Advanced Persistent Threat (APT) seriously threatens a nation’s cyberspace security. Current defense technologies are typically unable to detect it effectively since APT attack is complex and the signatures for detection are not clear. To enhance the understanding of APT attacks, in this paper, a novel approach for extracting APT attack events from web texts is proposed. First, the APT event types and event schema are defined. Secondly, an APT attack event extraction dataset in Chinese is constructed. Finally, an APT attack event extraction model based on the BERT-BiGRU-CRF architecture is proposed. Comparative experiments are conducted with ERNIE, BERT, and BERT-BiGRU-CRF models, and the results show that the APT attack event extraction model based on BERT-BiGRU-CRF achieves the highest F1 value, indicating the best extraction performance. Currently, there is seldom APT event extraction research, the work in this paper contributes a new method to Cyber Threat Intelligence (CTI) analysis. By considering the multi-stages, complexity of APT attacks, and the data source from huge credible web texts, the APT event extraction method enhances the understanding of APT attacks and is helpful to improve APT attack detection capabilities.

In cybersecurity, constructing an accurate knowledge graph is vital for discovering key entities and relationships in security incidents buried in vast unstructured threat reports. Traditional knowledge-graph construction pipelines based on handcrafted rules or conventional machine learning models falter when the data scale and linguistic variety grow. GraphRAG, a retrieval-augmented generation (RAG) framework that splits documents into fixed-length chunks and then retrieves the most relevant ones for generation, offers a scalable alternative yet still suffers from fragmentation and semantic gaps that erode graph integrity. To resolve these issues, this paper proposes SC-LKM, a cybersecurity knowledge-graph construction method that couples the GraphRAG backbone with hierarchical semantic chunking. SC-LKM applies semantic chunking to build a cybersecurity knowledge graph that avoids the fragmentation and inconsistency seen in prior work. The semantic chunking method first respects the native document hierarchy and then refines boundaries with topic similarity and named-entity continuity, maintaining logical coherence while limiting information loss during the fine-grained processing of unstructured text. SC-LKM further integrates the semantic comprehension capacity of Qwen2.5-14B-Instruct, markedly boosting extraction accuracy and reasoning quality. Experimental results show that SC-LKM surpasses baseline systems in entity-recognition coverage, topology density, and semantic consistency.

Current mainstream for Chinese grammatical error correction methods rely on deep neural network models, which require a large amount of high-quality data for training. However, existing Chinese grammatical error correction corpora have a low annotation quality and high noise levels, leading to a low generalization ability of the models and difficulty in handling complex sentences. To address this issue, this paper proposes a dynamic assessment-based curriculum learning method for Chinese grammatical error correction. The proposed approach focuses on two key components: defining the difficulty of training samples and devising an effective training strategy. In the difficulty assessment phase, we enhance the accuracy of the curriculum sequence by dynamically updating the evaluation model. During the training strategy phase, a multi-stage dynamic progressive approach is employed to select training samples of varying difficulty levels, which helps prevent the model from prematurely converging to local optima and enhances the overall training effectiveness. Experimental results on the MuCGEC and NLPCC 2018 Chinese grammatical error correction datasets show that the proposed curriculum learning method significantly improves the model’s error correction performance, with F0.5 scores increasing by 0.9 and 1.05, respectively, validating the method’s effectiveness.

Advanced Persistent Threats (APTs) pose significant cybersecurity challenges due to their multi-stage complexity. Knowledge graphs (KGs) effectively model APT attack processes through node-link architectures; however, the scarcity of high-quality, annotated datasets limits research progress. The primary challenge lies in balancing annotation cost and quality, particularly due to the lack of quality assessment methods for graph annotation data. This study addresses these issues by extending existing APT ontology definitions and developing a dynamic, trustworthy annotation framework for APT knowledge graphs. The framework introduces a self-verification mechanism utilizing large language model (LLM) annotation consistency and establishes a comprehensive graph data metric system for problem localization in annotated data. This metric system, based on structural properties, logical consistency, and APT attack chain characteristics, comprehensively evaluates annotation quality across representation, syntax semantics, and topological structure. Experimental results show that this framework significantly reduces annotation costs while maintaining quality. Using this framework, we constructed LAPTKG, a reliable dataset containing over 10,000 entities and relations. Baseline evaluations show substantial improvements in entity and relation extraction performance after metric correction, validating the framework’s effectiveness in reliable APT knowledge graph dataset construction.

Retrieval-augmented generation (RAG) grounds large language models (LLMs) with external evidence. Dynamic knowledge tasks, however, require systems to decide not only what to retrieve but also when to refresh, how to arbitrate conflicts, and how to preserve an auditable record of the evidence used to answer a query. We present LedgerRAG, a trigger-aware retrieval chain framework that maintains an explicit claim-level evidence ledger and uses coverage, temporal validity, authority, and conflict signals to control retrieval, refresh, and stopping decisions. We expand the evaluation with a query-level BM25 baseline, a dense retriever setting, and task-aligned proxy baselines representing graph-style retrieval, temporal-only retrieval, and conflict-focused retrieval. The revised results show that LedgerRAG’s clearest advantage lies in conflict governance and auditable evidence control, achieving near-perfect ConFLICT adjudication (CRAcc = 0.993) under authority-aware routing while yielding more modest gains and explicit trade-offs in regulation-change and streaming settings.