Named Entity Recognition in Information Security Domain for Russian

Proceedings of Recent Advances in Natural Language Processing, pages 1114–1120, Varna, Bulgaria, Sep 2–4, 2019. https://doi.org/10.26615/978-954-452-056-4_128 1114 Named Entity Recognition in Information Security Domain for Russian Sirotina Anastasiia Lomonosov Moscow State University (Russia) overnastuhed@yandex.ru Loukachevich Natalia Lomonosov Moscow State University (Russia) louk_nat@mail.ru Abstract In this paper we discuss the named entity recognition task for Russian texts related to cybersecurity. First of all, we describe the problems that arise in course of label- ing unstructured texts from information security domain. We introduce guidelines for human annotators, according to which a corpus has been marked up. Then, a CRF-based system and different neural ar- chitectures have been implemented and applied to the corpus. The named entity recognition systems have been evaluated and compared to determine the most effi- cient one. 1 Introduction For a cybersecurity expert, it is vital to stay aware of all of the newly discovered vulnerabilities and exploits. Although various security databases, such as National Vulnerability Database (NVD) or MS Bulletins, contain detailed information on var- ious cybersecurity problems, they do not usually provide any data on the latest discoveries. The most up-to-date descriptions of vulnerabilities are usually posted on specific websites and forums in form of unstructured informal texts. Therefore, a system extracting relevant cybersecurity infor- mation from unstructured publications could be of great use for a cybersecurity expert. As there are a lot of NER systems for news documents, the first idea one comes up with is to apply such a system to the cybersecurity domain. Unfortunately, all such attempts prove to be un- successful for two reasons. Firstly, there is a great difference between general news documents and informal publications on cybersecurity: the latter contain a lot of non-vocabulary words (such as jargonisms, borrowings and domain-specific terms), include various grammar and spelling mis- takes and use spoken syntax. What is more, changing the domain, where the extraction is con- ducted, usually means that some new named enti- ty types should be accounted for (e.g. for cyberse- curity domain these are names of programs and viruses). As none of the existing NER systems can be applied to the cybersecurity domain, our only option is to create a new system, which is trained on a newly labeled corpus, where all the domain- specific names and terms are taken into account. This paper observes the named entity recogni- tion (NER) task for unstructured Russian texts re- lated to cybersecurity. Our first step is a thorough analysis of unstructured texts related to cybersecu- rity, elaboration of guidelines for human annota- tors and, finally, corpus labeling. At the second step, we implement several NER systems (one based on CRF-method and others based on artifi- cial neural networks), apply them to the corpus, evaluate and compare of the results shown by the systems. 2 Related Work The information extraction task in cybersecurity domain has been discussed in several works. However, the vast majority of the works consider information extraction only from structured or semi-structured English texts. For instance, (Bridges et al., 2013) …

Content truncated to 500 words