Cybersecurity named entity recognition method based on large language model linking

doi:10.11772/j.issn.1001-9081.2025070867

Journal of Computer Applications ›› 2026, Vol. 46 ›› Issue (7): 2064-2073.DOI: 10.11772/j.issn.1001-9081.2025070867

• Artificial intelligence • Previous Articles

Cybersecurity named entity recognition method based on large language model linking

Didi HOU¹^,², Shaodong HONG¹^,², Yujie FU¹^,², Yunhe CUI¹^,², Guowei SHEN¹^,²()

^1.College of Computer Science and Technology，Guizhou University，Guiyang Guizhou 550025，China
^2.Guizhou Provincial Key Laboratory of Software Engineering and Information Security （Guizhou University），Guiyang Guizhou 550025，China

Received:2025-08-01 Revised:2025-08-19 Accepted:2025-08-29 Online:2025-11-05 Published:2026-07-10
Contact: Guowei SHEN
About author:HOU Didi， born in 2000， M. S. candidate. Her research interests include threat intelligence analysis， knowledge graph.
HONG Shaodong， born in 1997， M. S. candidate. His research interests include model collaboration， code generation.
FU Yujie， born in 1998， Ph. D. candidate. His research interests include automated network defense， reinforcement learning.
CUI Yunhe， born in 1987， Ph. D.， associate professor. His research interests include edge computing， software defined network， data center network.
Supported by:
Science and Technology Program of Guizhou Province （Qiankehe Basic-ZK ［2023］ Key 011, Qiankehe Support ［2023］ General 447）

基于大语言模型链接的网络安全实体识别方法

侯迪迪¹^,², 洪少东¹^,², 付玉杰¹^,², 崔允贺¹^,², 申国伟¹^,²()

^1.贵州大学计算机科学与技术学院，贵阳 550025
^2.贵州省软件工程与信息安全特色重点实验室（贵州大学），贵阳 550025

通讯作者: 申国伟
作者简介:侯迪迪（2000—），女，贵州毕节人，硕士研究生，CCF会员，主要研究方向：威胁情报分析、知识图谱
洪少东（1997—），男，贵州毕节人，硕士研究生，CCF会员，主要研究方向：模型协同、代码生成
付玉杰（1998—），男，贵州贵阳人，博士研究生，CCF会员，主要研究方向：自动化网络防御、强化学习
崔允贺（1987—），男，山东济宁人，副教授，博士，CCF会员，主要研究方向：边缘计算、软件定义网络、数据中心网络
基金资助:
贵州省科技计划项目（黔科合基础-ZK［2023］重点011,黔科合支撑［2023］一般447）

Abstract

Abstract:

Cybersecurity knowledge graph is an important means to conduct deep correlation analysis on unstructured Cyber Threat Intelligence （CTI） data. The Use of Large Language Model （LLM） can overcome the limitations of traditional cybersecurity named entity recognition methods， such as lack of understanding of text context， difficulty in capturing long-distance dependencies， and lack of robustness when facing noise and redundancy. However， the extraction of cybersecurity named entities by a single LLM will lead to poor adaptability of the model capability outside the domain boundary， insufficient generalization ability on Out-Of-Distribution （OOD） data， and cognitive limitations of a single model. To solve these problems， an LLM collaborative linking method that integrates fine-tuning was proposed. In the method， Low-Rank Adaptation （LoRA） fine-tuning of LLMs was performed on a base LLM using a CTI corpus， and the model's understanding of the cybersecurity field was enhanced through parameter optimization. At the same time， static voting and dynamic meta-learner linking were adopted by LLM collaboration. In the static mechanism， prediction results of multiple models were integrated through voting； and in the dynamic mechanism， the feature space adaptation function was designed to quantify the model capability boundary. Simultaneously， dynamic mapping from input data features to model performance was achieved through meta-learners such as random forests. Experimental results show that the F1-score of the proposed method reaches 91.1%， which is 6.8% higher than that of the semantic enhancement network method based on multiple features， providing an efficient and scalable solution for named entity recognition in cybersecurity.

