CyberNER: Multi-Type Named Entity Recognition and Alias Canonicalisation for APT Cyber Threat Intelligence Reports

Abstract

APT reports in the Cyber Threat Intelligence (CTI) are rich with information, but are not structured, resulting in security analysts devoting 2-3 hours to manually sifting through each report to identify the linkages, tactics, techniques, and relationships. Named Entity Recognition (NER) systems aim to overcome the manual nature of this task, but existing solutions result in limited entity coverage, boundary false negatives caused by the rigid fixed-window tokenization, and failure to resolve conflicting vendor aliases. Therefore, this paper introduces CyberNER, a two-stage pipeline to solve the multi-type NER and alias canonicalization problem in APT CTI reports.  In Stage 1, Documents through semantic hierarchical chunking are categorised at natural section, paragraph, and sentence boundaries. Stage 2 would introduce fine-tuned CySecBERT, a cybersecurity language model based on CySecBERT, to identify 12 types. Each entity has a confidence score. There is also a three-tier MITRE STIX 2.1 alias canonicalization layer that addresses variations in surface forms from different vendor reports. The Threat Recall Actor improves exponentially from a baseline of 21% to 94%. Evaluated using a 12-type annotated benchmark from 182 APTNotes reports covering 30 APT groups, CyberNER achieves a Macro-F1 score of 0.853, outperforming all four baselines. The structured JSON output is directly consumable for downstream tasks, including TTP mapping, attack-flow graph generation, and multi-source intelligence fusion.