[Paper Review] OntoEnricher: A Deep Learning Approach for Ontology Enrichment from Unstructured Text.

Lalit Mohan Sanagavarapu, Vivek Iyer+1 more|arXiv (Cornell University)|Feb 8, 2021

Information and Cyber Security9 references4 citations

TL;DR

OntoEnricher proposes a deep learning approach using bidirectional LSTMs and Universal Sentence Encoder to automatically enrich information security ontologies by extracting security concepts—such as vulnerabilities, threats, and controls—from unstructured text. The method achieves over 80% test accuracy in identifying knocked-out ontology concepts, demonstrating robustness in contextual concept extraction.

ABSTRACT

Information Security in the cyber world is a major cause for concern, with significant increase in the number of attack surfaces. Existing information on vulnerabilities, attacks, controls, and advisories available on the web provides an opportunity to represent knowledge and perform security analytics to mitigate some of the concerns. Representing security knowledge in the form of ontology facilitates anomaly detection, threat intelligence, reasoning and relevance attribution of attacks, and many more. This necessitates dynamic and automated enrichment of information security ontologies. However, existing ontology enrichment algorithms based on natural language processing and ML models have issues with the contextual extraction of concepts in words, phrases and sentences. This motivates the need for sequential Deep Learning architectures that traverse through dependency paths in text and extract embedded vulnerabilities, threats, controls, products and other security related concepts and instances from learned path representations. In the proposed approach, Bidirectional LSTMs trained on a large DBpedia dataset and Wikipedia corpus of 2.8 GB along with Universal Sentence Encoder was deployed to enrich ISO 27001 based information security ontology. The approach yielded a test accuracy of over 80\% when tested with knocked out concepts from ontology and web page instances to validate the robustness.

Motivation & Objective

• Address the growing need for dynamic, automated enrichment of information security ontologies due to the expanding attack surface in cyberspace.
• Overcome limitations of existing NLP and ML-based ontology enrichment methods in capturing contextual relationships in words, phrases, and sentences.
• Enable robust extraction of security-relevant concepts—such as vulnerabilities, threats, controls, and products—from unstructured web text.
• Improve the scalability and contextual accuracy of ontology enrichment by leveraging sequential deep learning over dependency paths in text.

Proposed method

• Employ bidirectional Long Short-Term Memory (LSTM) networks trained on a large-scale corpus including DBpedia and a 2.8 GB Wikipedia dataset.
• Utilize the Universal Sentence Encoder to generate contextual sentence embeddings that enhance semantic understanding of input text.
• Process dependency paths in text to model sequential relationships between words and phrases, enabling deeper contextual extraction of security concepts.
• Train the model to identify and map entities such as vulnerabilities, threats, controls, and products to predefined classes in the ISO 27001-based information security ontology.
• Validate the model’s robustness by testing on instances with deliberately removed ontology concepts and assessing recovery accuracy.

Experimental results

Research questions

• RQ1 Can deep learning models effectively extract security-relevant concepts from unstructured text with high contextual accuracy?
• RQ2 How well do bidirectional LSTMs combined with pre-trained sentence encoders perform in enriching information security ontologies compared to traditional NLP methods?
• RQ3 To what extent can the model generalize and recover missing or knocked-out concepts in an ontology when presented with real-world web text?
• RQ4 How effective is the use of dependency path traversal in capturing semantic relationships critical for ontology enrichment?

Key findings

• The OntoEnricher model achieved a test accuracy of over 80% when evaluating the recovery of knocked-out concepts from the ISO 27001-based information security ontology.
• The integration of bidirectional LSTMs with the Universal Sentence Encoder significantly improved contextual understanding of security-related text.
• Sequential processing of dependency paths enabled the model to capture nuanced semantic relationships between terms, enhancing concept extraction precision.
• The model demonstrated robustness in handling real-world, unstructured web content, making it suitable for dynamic ontology enrichment in cyber threat intelligence applications.