Key words: cybersecurity, named entity recognition, Large Language Model (LLM), Low-Rank Adaptation (LoRA) fine-tuning, meta-learner, model collaboration

摘要：

网络安全知识图谱是对非结构化的网络威胁情报（CTI）数据进行深度关联分析的重要手段，使用大语言模型（LLM）能够克服传统的网络安全命名实体识别方法存在的缺乏对文本上下文的理解、难以捕捉长距离依赖以及面对噪声和冗余时缺乏鲁棒性的局限。然而，单一LLM在网络安全命名实体抽取中存在模型能力在边界外领域适应性差、分布外（OOD）数据上泛化能力不足以及单一模型认知局限的情况。为了解决以上问题，提出一种融合微调的LLM协同链接方法。该方法使用CTI语料对基础LLM进行低秩适应（LoRA）参数微调，通过参数优化增强模型对网络安全领域的理解。同时， LLM协同采用静态投票与动态元学习器的链接方式，其中，通过投票让静态机制综合多个模型的预测结果，而在动态机制中设计特征空间适配函数来量化模型的能力边界，并通过随机森林等元学习器实现输入数据特征与模型性能的动态映射。实验结果表明，所提方法的F1分数达到了91.1%，与基于多特征的语义增强网络方法相比提升了6.8%，为网络安全命名实体识别提供了高效可扩展的解决方案。

关键词: 网络安全, 命名实体识别, 大语言模型, 低秩适应微调, 元学习器, 模型协同

CLC Number:

TP391.1

Didi HOU, Shaodong HONG, Yujie FU, Yunhe CUI, Guowei SHEN. Cybersecurity named entity recognition method based on large language model linking[J]. Journal of Computer Applications, 2026, 46(7): 2064-2073.

侯迪迪, 洪少东, 付玉杰, 崔允贺, 申国伟. 基于大语言模型链接的网络安全实体识别方法[J]. 《计算机应用》唯一官方网站, 2026, 46(7): 2064-2073.

Figures/Tables 13

Fig. 1 Framework of LLM linking method integrating fine-tuning

Fig. 2 LoRA fine-tuning technology principle

Fig. 3 LLM inference prompt

Fig. 4 Static linking process

Fig. 5 Dynamic linking framework of meta-learners

Tab. 1 DNRTI entity information

实体类型	含义	示例	数量
Area	Location	China	3 447
Exp	Exploit	EternalBlue	1 559
Feature	Characteristics	Uploading files	2 441
HackOrg	Hacker Org	China Chopper	5 465
Idus	Industry	social media	2 136
OffAct	Attack Pattern	supply-chain	2 669
Org	Organization	Google	2 489
Purp	Motivation	steal credentials	2 424
SamFile	File	KHNP.doc	2 400
SecTeam	Security team	FireEye	1 921
Time	Time	2008	2 659
Tool	Tool	LATENTBOT	4 784
Way	Technique	spear phishing	2 018

Tab. 2 Parameter configuration of LoRA fine-tuning

模型	目标模块	LoRA $γ$	LoRA $α$	LoRA dropout	Batch_size	Epochs	Learning_rate
LlaMA-3.1-8B	q，k，v_proj	8	32	0.1	4	8	1.00×10^-4
Qwen2.5-7B	q，k，v_proj	8	32	0.1	4	10	1.00×10^-4
GLM4-9B	q，k，v_proj	8	32	0.1	4	7	1.00×10^-4
OneKE	q，k，v_proj	8	32	0.1	4	7	1.00×10^-4

Tab. 2 Parameter configuration of LoRA fine-tuning

模型	目标模块	LoRA $γ$	LoRA $α$	LoRA dropout	Batch_size	Epochs	Learning_rate
LlaMA-3.1-8B	q，k，v_proj	8	32	0.1	4	8	1.00×10^-4
Qwen2.5-7B	q，k，v_proj	8	32	0.1	4	10	1.00×10^-4
GLM4-9B	q，k，v_proj	8	32	0.1	4	7	1.00×10^-4
OneKE	q，k，v_proj	8	32	0.1	4	7	1.00×10^-4

Tab. 3 Specific parameter configuration of ensemble learning

参数	MLP	CNN	随机森林
Batch_size	16	16	—
Epochs	270	370	—
Learning_rate	1×10^-4	1×10^-3	—
Dropout	0.5	0.5	—
优化器	AdamW	Adam	—
学习率调度器	StepLR	—	—
n_estimators	—	—	300
random_state	—	—	42

Tab. 4 Cybersecurity named entity recognition performance of pre-trained LLMs

模型	准确率	精确率	召回率	F1分数
DeepSeek	75.5	41.8	48.2	44.9
GPT-4o	77.3	41.5	51.1	45.8
GPT-4	71.3	34.7	46.7	39.8
LlaMA-3.1-8B	82.6	47.8	41.6	44.5
Qwen2.5-7B	77.5	39.3	40.0	39.6
GLM4-9B	81.9	46.3	44.6	45.5
OneKE	83.1	48.2	39.5	43.6

