[Paper Review] LSTM Recurrent Neural Networks for Cybersecurity Named Entity Recognition

Houssem Gasmi, Jannik Laval+1 more|arXiv (Cornell University)|Aug 30, 2024

Topic Modeling14 references47 citations

TL;DR

The paper presents a domain-independent LSTM-CRF approach for cybersecurity named entity recognition that does not rely on hand-crafted features and outperforms state-of-the-art methods on a sufficiently sized annotated corpus.

ABSTRACT

The automated and timely conversion of cybersecurity information from unstructured online sources, such as blogs and articles to more formal representations has become a necessity for many applications in the domain nowadays. Named Entity Recognition (NER) is one of the early phases towards this goal. It involves the detection of the relevant domain entities, such as product, version, attack name, etc. in technical documents. Although generally considered a simple task in the information extraction field, it is quite challenging in some domains like cybersecurity because of the complex structure of its entities. The state of the art methods require time-consuming and labor intensive feature engineering that describes the properties of the entities, their context, domain knowledge, and linguistic characteristics. The model demonstrated in this paper is domain independent and does not rely on any features specific to the entities in the cybersecurity domain, hence does not require expert knowledge to perform feature engineering. The method used relies on a type of recurrent neural networks called Long Short-Term Memory (LSTM) and the Conditional Random Fields (CRFs) method. The results we obtained showed that this method outperforms the state of the art methods given an annotated corpus of a decent size.

Motivation & Objective

• Automate and expedite the conversion of cybersecurity information from unstructured online sources into formal representations.
• Address the challenge of NER in cybersecurity where entities have complex structures and domain-specific cues.
• Develop a model that does not require expert feature engineering specific to cybersecurity.
• Demonstrate that a neural sequence-labeling approach can achieve strong performance without domain-specific features.

Proposed method

• Use a Long Short-Term Memory (LSTM) recurrent neural network for sequence labeling.
• Combine LSTM with Conditional Random Fields (CRF) for structured prediction of entities.
• Avoid any features tailored to cybersecurity entities; rely on domain-independent representations.
• Train on an annotated corpus and evaluate against state-of-the-art methods.
• Demonstrate that the approach outperforms baselines given a sufficiently large annotated dataset.

Experimental results

Research questions

• RQ1 Can an LSTM-CRF model, without domain-specific feature engineering, effectively perform cybersecurity named entity recognition?
• RQ2 Does a domain-independent neural approach outperform state-of-the-art methods on cybersecurity NER when provided with a decent annotated corpus?
• RQ3 To what extent does annotated data size influence the performance gains of LSTM-CRF in cybersecurity NER?

Key findings

• The method outperforms state-of-the-art methods given an annotated corpus of a decent size.