{"id":"https://openalex.org/W7225458679","doi":"https://doi.org/10.1007/s11416-026-00688-z","title":"Knowledge-enhanced named entity recognition for cyber threat intelligence: a multi-stage classification and retrieval framework","display_name":"Knowledge-enhanced named entity recognition for cyber threat intelligence: a multi-stage classification and retrieval framework","publication_year":2026,"publication_date":"2026-11-07","ids":{"openalex":"https://openalex.org/W7225458679","doi":"https://doi.org/10.1007/s11416-026-00688-z"},"language":"en","primary_location":{"id":"doi:10.1007/s11416-026-00688-z","doi":"https://doi.org/10.1007/s11416-026-00688-z","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-026-00688-z","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00688-z.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-c","jufo-1","poland-70","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00688-z.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5040815520","display_name":"Bolong Cheng","orcid":"https://orcid.org/0000-0002-2703-5452","observed_orcids":["https://orcid.org/0000-0002-2703-5452"]},"institutions":[{"id":"https://openalex.org/I154130895","display_name":"University of Auckland","ror":"https://ror.org/03b94tp07","country_code":"NZ","type":"education","lineage":["https://openalex.org/I154130895"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Bolong Cheng","raw_affiliation_strings":["University of Auckland, Auckland, New Zealand"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Auckland, Auckland, New Zealand","institution_ids":["https://openalex.org/I154130895"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046437897","display_name":"Aniket Mahanti","orcid":"https://orcid.org/0000-0002-6545-3073","observed_orcids":["https://orcid.org/0000-0002-6545-3073"]},"institutions":[{"id":"https://openalex.org/I154130895","display_name":"University of Auckland","ror":"https://ror.org/03b94tp07","country_code":"NZ","type":"education","lineage":["https://openalex.org/I154130895"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Aniket Mahanti","raw_affiliation_strings":["University of Auckland, Auckland, New Zealand"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Auckland, Auckland, New Zealand","institution_ids":["https://openalex.org/I154130895"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054337099","display_name":"Ranesh Kumar Naha","orcid":"https://orcid.org/0000-0003-4165-9349","observed_orcids":["https://orcid.org/0000-0003-4165-9349"]},"institutions":[{"id":"https://openalex.org/I160993911","display_name":"Queensland University of Technology","ror":"https://ror.org/03pnv4752","country_code":"AU","type":"education","lineage":["https://openalex.org/I160993911"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Ranesh Naha","raw_affiliation_strings":["Queensland University of Technology, Brisbane, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Queensland University of Technology, Brisbane, Australia","institution_ids":["https://openalex.org/I160993911"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5084123017","display_name":"Sudheer Kumar Battula","orcid":"https://orcid.org/0000-0001-6597-252X","observed_orcids":["https://orcid.org/0000-0001-6597-252X"]},"institutions":[{"id":"https://openalex.org/I129801699","display_name":"University of Tasmania","ror":"https://ror.org/01nfmeh72","country_code":"AU","type":"education","lineage":["https://openalex.org/I129801699"]}],"countries":["AU"],"is_corresponding":true,"raw_author_name":"Sudheer Kumar Battula","raw_affiliation_strings":["University of Tasmania, Hobart, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Tasmania, Hobart, Australia","institution_ids":["https://openalex.org/I129801699"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5084123017"],"corresponding_institution_ids":["https://openalex.org/I129801699"],"apc_list":{"value":3290,"currency":"USD","value_usd":3290},"apc_paid":{"value":3290,"currency":"USD","value_usd":3290},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9833999872207642,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9833999872207642,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0020000000949949026,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0015999999595806003,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cyber-threat-intelligence","display_name":"cyber threat intelligence","score":0.984000027179718},{"id":"https://openalex.org/keywords/named-entity-recognition","display_name":"named entity recognition","score":0.9890000224113464},{"id":"https://openalex.org/keywords/knowledge-retrieval","display_name":"knowledge retrieval","score":0.6039999723434448},{"id":"https://openalex.org/keywords/bm25-retrieval","display_name":"BM25 retrieval","score":0.8870000243186951}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8751999735832214},{"id":"https://openalex.org/C2779135771","wikidata":"https://www.wikidata.org/wiki/Q403574","display_name":"Named-entity recognition","level":3,"score":0.7095999717712402},{"id":"https://openalex.org/C152565575","wikidata":"https://www.wikidata.org/wiki/Q1124538","display_name":"Conditional random field","level":2,"score":0.6406000256538391},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.6032000184059143},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5982999801635742},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.4961000084877014},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.48019999265670776},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.4715000092983246},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.4645000100135803},{"id":"https://openalex.org/C96711827","wikidata":"https://www.wikidata.org/wiki/Q17012245","display_name":"Entity linking","level":3,"score":0.46209999918937683},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.4255000054836273},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.4253000020980835},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.4221000075340271},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.3953999876976013},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.36570000648498535},{"id":"https://openalex.org/C195807954","wikidata":"https://www.wikidata.org/wiki/Q1662562","display_name":"Information