Xabcd: A Better Model for Named Entity Recognition in Cyber Threat Intelligence

Due to the ambiguity between naming entity nouns and daily usage nouns in cyber threat intelligence, such as hacker organizations, attack tools, and attack techniques, the understanding of their content heavily relies on cyber security knowledge. How to quickly and accurately extract named entities related to network security from multi-source texts has become a hot and difficult research topic in the current threat intelligence field. In this paper, a named entity recognition framework from cyber threat intelligence unstructured text is designed. For the business requirements in the field of cyber threat intelligence, this framework completely covers data acquisition, text classification, entity and relationship definition, entity and relationship analysis and modeling and ability application. The framework is available for experimental exploration of entity recognition technology for threat intelligence. In addition, this paper proposes an entity recognition model for cyber threat intelligence, Xabcd, based on data and feature knowledge. Based on open network security text corpus, Xabcd model obtained the key indicators such as precision, recall, and F1-score as 97.35%, 97.15% and 97.23% respectively, which are all higher than the baseline model levels, so the experimental results demonstrate the feasibility and effectiveness of the model.