The Open Source Threat Intelligence Relational Dataset and Its Optimal Implementation

Threat intelligence provides a platform for cybersecurity engineers for attack traceability, which provides substantial knowledge database logs to defend against future security threats. Threat intelligence relationship extraction based on deep learning solves the challenge of threat knowledge construction to a certain extent but still faces problems such as lack of open-source datasets and the inability of the model to accurately correlate threat entities with potential relationships. Therefore, for cybersecurity research work, this paper designs a threat ontology, constructs the threat relationship dataset TreatRE by remote supervision, and opens this dataset. The dataset contains 12000 utterances and 12 threat relations from 500 CTIs, and it performs well in multiple relation models trained on deep learning methods. Meanwhile, we propose a multisensory attention-based threat intelligence relationship extraction method MAtt, which combines location perception, self-attention perception, and neuronal memory perception to further improve the threat relationship extraction effect. Experimental results show that the trained model based on TreatRE can more accurately extract the knowledge objects and their relationships described in threat intelligence. An accuracy score of 95.4% can be obtained using the MAtt method, which is 3.48% more than the best baseline compared with the same type of relationship extraction model.

I. Introduction

Threat intelligence relationship extraction plays a very important role in threat intelligence processing and analysis. When unstructured threat information is extracted as "entity-relationship-entity", such relationship triad is more effective in helping security analysts to quickly understand the connection between threat entities and to analyze the potential relevance of the threat information. Fig. 1 shows a threat information relationship extraction statement.