# Towards a relation extraction framework for cyber-security concepts

arXiv: https://arxiv.org/abs/1504.04317 · HTML: https://mlsanity.com/paper/1504.04317/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Apr 2015.

## Built on by (most cited first, 9 of 9)

- [Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI](https://mlsanity.com/paper/2211.01753/) (2022)
- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniques](https://mlsanity.com/paper/2207.08478/) (2022)
- [From Threat Reports to Continuous Threat Intelligence: A Comparison of Attack Technique Extraction Methods from Textual Artifacts](https://mlsanity.com/paper/2210.02601/) (2022)
- [Multi-features based Semantic Augmentation Networks for Named Entity Recognition in Threat Intelligence](https://mlsanity.com/paper/2207.00232/) (2022)
- [Constructing a Knowledge Graph from Textual Descriptions of Software Vulnerabilities in the National Vulnerability Database](https://mlsanity.com/paper/2305.00382/) (2023)
- [LSTM Recurrent Neural Networks for Cybersecurity Named Entity Recognition](https://mlsanity.com/paper/2409.10521/) (2024)
- [A Deep Learning Approach for Ontology Enrichment from Unstructured Text](https://mlsanity.com/paper/2112.08554/) (2021)
- [Automated Mapping of CVE Vulnerability Records to MITRE CWE Weaknesses](https://mlsanity.com/paper/2304.11130/) (2023)

## Abstract (arXiv)

In order to assist security analysts in obtaining information pertaining to their network, such as novel vulnerabilities, exploits, or patches, information retrieval methods tailored to the security domain are needed. As labeled text data is scarce and expensive, we follow developments in semi-supervised Natural Language Processing and implement a bootstrapping algorithm for extracting security entities and their relationships from text. The algorithm requires little input data, specifically, a few relations or patterns (heuristics for identifying relations), and incorporates an active learning component which queries the user on the most important decisions to prevent drifting from the desired relations. Preliminary testing on a small corpus shows promising results, obtaining precision of .82.