用专家知识提升威胁情报抽取准确率,解决混淆与歧义问题。
TIJERE: A Novel Threat Intelligence Joint Extraction Model Based on Analyst Expert Knowledge

- 将实体关系抽取转为多序列标注,增强特征区分度
- 在网络安全数据集上实现93%以上命名实体识别与98%关系抽取准确率
- 开源首个联合标注的网络安全情报数据集,适合安全分析与模型研究者
从威胁情报报告中提取实体与关系并结构化为知识图谱,对自动化威胁分析、检测与缓解至关重要。然而现有联合抽取方法存在特征混淆、语言歧义、噪声传播和关系重叠等问题,导致准确率低、性能差。本文提出TIJERE,一种基于分析师专家知识的新型联合抽取框架,将联合抽取建模为多序列标注表示(MSLR)问题:为每对实体生成独立序列。不同于传统标注方案,MSLR融合专家领域特征,增强实体的位置、上下文与语义表征,提升特征区分度与分类精度。同时,通过使用在网络安全文本上微调的SecureBERT+上下文语言模型,减少语言歧义,增强领域泛化能力,显著提升命名实体识别(NER)与关系抽取(RE)性能。本文还构建了首个公开可用的联合标注网络安全实体与关系数据集DNRTI-JE,填补自动化威胁情报领域的空白。在自建的DNRTI-JE数据集上的实证评估显示,TIJERE在NER上取得超过0.93的F1分数,在RE上达到0.98,优于现有方法。TIJERE与标准化基准数据集共同支持高性能网络安全情报抽取,具备在医疗、金融、生物信息学等领域的可迁移应用潜力。
原文摘要 · Abstract (English)
The extraction of entities and relationships from threat intelligence reports into structured formats, such as cybersecurity knowledge graphs, is essential for automated threat analysis, detection, and mitigation. However, existing joint extraction methods struggle with feature confusion, language ambiguity, noise propagation, and overlapping relations, resulting in low accuracy and poor model performance. This paper presents TIJERE, an innovative joint entity and relation extraction framework that formulates joint extraction as a multisequence labeling representation (MSLR) problem. Specifically, separate sequences are generated for each entity pair. Unlike prior tagging schemes, MSLR integrates expert domain features to enrich positional, contextual, and semantic representations of entities, thereby enhancing feature distinction and classification accuracy. Additionally, TIJERE reduces language ambiguity and enhances domain-specific generalization by leveraging SecureBERT+, a contextual language model fine-tuned on cybersecurity text. This improves both named entity recognition (NER) and relation extraction (RE). This paper also introduces DNRTI-JE, the first publicly available jointly labeled dataset for cybersecurity entity and RE, filling a crucial gap in cyber threat intelligence automation. Empirical evaluations on the curated DNRTI-JE dataset demonstrate that TIJERE achieves state-of-the-art performance, with F1-scores exceeding 0.93 for NER and 0.98 for RE, outperforming existing methods. Together, TIJERE and the standardized benchmarking DNRTI-JE dataset enable high-performance cybersecurity intelligence extraction, with transferable applications in healthcare, finance, and bioinformatics.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。