Cyber threat indicators extraction based on contextual knowledge prompt

Abstract

Extracting Indicators of Compromise (IOC) from security-related social data (e.g., security blogs, hacker forums) is crucial for predicting cyber risks and mitigating cyber attacks proactively. However, existing IOC extraction approaches suffer from two serious limitations. First, they fail to learn the multiculti-granular and fine-grained IOC features, resulting in high false positives. Second, current methods cannot incorporate symbolic rules and contextual knowledge, resulting in poor interpretability. In this paper, we propose AIIOC, an Accurate and Interpretable I O C extraction model based on contextual knowledge prompts. Particularly, AIIOC first proposes a multi-granularity attention mechanism to learn fine-grained IOC features and boost the accuracy of IOC identification. Additionally, AIIOC designs a novel sequence labeling method that integrates symbolic rules and contextual knowledge prompts, which can encode symbolic rules and contextual semantics of IOC in trainable recurrent neural networks to improve both accuracy and interpretability. Experimental results on two real-world datasets verify that AIIOC outperforms state-of-the-art methods and showcases promising interpretability by incorporating symbolic rules and contextual knowledge prompts.