BNER: A Broad Learning System-Based Named Entity Recognition Method for Cyber Threat Intelligence

Extracting cybersecurity-related entities (e.g., attack timestamps, vulnerabilities, and tools) from unstructured cyber threat intelligence (CTI) is a critical step in CTI analysis. However, cybersecurity is a field that requires both real-time processing and high accuracy, so information extraction methods must achieve efficiency and precision. Deep learning models rely on the backpropagation algorithm for gradient updates, resulting in high computational costs and long training times, making them unsuitable for cybersecurity field applications. Moreover, sequence labeling tasks such as NER often suffer from invalid tag transitions, leading to structurally incorrect outputs. To address the aforementioned limitations, this paper applies the Broad Learning System (BLS) to the task of named entity recognition (NER) in unstructured CTI, replacing the timeconsuming backpropagation process with matrix multiplication to enhance the efficiency of feature extraction while maintaining a high level of accuracy. In addition, a label-constrained algorithm is introduced to enforce valid tag transitions and eliminate structurally incorrect outputs in the sequence labeling process. Specifically, we first employ the bidirectional encoder of Transformer (BERT) for contextual feature extraction. Next, we use BLS to compute feature weight distributions. Finally, a label-constrained algorithm is applied to optimize the final results. Experimental results demonstrate that the proposed BNER (BLS Named Entity Recognition) model achieves a 51.88% improvement in F1-score over baseline methods on the DNRTI dataset, while reducing training time by $\mathbf{9 8. 1 4 \%}$.