CTI-JE: A Joint Extraction Framework of Entities and Relations in Unstructured Cyber Threat Intelligence

Advanced Persistent Threat (APT) pose an increasingly serious challenge to the security of businesses and organizations. In order to cope with these threats more effectively, effective utilization of cybers threat intelligence becomes crucial. Cyber Threat Intelligence(CTI) is characterized by fragmentation and voluminous, and information extraction can help cybersecurity researchers extract valuable information from massive cyber threat intelligence and understand the full picture of attack events. We propose a threat intelligence joint extraction model CTI-JE, which models the joint extraction problem as a table-filling task. CTI-JE uses SecBERT to generate embedding representations of words and then learns different representations for NER and RE tasks to avoid feature confusion. We construct a shared feature to enhance the interaction between subtasks, using dilated convolution and channel attention mechanism to extract fine-grained features. Experimental results on a cyber threat intelligence dataset show that our proposed model achieves better performance than existing baseline models.