Fig. 6 Comparison of linking performance of single pre-trained LLMs and MLP

Tab. 5 Performance improvement brought by LoRA fine-tuning

模型	准确率			精确率			召回率			F1分数
模型	微调前	微调后	提升	微调前	微调后	提升	微调前	微调后	提升/%	微调前	微调后	提升
LlaMA-3.1-8B	82.6	96.0	16.2	47.8	88.1	84.3	41.6	87.9	111.3	44.5	88.0	97.8
Qwen2.5-7B	77.5	96.3	24.3	39.3	87.8	123.4	40.0	89.4	123.5	39.6	88.7	124.0
GLM4-9B	81.9	95.7	16.9	46.3	87.0	87.9	44.6	86.6	94.2	45.5	86.8	90.8
OneKE	83.1	95.9	15.4	48.2	88.0	82.6	39.5	87.2	120.8	43.6	87.6	100.9

Fig. 7 Performance comparison before and after fine-tuning model linking

Tab. 6 Performance comparison of LLM linking methods and existing models

方法	精确率	召回率	F1分数
BERT	77.2	82.2	79.6
CRF	82.1	78.0	80.0
TiKG	74.1	76.0	75.0
BERT-BiLSTM-CRF	85.2	85.0	84.6
CNN-BiLSTM-CRF	76.2	76.2	76.1
基于多特征的语义增强网络^［39］	86.2	84.5	85.3
大语言模型链接（Vote）	89.5	91.6	90.5
大语言模型链接（随机森林）	90.8	91.4	91.1

