Extracting Multiple Relations between Entities from Unstructured Threat Intelligence Reports

Abstract

Abstract— Cyber threats are becoming an ever-increasing concern for organizations and even countries. Attackers are constantly in search of new and sophisticated attack vectors. On the other side, security defenders need to gather as much as possible information about the threats on the Internet and analyze them to understand current and emerging attack trends for effectively detecting and mitigating potential threats with fast response. This paper addresses the problem of automatically extracting threat intelligence from unstructured text sources. We focus specifically on the possibility of multiple relations between two entities and propose a two-stage process that allows any binary classifier to be used for multi-class classification without interfering with the binary algorithm used. The experimental results illustrate the efficiency of our proposed approach.