ITIRel: Joint Entity and Relation Extraction for Internet of Things Threat Intelligence

With the rising security issues in the Internet of Things (IoT), IoT threat intelligence (short for ITI) raises more and more concern. However, the lack of ITI knowledge graphs hinders the sharing and utilization of ITI that is usually in the form of unstructured text data scattered around the Internet. In this article, we propose a knowledge extraction method vital to the construction of ITI knowledge graphs. We first build an ITI ontology based on existing security ontologies and knowledge bases, providing an organized schema to incorporate ITI text data. Secondly, we design a joint model for ITI entity and relation extraction, namely, ITIRel, based on TPLinkerplus. To assist ITIRel in ITI entity recognition, we introduce domain knowledge to help the model learn the semantics of IoT security terms, which also improves the accuracy of relation extraction. We further optimize the tagging scheme of TPLinkerplus to enhance joint extraction performance. Finally, due to the lack of annotated ITI text data, we combine manual annotation and data augmentation techniques to create a new ITI dataset. Experiment results show that ITIRel establishes the new state-of-the-art on the dataset, which implies that our knowledge extraction method is suitable for ITI.