Context-aware Entity-Relation Extraction Pipeline for Threat Intelligence Knowledge Graphs

Cybersecurity knowledge graphs (CKGs) integrate diverse sources of cyber threat intelligence (CTI) into a structured, queryable format, offering scalable solutions for automating proactive and real-time security responses. This has led to their increased adoption, improving the workflow and effectiveness of security professionals. However, constructing CKGs requires extracting entity-relation triples from unstructured reports, a process complicated by report complexity, specialized cybersecurity terminologies, and language ambiguity. As a result, existing pipeline approaches suffer from error propagation, resulting in low accuracy and poor generalizability. This paper introduces the Context-aware Threat Intelligence Knowledge Graph (CTiKG) framework, designed to accurately identify and classify threat entities and their relationships from CTI reports. CTiKG integrates hybrid NLP models that leverage SecureBERT embeddings and expert knowledge encoded in an ontology to control classification errors and reduce error propagation, thereby enhancing extraction accuracy. Evaluations using the augmented DNRTI-STIX2 dataset, which features 21 entity categories adhering to STIX-2.1 standards, demonstrate the model's superior performance compared to state-of-the-art methods, with increases of 2-3% in NER and up to 5% in RE in terms of precision, recall, and F1-scores. Further validation on the DNRTI and STUCCO datasets and a practical cybersecurity use case illustrate the framework's robustness. The DNRTI-STIX2 and curated CTI datasets are available on GitHub to support further research.