Threat intelligence is crucial for the early detection of network security threats, and named entity recognition (NER) plays a critical role in this process. However, traditional NER models based on sequence tagging primarily focus on word-level information for single-token entities, which leads to the inefficient extraction of multi-token entities in intelligence texts. Moreover, traditional NER models provide only a single semantic representation of intelligence texts, meaning that polysemous entities in intelligence texts cannot be effectively classified. To address these problems, this paper proposes a novel model based on segment-level information extraction and similar semantic space construction (SSNER). First, SSNER retrains the traditional BERT model based on a threat intelligence corpus and modifies BERT’s mask mechanism to extract the segment-level word embedding so that the ability of the SSNER to recognize multi-token entities is enhanced. Second, SSNER designs a similar semantic space construction method, which obtains compound semantic representations with symmetrical properties by filtering out the set of similar words and integrating them using self-attention to generate more accurate labels for the polysemous entities. The experimental results on two datasets, DNRTI and Bridges, indicate that SSNER outperforms both baseline and related models. In particular, SSNER achieves an F1-score of 96.02% on the Bridges dataset, exceeding the previous best model by approximately 1.46%.

Extracting cybersecurity entities from unstructured web text is an important part of security analysis. Traditional BERT-based entity extraction models rely on a single semantic expression generated by the model, however, these models do not take into account the polysemous information that exists for entities in the intelligence domain, thus limiting the performance of traditional models for extracting entities. Therefore, this paper proposes a Semantic Enhancement Model (SEM) for named entities based on similar semantic space construction. First, the input text goes into BERT and CNN to get word-level word embeddings and character-level word embeddings respectively, and then merges them into mixed feature word embedding to enhance the robustness of the model. At the same time, SEM computes the set of similar words S-SET for the input text sequentially by the Similar Word Sense Matching Algorithm, and then uses the self-attention mechanism to compute the semantic relevance weights among the S-SET elements, so as to get the word embeddings with similar semantics. Subsequently mixed feature word embeddings and similar semantic word embeddings are used to calculate the similarity between the embedding vectors at different semantic levels through a multi-head attention mechanism, and then fused to construct an integrated semantic expression of the entity; thereby enriching the semantic expression of the entity and increasing the probability of the entity being predicted correctly. Finally, the integrated semantic expression is input into CRF for entity prediction. The experimental outcomes demonstrate that our proposed model outperforms existing baseline approaches on the network security datasets DNRTI and Bridge.