PROMPT-BART: A Named Entity Recognition Model Applied to Cyber Threat Intelligence

Source abstract

The escalating sophistication of cyberattacks necessitates automated extraction of machine-readable intelligence from unstructured Cyber Threat Intelligence (CTI). To address the dual challenges of limited standardized datasets and insufficient domain knowledge utilization, we propose CTINER, the first STIX 2.1-aligned dataset with 42,549 annotated entities across 13 cybersecurity-specific types, surpassing existing resources in scale (+51.82% more annotated entities) and vocabulary coverage (+40.39% more words), while ensuring label rationality and consistency. Furthermore, we introduce PROMPT-BART, a novel named entity recognition (NER) model based on the BART generative model. By integrating template prompting and demonstration learning, PROMPT-BART achieves F1 score improvements ranging from 4.26% to 8.3% over conventional deep learning baselines, and outperforms prompt-based learning baselines by 1.31%.