Abstract
The automatic extraction of information from Cyber Threat Intelligence (CTI) reports is crucial in risk management. The increased frequency of the publications of these reports has led researchers to develop new systems for automatically recovering different types of entities and relations from textual data. Most state-of-the-art models leverage Natural Language Processing (NLP) techniques, which perform greatly in extracting a few types of entities at a time but cannot detect heterogeneous data or their relations. Furthermore, several paradigms, such as STIX, have become de facto standards in the CTI community and dictate a formal categorization of different entities and relations to enable organizations to share data consistently. This paper presents STIXnet, the first solution for the automated extraction of all STIX entities and relationships in CTI reports. Through the use of NLP techniques and an interactive Knowledge Base (KB) of entities, our approach obtains F1 scores comparable to state-of-the-art models for entity extraction (0.916) and relation extraction (0.724) while considering significantly more types of entities and relations. Moreover, STIXnet constitutes a modular and extensible framework that manages and coordinates different modules to merge their contributions uniquely and exhaustively. With our approach, researchers and organizations can extend their Information Extraction (IE) capabilities by integrating the efforts of several techniques without needing to develop new tools from scratch.
Original language | English |
---|---|
Title of host publication | ARES 2023 - 18th International Conference on Availability, Reliability and Security, Proceedings |
Publisher | Association for Computing Machinery (ACM) |
ISBN (Electronic) | 9798400707728 |
DOIs | |
Publication status | Published - 29 Aug 2023 |
Externally published | Yes |
Event | 18th International Conference on Availability, Reliability and Security, ARES 2023 - Benevento, Italy Duration: 29 Aug 2023 → 1 Sept 2023 |
Conference
Conference | 18th International Conference on Availability, Reliability and Security, ARES 2023 |
---|---|
Country/Territory | Italy |
City | Benevento |
Period | 29/08/23 → 1/09/23 |
Keywords
- Cyber Threat Intelligence
- Information Extraction
- Natural Language Processing
- STIX