Dendi Renaldo Permana

Security challenges in the digital era such as cybercrime cases are increasing. Advanced persistent threats (APTs) are data leak information disseminated through social media that can be a valuable resource for cyber threats intelligence (CTI) analysts. However, method development is still needed to assist CTI in overcoming APTs. This study performs entity detection from unstructured APT data into a structured format that matches the structured threats information expression (STIX) v2.1 domain object. This transformation integrates the field of natural language processing (NLP) with named entity recognition (NER) techniques to facilitate annotation of unstructured data from APT reports. In addition, this study also uses a deep learning approach, especially bidirectional long short-term memory (BiLSTM) and conditional random fields (CRF) to automate the annotation process with various tagging schemes, such as BIO, IOE, and BILOU. The results obtained show that the BIO tagging scheme has the highest F1-score with 99.33%. The proposed model demonstrates exceptional performance in extracting entities from unstructured APT reports, laying a strong foundation for future work in automated threat intelligence systems, including advancements in relation extraction and knowledge graph construction.