Information Extraction of Cybersecurity Concepts: An LSTM Approach

Abstract

Extracting cybersecurity entities and the relationships between them from online textual resources such as articles, bulletins, and blogs and converting these resources into more structured and formal representations has important applications in cybersecurity research and is valuable for professional practitioners. Previous works to accomplish this task were mainly based on utilizing feature-based models. Feature-based models are time-consuming and need labor-intensive feature engineering to describe the properties of entities, domain knowledge, entity context, and linguistic characteristics. Therefore, to alleviate the need for feature engineering, we propose the usage of neural network models, specifically the long short-term memory (LSTM) models to accomplish the tasks of Named Entity Recognition (NER) and Relation Extraction (RE). We evaluated the proposed models on two tasks. The first task is performing NER and evaluating the results against the state-of-the-art Conditional Random Fields (CRFs) method. The second task is performing RE using three LSTM models and comparing their results to assess which model is more suitable for the domain of cybersecurity. The proposed models achieved competitive performance with less feature-engineering work. We demonstrate that exploiting neural network models in cybersecurity text mining is effective and practical.

Automatic Part-of-Speech Tagging for Security Vulnerability Descriptions

“…Manual analysis of security vulnerabilities demands high expertise and imposes a huge burden on security analysts, which inevitably limits productivity. Thus, it is extremely useful to automate this process and recommend potentially vulnerable source files to security experts and developers with a given vulnerability description [4]. Hence, POS tagging is one of the early phases to be automated.…”

“…Moreover, decimal numbers "3.0" and "6.5" that respectively follow a product "V 2I Hub" and "W ebAccess" provide critical information about which versions of a product are vulnerable to SQL injection or XSS vulnerabilities. The NLP approaches identify "3.0" and "6.5" as cardinal numbers; however, decimal numbers that follow a software product are expected to be versions of that product and not quantities of it [4]. Hence, in the security vulnerability domain, they are identified as proper nouns.…”

“…1) Unannotated Corpus Preparation: Unlike traditional POS taggers, e.g., the PTB Project [19], a corpus dedicated to security vulnerability research is not widely available [4]. Thus, we begin our work by preparing a corpus of security vulnerabilities from online data sources.…”

“…to tokens in SVD, is challenging due to its content includes high-level natural language descriptions of the text composed of a mixed language studded with codes, domain-specific jargon, vague language, and averviations [1]. In reality, identifying a tokens functional role within a SVD and annotating each of the tokens with POS tags is useful for a wide scope of downstream applications ranging from domain-specific NER [3], [4] to more sophisticated uses such as security vulnerability systems [5]- [7]. Hence, POS tagging is the foundation of many downstream applications and a prerequisite for a wide range of systems [8].…”

Quantifying the Significance and Relevance of Cyber-Security Text Through Textual Similarity and Cyber-Security Knowledge Graph

“…Simran et al proposed a deep-learning-based framework for NER in cybersecurity and evaluated various deep-learning architectures [15]. Gasmi et al proposed an LSTM model for NER and Relation Extraction tasks [16]. Even though, not a deep learning approach Yi et al also proposed cyber-security NER model based on regular expressions and known-entity dictionary [17].…”