The DOI matches its Crossref record; 23 of the 24 references it cites were found in a registry or an index.
Threat Intelligence Named Entity Recognition Based on Segment-Level Information Extraction and Similar Semantic Space Construction
Open accessAbstract
Threat intelligence is crucial for the early detection of network security threats, and named entity recognition (NER) plays a critical role in this process. However, traditional NER models based on sequence tagging primarily focus on word-level information for single-token entities, which leads to the inefficient extraction of multi-token entities in intelligence texts. Moreover, traditional NER models provide only a single semantic representation of intelligence texts, meaning that polysemous entities in intelligence texts cannot be effectively classified. To address these problems, this paper proposes a novel model based on segment-level information extraction and similar semantic space construction (SSNER). First, SSNER retrains the traditional BERT model based on a threat intelligence corpus and modifies BERT’s mask mechanism to extract the segment-level word embedding so that the ability of the SSNER to recognize multi-token entities is enhanced. Second, SSNER designs a similar semantic space construction method, which obtains compound semantic representations with symmetrical properties by filtering out the set of similar words and integrating them using self-attention to generate more accurate labels for the polysemous entities. The experimental results on two datasets, DNRTI and Bridges, indicate that SSNER outperforms both baseline and related models. In particular, SSNER achieves an F1-score of 96.02% on the Bridges dataset, exceeding the previous best model by approximately 1.46%.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
CyberNER-LLM extracts entities from threat-intelligence reports with accuracies that approach human-expert performance.
“CyberNER-LLM extracts entities from threat-intelligence reports with accuracies that approach human-expert performance”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [31]
CyberNER-LLM, KnowCTI, and segment-level CTI NER frameworks extract entities and relations from unstructured threat reports with accuracies up to 98% on cybercrime-forum corpora.
“CyberNER-LLM [29], KnowCTI [30], and segment-level CTI NER frameworks [31] extract entities and relations from unstructured threat reports with accuracies up to 98% on cybercrime-forum corpora.”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [31]
Citations
Cites
Focal Loss for Dense Object Detection
Lin, T.-Y., Goyal, P., Girshick, R., He, K., & Dollar, P. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.324 · Cited by 30,581
Language independent NER using a maximum entropy tagger
Curran, J. R., & Clark, S. (2003) · Conference on Computational Natural Language Learning · doi:10.3115/1119176.1119200 · Cited by 251
Husari, G., Al-Shaer, E. S., Ahmed, M., Chu, B., & Niu, X. (2017) · Annual Computer Security Applications Conference · doi:10.1145/3134600.3134646 · Cited by 222
SecureBERT: A Domain-Specific Language Model for Cybersecurity
Aghaei, E., Niu, X., Shadid, W., & Al-Shaer, E. (2023) · Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-25538-0_3 · Cited by 210
Creating Cybersecurity Knowledge Graphs From Malware After Action Reports
Piplai, A., Mittal, S., Joshi, A., Finin, T., Holt, J., & Zak, R. (2020) · IEEE Access · doi:10.1109/access.2020.3039234 · Cited by 114
A Knowledge-Based Approach to Intrusion Detection Modeling
More, S., Matthews, M., Joshi, A., & Finin, T. (2012) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2012.26 · Cited by 98
DNRTI: A Large-Scale Dataset for Named Entity Recognition in Threat Intelligence
Wang, X., Liu, X., Ao, S., Li, N., Jiang, Z., Xu, Z., Xiong, Z., Xiong, M., & Zhang, X. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00252 · Cited by 91
Towards a Relation Extraction Framework for Cyber-Security Concepts
Jones, C. L., Bridges, R. A., Huffer, K. M. T., & Goodall, J. R. (2015) · Annual Cyber and Information Security Research Conference (CISRC) · doi:10.1145/2746266.2746277 · Cited by 84
Processing tweets for cybersecurity threat awareness
Alves, F., Bettini, A., Ferreira, P., & Bessani, A. (2020) · Information Systems · doi:10.1016/j.is.2020.101586 · Cited by 83
A Systematic Literature Review on AI-Based Methods and Challenges in Detecting Zero-Day Attacks
Por, L. Y., Dai, Z., Leem, S. J., Chen, Y., Yang, J., Binbeshr, F., Phan, K. Y., & Ku, C. S. (2024) · IEEE Access · doi:10.1109/access.2024.3455410 · Cited by 80
A network security entity recognition method based on feature template and CNN-BiLSTM-CRF
Qin, Y. N., Shen, G., Zhao, W., Chen, Y., Yu, M., & Jin, X. (2019) · Frontiers of Information Technology & Electronic Engineering · doi:10.1631/fitee.1800520 · Cited by 69
Data and knowledge-driven named entity recognition for cyber security
Gao, C., Zhang, X., & Liu, H. (2021) · Cybersecurity · doi:10.1186/s42400-021-00072-y · Cited by 67
CTI View: APT Threat Intelligence Analysis System
