HCCL at SemEval-2018 Task 8: An End-to-End System for Sequence Labeling from Cybersecurity Reports

Proceedings of the 12th International Workshop on Semantic Evaluation (SemEval-2018), pages 874–877 New Orleans, Louisiana, June 5–6, 2018. ©2018 Association for Computational Linguistics HCCL at SemEval-2018 Task 8: An End-to-End System for Sequence Labeling from Cybersecurity Reports Mingming Fu 1,2, Xuemin Zhao 1 , Yonghong Yan 1,2,3 1The Key Laboratory of Speech Acoustics and Content Understanding Institute of Acoustics, Chinese Academy of Sciences 2University of Chinese Academy of Sciences 3Xinjiang Laboratory of Minority Speech and Language Information Processing Xinjiang Technical Institute of Physics and Chemistry, Chinese Academy of Sciences {fumingming,zhaoxuemin,yanyonghong}@hccl.ioa.ac.cn Abstract This paper describes HCCL team systems that participated in SemEval 2018 Task 8: Se- cureNLP (Semantic Extraction from cyberse- curity reports using NLP). To solve the prob- lem, our team applied a neural network ar- chitecture that benefits from both word and character level representaions automatically, by using combination of Bi-directional LSTM, CNN and CRF (Ma and Hovy, 2016). Our system is truly end-to-end, requiring no fea- ture engineering or data preprocessing, and we ranked 4th in the subtask 1, 7th in the subtask 2 and 3rd in the SubTask2-relaxed. 1 Introduction Recently, cybersecurity defense has also been rec- ognized as one of the problem areas likely to be important both for advancing AI and for its long- run impact on society. In particular, natural lan- guage processing (NLP) has the potential for sub- stantial contribution in cybersecurity and that this is a critical research area given the urgency and risks involved (Lim et al., 2017). In SemEval 2018 Task 8 (Phandi et al., 2018), there are four subtask: 1. SubTask1: Classify if a sentence is useful for inferring malware actions and capabilities 2. SubTask2: predict the token labels in the sen- tences. The output needs to be in BIO format. There are 3 types of token labels: ”Action”, ”Entity”, and ”Modifier”. 3. SubTask3: predict the relations between the token labels 4. SubTask4: predict the attributes for each en- tity token In this evaluation, our team submitted the re- sults of Subtask 1 and Subtask 2. To tackle this problem, we treat subtask 2 as a sequence labeling problem. Most traditional high performance se- quence labeling models are linear statistical mod- els, including Hidden Markov Models (HMM) and Conditional Random Fields (CRF) (Luo et al., 2015), which rely heavily on hand-crafted features and taskspecific resources. Recently, many neural network based meth- ods have been successfully applied to sequence labeling task: Named Entity Recognition (Lam- ple et al., 2016). In this paper, we present an end-to-end System (combined CNN, LSTM and CRF) for sequence labeling that uses no compli- cated handcrafted features or domain knowledge. LSTM is capable of learning long-term depen- dencies, which is beneficial to sequence modeling tasks. And character level CNN can get character- level representation. For sequence labeling (or general structured prediction) tasks, it is benefi- cial to consider the correlations between labels in neighborhoods and jointly decode the best chain of labels for a given input sentence. So we model label sequence jointly using a …

Content truncated to 500 words