DM_NLP at SemEval-2018 Task 8: neural sequence labeling with linguistic features

Proceedings of the 12th International Workshop on Semantic Evaluation (SemEval-2018), pages 707–711 New Orleans, Louisiana, June 5–6, 2018. ©2018 Association for Computational Linguistics DM NLP at SemEval-2018 Task 8: Neural Sequence Labeling with Linguistic Features Chunping Ma, Huafei Zheng, Pengjun Xie, Chen Li, Linlin Li, Si Luo Alibaba Group, China {chunping.mcp, huafei.zhf, chengchen.xpj, puji.lc, linyan.lll, luo.si}@alibaba-inc.com Abstract This paper describes our submissions for SemEval-2018 Task 8: Semantic Extraction from CybersecUrity REports using NLP. The DM NLP participated in two subtasks: Sub- Task 1 classifies if a sentence is useful for in- ferring malware actions and capabilities, and SubTask 2 predicts token labels (”Action”, ”Entity”, ”Modifier” and ”Others”) for a given malware-related sentence. Since we leverage results of Subtask 2 directly to infer the result of Subtask 1, the paper focus on the system solving Subtask 2. By taking Subtask 2 as a se- quence labeling task, our system relies on a re- current neural network named BiLSTM-CNN- CRF with rich linguistic features, such as POS tags, dependency parsing labels, chunking la- bels, NER labels, Brown clustering. Our sys- tem achieved the highest F1 score in both to- ken level and phrase level. 1 Introduction As a growing number of mobile devices and facil- ities are getting connected and digitized, malware attacks become increasingly rampant and danger- ous. CybersecUrity attracts more public attention but few NLP research and efforts. A large number of malware-related texts is available online, such as malware reports and relevant blogs (DiMaggio, 2015). However due to the sheer volume and di- versity of these texts, NLP researchers encounter problems to obtain valuable information, such as the specific actions taken by a certain malware and the capabilities described. Therefore, auto- matic screening malware-related contents and la- beling every token of the contents become poten- tial applications of NLP and have drawn growing research interests. In order to create a database in CybersecUrity domain which helps researchers to parse malware- related texts, the organizers of SemEval 2018 Task 8 (Phandi et al., 2018) (Lim et al., 2017)proposed the follow tasks: 1. SubTask1: Classify if a sentence is relevant for inferring malware actions and capabili- ties. 2. SubTask2: Predict token labels for a given malware-related text. 3. SubTask3: Predict relation labels for a given malware-related text. 4. SubTask4: Predict attribute labels for a given malware-related text. However, due to lack of time, we decided to ad- dress only SubTask 1 and SubTask 2. In this paper, we describe the system that we submitted for the SemEval 2018 shared task. Our system is based on RNN network and ranked first in both token level and phrase level. Most existing high performance sequence label- ing methods are linear statistical models, such as HMM (Hidden Markov Models) (Eddy, 1996) and CRF (Conditional Random Fields) (Lafferty et al., 2001). In the past few years, neural networks have been widely used to solve NLP problems. Spe- cially, several RNN-based neural networks have been proposed to handle sequence labeling tasks including Chinese word segmentation (Yao and …

Content truncated to 500 words