Zhou, Y., Tang, Y., Yi, M., Chuan-yu, X., & Lu, H. (2022) · Security and Communication Networks · doi:10.1155/2022/9875199 · Cited by 55
Named Entity Recognition Using BERT with Whole World Masking in Cybersecurity Domain
Zhou, S., Liu, J., Zhong, X., & Zhao, W. (2021) · IEEE International Conference on Big Data Analytics (ICBDA) · doi:10.1109/icbda51983.2021.9403180 · Cited by 51
Wang, X., & Liu, J. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.110114 · Cited by 47
McNeil, N., Bridges, R. A., Iannacone, M. D., Czejdo, B., Perez, N., & Goodall, J. R. (2013) · International Conference on Machine Learning and Applications · doi:10.1109/icmla.2013.106 · Cited by 40
Liu, P., Li, H., Wang, Z., Liu, J., Ren, Y., & Zhu, H. (2022) · Proceedings - International Conference on Pattern Recognition/Proceedings/International Conference on Pattern Recognition · doi:10.1109/icpr56361.2022.9956373 · Cited by 28
Cyberattack Prediction Through Public Text Analysis and Mini-Theories
Perera, I., Hwang, J. D., Bayas, K., Dorr, B. J., & Wilks, Y. A. (2018) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2018.8622106 · Cited by 26
Kim, E., Kim, K., Shin, D., Jin, B., & Kim, H. (2018) · International Conference on Future Internet Technologies · doi:10.1145/3226052.3226056 · Cited by 23
IDCNN-CRF-based domain named entity recognition method
Yu, B., & Wei, J. (2020) · IEEE International Conference on Civil Aviation Safety and Information Technology (ICCASIT) · doi:10.1109/iccasit50869.2020.9368795 · Cited by 20
Kristiansen, L.-M., Agarwal, V., Franke, K., & Shah, R. S. (2020) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata50022.2020.9378393 · Cited by 16
Yan, J., Du, Z., Li, J., Yang, S., Jing-hao, L., & Li, J. (2022) · Security and Communication Networks · doi:10.1155/2022/7729456 · Cited by 10
Relation Extraction Techniques in Cyber Threat Intelligence
Arikkat, D. R., Vinod, P., A., R. R. K., Nicolazzo, S., Nocera, A., & Conti, M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70239-6_24 · Cited by 6
Flagged first, then by citations
1 of the 24 references couldn’t be matched to a known paper.
Research works printed but not linked: 6
- Peng, W., Ding, J., Wang, W., Cui, L., Cai, W., Hao, Z., and Yun, X. (2024). CTISum: A New Benchmark Dataset For Cyber Threat Intelligence Summarization. arXiv.
- Dong, Y., Guo, W., Chen, Y., Xing, X., Zhang, Y., and Wang, G. (2019, January 14–16). Towards the detection of inconsistencies in public security vulnerability reports. Proceedings of the 28th USENIX Security Symposium (USENIX Security 19), Santa Clara, CA, USA.
- Huang, L., and Xiao, X. (2025, January 7–10). CTIKG: LLM-Powered Knowledge Graph Construction from Cyber Threat Intelligence. Proceedings of the First Conference on Language Modeling, Montreal, QC, Canada.
- Huang, Z., Xu, W., and Yu, K. (2015). Bidirectional LSTM-CRF models for sequence tagging. arXiv.
- Kingma, D.P., and Ba, J. (2014). Adam: A method for stochastic optimization. arXiv.
- Bridges, R.A., Jones, C.L., Iannacone, M.D., Testa, K.M., and Goodall, J.R. (2013). Automatic labeling for entity extraction in cyber security. arXiv.
Cited by
Sorted by citations
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4
“CyberNER-LLM extracts entities from threat-intelligence reports with accuracies that approach human-expert performance [29,31].”
InfluentialLi, Y., Li, X., Zhang, Y., Liu, Z., Li, X., Xu, Q., & Chang, X. (2026) · Entropy · doi:10.3390/e28030261
A gated feature fusion model for entity recognition in open-source intelligence
Feng, G., & Chen, H. (2026) · Pattern Recognition · doi:10.1016/j.patcog.2026.113690
Feature-Augmented Iterative Critique: Enhancing Low-Resource LLMs for Threat Intelligence Extraction
Zhou, J., Wang, P., Dai, G., Ma, D., & Liu, F. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581619
Yang, C. R., Bao, J., Shang, Y., Ding, H., Guo, Q., Liao, Y., Zhou, R., & Xiong, N. N. (2026) · IET Communications · doi:10.1049/cmu2.70187
Li, J., Yang, L., & Che, B. (2026) · International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/icccs69761.2026.11613446
Chen, L., Zhao, C., Deng, J., Zuo, D., & Jianjiang, Z. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11729965
Self-citation
Metadata
- Authors
- Chen, L., Deng, H., Zhang, J., Zheng, B., & Jiang, R.
- Affiliations
- China West Normal University (CN)
- Corresponding author
- Deng, Hongli
- Zheng, Bochuan
- Venue
- Symmetry
- Publisher
- MDPI AG
- Published
- 2025-05-19
- Volume
- 17
- Issue
- 5
- Pages
- 783
- ISSN
- 2073-8994 (ISSN-L)
- OpenAlex
- W4410518371
- Cited by
- 7
- References
- 24
- Citations by year
- 2026: 7
- FWCI
- 2.83
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Symmetry (publishedVersion, cc-by)
- Funders
- Sichuan Province Science and Technology Support Program (2024ZYD0272)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
- Physical Sciences › Computer Science › Artificial Intelligence › Natural Language Processing Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- threat intelligence, named entity recognition, polysemy, BERT, masked language models, self-attention
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
