RECORD
Automatic Identification of Indicators of Compromise using Neural-Based Sequence Labelling
Artificial Intelligence · Submitted 24 Oct 2018
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim Experiments show that the proposed model outperforms other sequence labelling models, achieving over 88% average F1-score.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Indicators of Compromise (IOCs) are artifacts observed on a network or in an operating system that can be utilized to indicate a computer intrusion and detect cyber-attacks in an early stage. Thus, they exert an important role in the field of cybersecurity. However, state-of-the-art IOCs detection systems rely heavily on hand-crafted features with expert knowledge of cybersecurity, and require a large amount of supervised training corpora to train an IOC classifier. In this paper, we propose using a neural-based sequence labelling model to identify IOCs automatically from reports on cybersecurity without expert knowledge of cybersecurity. Our work is the first to apply an end-to-end sequence labelling to the task in IOCs identification. By using an attention mechanism and several token spelling features, we find that the proposed model is capable of identifying the low frequency IOCs from long sentences contained in cybersecurity reports. Experiments show that the proposed model outperforms other sequence labelling models, achieving over 88% average F1-score.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Indicators of Compromise (IOCs) are artifacts observed on a network or in an operating system that can be utilized to indicate a computer intrusion and detect cyber-attacks in an early stage. | background 1.00 | 0.04 | 0.02 | asserted 0.95 |
| s1 | Thus, they exert an important role in the field of cybersecurity. | background 1.00 | 0.04 | 0.02 | asserted 1.00 |
| s2 | However, state-of-the-art IOCs detection systems rely heavily on hand-crafted features with expert knowledge of cybersecurity, and require a large amount of supervised training corpora to train an IOC classifier. | gap 0.80 | 0.04 | 0.03 | asserted 1.00 |
| s3 | In this paper, we propose using a neural-based sequence labelling model to identify IOCs automatically from reports on cybersecurity without expert knowledge of cybersecurity. | contribution 0.88 | 0.80 | 0.17 | asserted 0.89 |
| s4 | Our work is the first to apply an end-to-end sequence labelling to the task in IOCs identification. | contribution 0.99 | 0.88 | 0.09 | asserted 1.00 |
| s5 | By using an attention mechanism and several token spelling features, we find that the proposed model is capable of identifying the low frequency IOCs from long sentences contained in cybersecurity reports. | result 0.84 | 0.96 | 0.22 | asserted 1.00 |
| s6 | Experiments show that the proposed model outperforms other sequence labelling models, achieving over 88% average F1-score. | result 1.00 | 0.96 | 0.57 | asserted 1.00 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Indicators of Compromise (IOCs) are artifacts observed on a network or in an operating system that can be utilized to indicate a computer intrusion and detect cyber-attacks in an early stage. Thus, they exert an important role in the field of cybersecurity. However, state-of-the-art IOCs detection systems rely heavily on hand-crafted features with expert knowledge of cybersecurity, and require a large amount of supervised training corpora to train an IOC classifier. In this paper, we propose using a neural-based sequence labelling model to identify IOCs automatically from reports on cybersecurity without expert knowledge of cybersecurity. Our work is the first to apply an end-to-end sequence labelling to the task in IOCs identification. By using an attention mechanism and several token spelling features, we find that the proposed model is capable of identifying the low frequency IOCs from long sentences contained in cybersecurity reports. Experiments show that the proposed model outperforms other sequence labelling models, achieving over 88% average F1-score.
Human review
How the literature uses it
1 arXiv paper cite this in 1 sentence
Papers citing it
Cites it as background 1 paper
-
Zhou et al. [ref] used an LSTM with a Conditional Random Fields (CRF) layer for sequence labeling focused solely on IoC identification.
Automated Mapping of CVE Vulnerability Records to MITRE CWE Weaknesses · Related Work · 0.91
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.