CyberRE-LLM: Cyber Threat Intelligence Relation Extraction with Large Language Model

CyberRE-LLM: Cyber Threat Intelligence Relation Extraction with Large Language Model

연구 분야: Safety

학회: International Conference on Intelligent Computing

Cyber Threat Intelligence (CTI) plays a crucial role in proactive cybersecurity defense, with relationship extraction being a key component. However, existing methods confront limitations, including substantial demand for labeled data and poor domain adaptability. To mitigate these concerns, we introduce CyberRE-LLM, a new framework for CTI relationship extraction using Large Language Models (LLMs). CyberRE-LLM employs a three-phase approach: (1) Consensus-based Prompt Ensemble to enhance LLM reliability; (2) Multi-Candidate Disambiguation to select accurate relationship types; and (3) Self-Supervision and Self-Correction to mitigate LLM errors. Additionally, it incorporates three strategies—Cloze4RE, Demonstration Retrieval, and Canonical Sentences—to improve performance. Experiments on three CTI datasets show significant improvements. CyberRE-LLM delivers a robust solution for CTI relationship extraction, even with limited labeled data, and has potential for broader application in cybersecurity and other domains with data scarcity.