{'fraction_non_alphanumeric': 0.03195207189216176, 'fraction_numerical': 0.01597603594608088, 'mean_word_length': 5.77027027027027, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Threat Intelligence Relationship Extraction Based on Distant Supervision and Reinforcement Learning

In recent years, threat intelligence has become a new hotspot in cybersecurity. It analyzes and predicts attacks that have occurred and have not occurred, and plays an important role in building an efficient defense system. Traditional threat intelligence relies on a manual collection and its efficiency is relatively low. Therefore, the efficient sharing of threat intelligence has important research value. For the information extraction technology of threat intelligence, we focus on the construction of threat intelligence labeling data sets and the extraction technology of threat intelligence relationship. The specific content and research results include two aspects: (1) Research on the construction of threat intelligence information extraction data set. The threat intelligence extraction data set is constructed by a distantly supervised labeling method. In this paper, more than 900 threat intelligence reports are used as a corpus. We finally obtain a relation extraction data set containing 10,000 sentence instances of 30 relationships. (2) Research on the extraction of threat intelligence relationships. To mitigate noise labeling data in the relation extraction data, we propose a distant supervision relationship extraction method based on DRL-ETPCNN-ATT (Deep Reinforcement Learning Entity Type Piecewise Convolution Neural Network-Attention) based on the PCNN-ATT (Piecewise Convolution Neural Network-Attention) model. The experimental results show that compared with the CNN (Convolution Neural Network), PCNN (Piecewise Convolution Neural Network), RL-CNN (Reinforcement Learning Convolution Neural Network) models, the accuracy of the extraction model used in this paper has increased by 16.77%, 5.88%, and 4.97%, and the recall rate has increased by 16.39%, 2.83%, and 4.49%. Keywords-threat intelligence; relationship extraction; distant supervision; reinforcement learning