References 39

[1]	Zhou Y， Tang Y， Yi M， et al. CTI View： APT threat intelligence analysis system ［J］. Security and Communication Networks， 2022， 2022： No.9875199.
[2]	Qin Y， Shen G W， Zhao W B， et al. A network security entity recognition method based on feature template and CNN-BiLSTM-CRF ［J］. Frontiers of Information Technology and Electronic Engineering， 2019， 20（6）： 872-884.
[3]	Sarhan I， Spruit M. Open-CyKG： an open cyber threat intelligence knowledge graph ［J］. Knowledge-Based Systems， 2021， 233： No.107524.
[4]	Wang G， Liu P， Huang J， et al. KnowCTI： knowledge-based cyber threat intelligence entity and relation extraction ［J］. Computers and Security， 2024， 141： No.103824.
[5]	Dasgupta S， Piplai A， Kotal A， et al. A comparative study of deep learning based named entity recognition algorithms for cybersecurity ［C］// IEEE BigData 2020. Piscataway： IEEE， 2020： 2596-2604.
[6]	秦娅，申国伟，赵文波，等.基于深度神经网络的网络安全实体识别方法［J］.南京大学学报（自然科学）， 2019， 55（1）： 29-40.
	Qin Ya， Shen Guowei， Zhao Wenbo， et al. Research on the method of network security entity recognition based on deep neural network ［J］. Journal of Nanjing University （Natural Science）， 2019， 55（1）： 29-40.
[7]	Zhao W X， Zhou K， Li J， et al. A survey of large language models ［J］. Frontiers of Computer Science， 2026， 20（12）： No.2012627.
[8]	秦小林，古徐，李弟诚，等.大语言模型综述与展望［J］.计算机应用， 2025， 45（3）： 685-696.
	Qin Xiaolin， Gu Xu， Li Dicheng， et al. Survey and prospect of large language models ［J］. Journal of Computer Applications， 2025， 45（3）： 685-696.
[9]	Hu E J， Shen Y， Wallis P， et al. LoRA： low-rank adaptation of large language models ［PP/OL］. V2. arXiv （2021-10-16）［2025-06-20］. .
[10]	Mirzadeh I， Alizadeh K， Shahrokhi H， et al. GSM-Symbolic： understanding the limitations of mathematical reasoning in large language models ［PP/OL］. arXiv （2024-10-07）［2025-08-17］. .
[11]	Zhang Z， Zhao Y， Gao H， et al. LinkNER： linking local named entity recognition models to large language models using uncertainty ［C］// TheWebConf 2024. New York： ACM， 2024： 4047-4058.
[12]	Jia Y， Qi Y， Shang H， et al. A practical approach to constructing a knowledge graph for cybersecurity ［J］. Engineering， 2018， 4（1）： 53-60.
[13]	Fang Y， Zhang Y， Huang C. CyberEyes： cybersecurity entity recognition model based on graph convolutional network ［J］. The Computer Journal， 2020， 64（8）： 1215-1225.
[14]	Mouiche I， Saad S. Entity and relation extractions for threat intelligence knowledge graphs ［J］. Computers and Security， 2025， 148： No.104120.
[15]	OpenAI. GPT-4 technical report ［PP/OL］. V6. arXiv （2024-03-04）［2025-05-17］. .
[16]	Liu J， Zhan J. Constructing knowledge graph from cyber threat intelligence using large language model ［C］// IEEE BigData 2023. Piscataway： IEEE， 2023： 516-521.
[17]	Hu Y， Zou F， Han J， et al. LLM-TIKG： threat intelligence knowledge graph construction utilizing large language model ［J］. Computers and Security， 2024， 145： No.103999.
[18]	Dietterich T G. Ensemble methods in machine learning ［C］// MCS 2000. Berlin： Springer， 2000： 1-15.
[19]	Chen T， Guestrin C. XGBoost： a scalable tree boosting system ［C］// KDD 2016. New York： ACM， 2016： 785-794.
[20]	Wolpert D H. Stacked generalization ［J］. Neural Networks， 1992， 5（2）： 241-259.
[21]	Ho T K. The random subspace method for constructing decision forests ［J］. IEEE Transactions on Pattern Analysis and Machine Intelligence， 1998， 20（8）： 832-844.
[22]	da Silva R A， de Paula Canuto A M， da Silveira Barreto C A， et al. Automatic recommendation method for classifier ensemble structure using meta-learning ［J］. IEEE Access， 2021， 9： 106254-106268.
[23]	Yoon T， Kang D. Multi-modal stacking ensemble for the diagnosis of cardiovascular diseases ［J］. Journal of Personalized Medicine， 2023， 13（2）： No.373.
[24]	Akyol K. Stacking ensemble based deep neural networks modeling for effective epileptic seizure detection ［J］. Expert Systems with Applications， 2020， 148： No.113239.
[25]	Kumar M， Singhal S， Shekhar S， et al. Optimized stacking ensemble learning model for breast cancer detection and classification using machine learning ［J］. Sustainability， 2022， 14（21）： No.13998.
[26]	Team Llama. The Llama 3 herd of models ［PP/OL］. V3. arXiv （2024-11-23）［2025-06-10］. .
[27]	Team Qwen. Qwen2.5 technical report ［PP/OL］. V2. arXiv （2025-01-03）［2025-05-15］. .
[28]	Zhang J， Bai Y， Lv X， et al. LongCite： enabling LLMs to generate fine-grained citations in long-context QA ［C］// ACL 2025. Stroudsburg： ACL， 2025： 5098-5122.
[29]	Luo Y， Ru X， Liu K， et al. OneKE： a dockerized schema-guided LLM agent-based knowledge extraction system ［C］// TheWebConf 2025. New York： ACM， 2025： 2871-2874.
[30]	张岐龙，单甘霖，段修生，等.基于特征空间中类别可分性判据的特征选择［J］.火力与指挥控制， 2010， 35（6）： 118-120.
	Zhang Qilong， Shan Ganlin， Duan Xiusheng， et al. Feature selection based on separability in feature space ［J］. Fire Control and Command Control， 2010， 35（6）： 118-120.
[31]	Breiman L. Random forests ［J］. Machine Learning， 2001， 45（1）： 5-32.
[32]	Taud H， Mas J F. MultiLayer Perceptron （MLP）［M］// Camacho Olmedo M T， Paegelow M， Mas J F， et al. Geomatic approaches for modeling land change scenarios， LNGC. Cham： Springer， 2018： 451-455.
[33]	LeCun Y， Bottou L， Bengio Y， et al. Gradient-based learning applied to document recognition ［J］. Proceedings of the IEEE， 1998， 86（11）： 2278-2324.
[34]	Wang X， Liu X， Ao S， et al. DNRTI： a large-scale dataset for named entity recognition in threat intelligence ［C］// TrustCom 2020. Piscataway： IEEE， 2020： 1842-1848.
[35]	Devlin J， Chang M W， Lee K， et al. BERT： pre-training of deep bidirectional Transformers for language understanding ［C］// NAACL-HLT 2019. Stroudsburg： ACL， 2019： 4171-4186.
[36]	Lafferty J D， McCallum A， Pereira F C N. Conditional random fields： probabilistic models for segmenting and labeling sequence data ［C］// ICML 2001. San Francisco： Morgan Kaufmann Publishers Inc.， 2001： 282-289.
[37]	Ma X， Hovy E. End-to-end sequence labeling via bi-directional LSTM-CNNs-CRF ［C］// ACL 2016. Stroudsburg： ACL， 2016： 1064-1074.
[38]	谢腾，杨俊安，刘辉.基于BERT-BiLSTM-CRF模型的中文实体识别［J］.计算机系统应用， 2020， 29（7）： 48-55.
	Xie Teng， Yang Jun'an， Liu Hui. Chinese entity recognition based on BERT-BiLSTM-CRF model ［J］. Computer Systems and Applications， 2020， 29（7）： 48-55.
[39]	Liu P， Li H， Wang Z， et al. Multi-features based semantic augmentation networks for named entity recognition in threat intelligence ［C］// ICPR 2022. Piscataway： IEEE， 2022： 1557-1563.

