提升威胁情报知识图谱实体关系抽取准确率,解决报告复杂语义带来的误判问题。
Context-aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs

- 融合SecureBERT+与领域本体知识,增强上下文理解能力。
- 在DNRTI-AUG-STIX2数据集上,实体识别和关系抽取分别提升3-4%和最高8%。
- 适合安全研究人员与自动化威胁分析系统开发者使用。
网络安全知识图谱(CKGs)将多元威胁情报(CTI)源整合为结构化、可查询的格式,显著提升安全响应的自动化与实时性。然而,构建CKGs需从非结构化报告中提取实体-关系三元组,面临报告结构复杂、领域语言特殊及语义模糊等挑战,现有流水线方法常因错误传播导致准确率下降。本文提出上下文感知的威胁情报知识图谱框架CTiKG,通过混合NLP模型结合SecureBERT+上下文嵌入与领域本体知识,减少误分类与级联错误。在包含21种实体类型的DNRTI-AUG-STIX2数据集上,相比最先进基线,实体识别性能提升3-4%,关系抽取最高提升8%,基于精确率、召回率与F1分数评估。在DNRTI与STUCCO基准上的额外验证证实了该框架的鲁棒性与实用性。所有数据集,包括整理后的DNRTI-AUG-STIX2,已开源至GitHub,促进复现与研究。
原文摘要 · Abstract (English)
Cybersecurity Knowledge Graphs (CKGs) unify diverse Cyber Threat Intelligence (CTI) sources into structured, queryable formats, offering scalable solutions for automating proactive and real-time security responses. Their increasing adoption has significantly enhanced the workflow and decision-making efficiency of security professionals. However, constructing CKGs requires extracting entity-relation triples from unstructured CTI reports, a task hindered by complex report structure, domain-specific language, and semantic ambiguity. As a result, existing pipeline-based approaches often suffer from error propagation, reducing extraction accuracy and limiting generalizability. This paper introduces the Context-aware Threat Intelligence Knowledge Graph (CTiKG) framework, a pipeline architecture designed to accurately extract and classify threat entities and their relationships from CTI reports. CTiKG incorporates hybrid NLP models that leverage SecureBERT+ contextual embeddings and expert knowledge from a domain ontology to reduce misclassifications and mitigate cascading errors. Experiments on the DNRTI-AUG-STIX2 dataset, which comprises 21 entity types aligned with STIX 2.1, demonstrate significant improvements over state-of-the-art baselines, yielding 3-4% gains in NER and up to 8% in RE performance, based on precision, recall, and F1-score. Additional validation on DNRTI and STUCCO benchmarks confirms the framework's robustness and practical applicability. All datasets, including the curated DNRTI-AUG-STIX2, are released on GitHub to foster reproducibility and further research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。