Septiani Widia Rosalia

This study aims to extract Indicators of Compromise (IoC) from Cyber Threat Intelligence (CTI) text using a Named Entity Recognition (NER) approach. The method employs the Begin, Inside, and Outside (BIO) annotation scheme for sequence labeling and compares the Bidirectional Encoder Representations from Transformer (BERT) and BERT-BiLSTM-CRF models. The dataset used consists of structured data from APTNER, which contains a collection of cybersecurity entities for model training and testing. The results show that both models were able to successfully extract IoC entities during 50-epoch test. The BERT model achieved the highest validation accuracy of 90.61%, while the BERT-BiLSTM-CRF model reached an Entity Level F1-score of 0.75 or 75%. The superiority of BERT- BiLSTM-CRF stems from BERT’s ability to generate rich contextual feature representations and BiLSTM-CRF’s capability to capture sequential dependencies and predict labels. This study applies Explainable Artificial Intelligence (XAI) to analyze and visualize the models’ contextual understanding in predicting a threat entity. The contributions of this study include the application of the BERT and BERT-BiLSTM-CRF models for IoC extraction in CTI data, a comparison of the performance of the two models, and the interpretation of model decisions using XAI to provide transparency in the results of cyber threat identification.