Cybersecurity named entity recognition method based on large language model linking

基于大语言模型链接的网络安全实体识别方法

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 13

References 39

Related Articles 15

Recommended Articles

Metrics

[1]	Jiahang LI, Qilong HAN, Lijie LI, Hui ZHANG. Large language model-driven method for qualifier enhancement in hyper-relational knowledge graphs [J]. Journal of Computer Applications, 2026, 46(7): 2043-2053.
[2]	Yadian CHENG, Yingying LI, Ping ZHANG, Fangbing QIU, Xiaonan CHAI, Yuqiao SHU. Dual-role interaction mechanism-based large language model for psychological health [J]. Journal of Computer Applications, 2026, 46(7): 2054-2063.
[3]	Yusheng YI, Zhaohao HUANG, Zihao DENG, Leilei KONG, Haoliang QI. CORER： collaborative multi-knowledge large language model prompt framework for IT application innovation database migration [J]. Journal of Computer Applications, 2026, 46(6): 1811-1817.
[4]	Taixin CAI, Fengfeng WEI. Large language model-enhanced ant colony optimization for multi-solution traveling salesman problems [J]. Journal of Computer Applications, 2026, 46(6): 1712-1720.
[5]	Longyu XIONG, Shengdong DU, Haochen SHI, Jie HU, Yan YANG, Tianrui LI. Government affairs hotline question answering system based on knowledge-enhanced large language model architecture [J]. Journal of Computer Applications, 2026, 46(6): 1721-1727.
[6]	Jintao WANG, Zhilin GAO, Qixiang MENG, Fanliang BU. Legal case retrieval method via case information reformulation using large language model [J]. Journal of Computer Applications, 2026, 46(6): 1785-1792.
[7]	Qianfei WANG, Yang LI, Deyu LI, Suge WANG. Dual-channel feature fusion representation method for short-text clustering based on large language model [J]. Journal of Computer Applications, 2026, 46(5): 1441-1449.
[8]	Jiali ZHENG, Gang ZHOU, Jing CHEN, Shunhang LI. Adaptive multi-feature fusion detection method for AI-generated text [J]. Journal of Computer Applications, 2026, 46(5): 1433-1440.
[9]	Xing SHENG, Sunxian WENG, Kuosong CHEN, Zhongping WANG, Ruifeng REN, Yong LIU. Deep learning-based patent value evaluation for power grid enterprises [J]. Journal of Computer Applications, 2026, 46(5): 1468-1474.
[10]	Xiaoyu WANG, Xin LI, Di XUE, Zhangtao JIANG, Wei WANG, Yanjun XIAO. Vulnerability classification framework for video surveillance network security based on large language models [J]. Journal of Computer Applications, 2026, 46(4): 1158-1170.
[11]	Kaizhou SHI, Xuan HE, Guoyi HOU, Gen LI, Shuanggao LI, Xiang HUANG. Airborne product metrological traceability knowledge graph construction method based on large language models [J]. Journal of Computer Applications, 2026, 46(4): 1086-1095.
[12]	Haoyang ZHANG, Liping ZHANG, Sheng YAN, Na LI, Xuefei ZHANG. Review of large language model methods for knowledge graph completion [J]. Journal of Computer Applications, 2026, 46(3): 683-695.
[13]	Dingjia WU, Zhe CUI. MG-SQL： SQL generation framework with enhanced schema linking and multi-generator collaboration [J]. Journal of Computer Applications, 2026, 46(3): 723-731.
[14]	Enkang XI, Jing FAN, Yadong JIN, Hua DONG, Hao YU, Yihang SUN. Review of threats faced by federated learning in privacy and security field [J]. Journal of Computer Applications, 2026, 46(3): 798-808.
[15]	Yiming HUANG, Xihua ZOU, Guo DENG, Di ZHENG. Pre-answering and retrieval filtering： dual-stage optimization method for RAG-based question-answering systems [J]. Journal of Computer Applications, 2026, 46(3): 696-707.