BiLSTM-CRF: Improving Cybersecurity Text Analysis through Bidirectional LSTM-CRF (BiLSTM-CRF) Based Named Entity Recognition

Abstract

The cybersecurity documents such as vulnerability reports, bulletins and blogs provide key information about system weaknesses, threats and attacks. For organizing this unstructured text into structured data is important for faster threat detection and better decision-making. Most existing Named Entity Recognition (NER) systems are trained on general text and do not perform well in cybersecurity tasks. This study presents a Bidirectional LSTM-CRF model built for recognizing entities in cybersecurity documents. The model includes a word embedding layer a,  a Bidirectional Long Short-Term Memory (BiLSTM) network and a Conditional Random Field (CRF) layer to understand both the meaning of words and the relationship between labels. It is tested on an open-source benchmark cybersecurity dataset that contains blogs, security bulletins and Common Vulnerabilities and Exposures (CVE) records. The results show that the proposed model produces better accuracy than other baseline systems in identifying and classifying cybersecurity entities.