# CyNER: A Python Library for Cybersecurity Named Entity Recognition

arXiv: https://arxiv.org/abs/2204.05754 · HTML: https://mlsanity.com/paper/2204.05754/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 19 references that are in the map.
- First posted on arXiv 8 Apr 2022.

## Builds on (most cited first, 4 of 4)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [Unsupervised Cross-lingual Representation Learning at Scale](https://mlsanity.com/paper/1911.02116/) (2019)
- [MALOnt: An Ontology for Malware Threat Intelligence](https://mlsanity.com/paper/2006.11446/) (2020)

## Built on by (most cited first, 6 of 6)

- [MORPH: Towards Automated Concept Drift Adaptation for Malware Detection](https://mlsanity.com/paper/2401.12790/) (2024)
- [CANAL -- Cyber Activity News Alerting Language Model: Empirical Approach vs. Expensive LLM](https://mlsanity.com/paper/2405.06772/) (2024)
- [AttackER: Towards Enhancing Cyber-Attack Attribution with a Named Entity Recognition Dataset](https://mlsanity.com/paper/2408.05149/) (2024)
- [Recognizing and Extracting Cybersecurtity-relevant Entities from Text](https://mlsanity.com/paper/2208.01693/) (2022)
- [From Ambiguity to Explicitness: NLP-Assisted 5G Specification Abstraction for Formal Analysis](https://mlsanity.com/paper/2308.03277/) (2023)
- [Towards a scalable AI-driven framework for data-independent Cyber Threat Intelligence Information Extraction](https://mlsanity.com/paper/2501.06239/) (2025)

## Abstract (arXiv)

Open Cyber threat intelligence (OpenCTI) information is available in an unstructured format from heterogeneous sources on the Internet. We present CyNER, an open-source python library for cybersecurity named entity recognition (NER). CyNER combines transformer-based models for extracting cybersecurity-related entities, heuristics for extracting different indicators of compromise, and publicly available NER models for generic entity types. We provide models trained on a diverse corpus that users can readily use. Events are described as classes in previous research - MALOnt2.0 (Christian et al., 2021) and MALOnt (Rastogi et al., 2020) and together extract a wide range of malware attack details from a threat intelligence corpus. The user can combine predictions from multiple different approaches to suit their needs. The library is made publicly available.