Open Access

ARTICLE

Adversarial Active Learning for Named Entity Recognition in Cybersecurity

Tao Li¹, Yongjin Hu^1,*, Ankang Ju¹, Zhuoran Hu²

1 Zhengzhou Institute of Information Science and Technology, Zhengzhou, 450001, China
2 College of Letters and Science, University of Wisconsin-Madison, Madison, 53706, USA

* Corresponding Author: Yongjin Hu. Email:

Computers, Materials & Continua 2021, 66(1), 407-420. https://doi.org/10.32604/cmc.2020.012023

Received 10 June 2020; Accepted 25 July 2020; Issue published 30 October 2020

Abstract

Owing to the continuous barrage of cyber threats, there is a massive amount of cyber threat intelligence. However, a great deal of cyber threat intelligence come from textual sources. For analysis of cyber threat intelligence, many security analysts rely on cumbersome and time-consuming manual efforts. Cybersecurity knowledge graph plays a significant role in automatics analysis of cyber threat intelligence. As the foundation for constructing cybersecurity knowledge graph, named entity recognition (NER) is required for identifying critical threat-related elements from textual cyber threat intelligence. Recently, deep neural network-based models have attained very good results in NER. However, the performance of these models relies heavily on the amount of labeled data. Since labeled data in cybersecurity is scarce, in this paper, we propose an adversarial active learning framework to effectively select the informative samples for further annotation. In addition, leveraging the long short-term memory (LSTM) network and the bidirectional LSTM (BiLSTM) network, we propose a novel NER model by introducing a dynamic attention mechanism into the BiLSTM-LSTM encoderdecoder. With the selected informative samples annotated, the proposed NER model is retrained. As a result, the performance of the NER model is incrementally enhanced with low labeling cost. Experimental results show the effectiveness of the proposed method.

---

Keywords

---