extraction","level":2,"score":0.364300012588501},{"id":"https://openalex.org/C518677369","wikidata":"https://www.wikidata.org/wiki/Q202833","display_name":"Social media","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.3393000066280365},{"id":"https://openalex.org/C2777462759","wikidata":"https://www.wikidata.org/wiki/Q18395344","display_name":"Word embedding","level":3,"score":0.33410000801086426},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.32839998602867126},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3154999911785126},{"id":"https://openalex.org/C148524875","wikidata":"https://www.wikidata.org/wiki/Q6975395","display_name":"F1 score","level":2,"score":0.3107999861240387},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.3037000000476837},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3034000098705292},{"id":"https://openalex.org/C512654426","wikidata":"https://www.wikidata.org/wiki/Q19652","display_name":"Public domain","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.28600001335144043},{"id":"https://openalex.org/C2776461190","wikidata":"https://www.wikidata.org/wiki/Q22673982","display_name":"Word2vec","level":3,"score":0.2842000126838684},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.26969999074935913},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.26409998536109924},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2619999945163727},{"id":"https://openalex.org/C4554734","wikidata":"https://www.wikidata.org/wiki/Q593744","display_name":"Knowledge base","level":2,"score":0.26030001044273376},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.2596000134944916}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s11416-026-00688-z","doi":"https://doi.org/10.1007/s11416-026-00688-z","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-026-00688-z","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00688-z.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-c","jufo-1","poland-70","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s11416-026-00688-z","doi":"https://doi.org/10.1007/s11416-026-00688-z","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11416-026-00688-z","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11416-026-00688-z.pdf","source":{"id":"https://openalex.org/S2764922190","display_name":"Journal of Computer Virology and Hacking Techniques","issn_l":"1772-9890","issn":["1772-9890","1772-9904","2263-8733"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","dongbi-c","jufo-1","poland-70","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Virology and Hacking Techniques","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320320609","display_name":"University of Tasmania","ror":"https://ror.org/01nfmeh72"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225458679.pdf","grobid_xml":"https://content.openalex.org/works/W7225458679.grobid-xml"},"referenced_works_count":44,"referenced_works":["https://openalex.org/W1986203139","https://openalex.org/W2076204351","https://openalex.org/W2122137693","https://openalex.org/W2128180557","https://openalex.org/W2743411104","https://openalex.org/W2760313715","https://openalex.org/W2787560479","https://openalex.org/W2890262614","https://openalex.org/W2914403931","https://openalex.org/W2914789242","https://openalex.org/W2934951104","https://openalex.org/W2963341956","https://openalex.org/W2963563709","https://openalex.org/W2965373594","https://openalex.org/W2997634552","https://openalex.org/W3013136547","https://openalex.org/W3015883388","https://openalex.org/W3023882301","https://openalex.org/W3111854523","https://openalex.org/W3113358185","https://openalex.org/W3129754801","https://openalex.org/W3141363959","https://openalex.org/W3165688004","https://openalex.org/W3198333480","https://openalex.org/W4239319433","https://openalex.org/W4281381644","https://openalex.org/W4281478262","https://openalex.org/W4313188880","https://openalex.org/W4313880566","https://openalex.org/W4319079731","https://openalex.org/W4324093415","https://openalex.org/W4383097895","https://openalex.org/W4390805977","https://openalex.org/W4393059617","https://openalex.org/W4402644087","https://openalex.org/W4403061270","https://openalex.org/W4404037769","https://openalex.org/W4410344873","https://openalex.org/W4416231654","https://openalex.org/W7118927645","https://openalex.org/W7125483926","https://openalex.org/W7128164726","https://openalex.org/W7160296052","https://openalex.org/W7204567987"],"related_works":["https://openalex.org/W7168268248","https://openalex.org/W3023882301","https://openalex.org/W7212354473","https://openalex.org/W7138873598","https://openalex.org/W7154490709","https://openalex.org/W4414392302","https://openalex.org/W4411550904","https://openalex.org/W4225658247","https://openalex.org/W4412756117","https://openalex.org/W4393253320"],"abstract_inverted_index":{"Abstract":[0],"Cyber":[1],"Threat":[2],"Intelligence":[3],"(CTI)":[4],"increasingly":[5],"appears":[6],"as":[7,179],"unstructured":[8],"text":[9,105],"across":[10],"social":[11],"media":[12],"and":[13,20,64,74,88,112,127,164,182,191,201,214,238],"open-source":[14],"security":[15],"reports,":[16],"yet":[17],"its":[18],"volume":[19],"noise":[21],"make":[22],"timely,":[23],"accurate":[24],"extraction":[25],"a":[26,33,53,65,69,137,142,227],"persistent":[27],"bottleneck":[28],"for":[29,80,174],"defenders.":[30],"We":[31,193],"present":[32],"multi-stage":[34],"CTI":[35,71,244],"processing":[36],"framework":[37],"that":[38,225],"couples":[39],"domain-specific":[40],"classification":[41,72],"with":[42,106,136,230],"knowledge-enhanced":[43],"Named":[44],"Entity":[45],"Recognition":[46],"(NER).":[47],"A":[48,98],"classifier":[49],"fine-tuned":[50],"from":[51,110,153],"SecureBERT,":[52],"cybersecurity-specific":[54],"language":[55],"model,":[56],"first":[57],"filters":[58],"threat-relevant":[59],"content,":[60],"achieving":[61,75],"92.41%":[62],"accuracy":[63],"93.36%":[66],"F1-score":[67,165],"on":[68,132],"public":[70],"corpus":[73],"the":[76,89,133,160,169,204,208,215,222],"highest":[77,161],"observed":[78],"performance":[79],"Support":[81],"Vector":[82],"Machine":[83],"(SVM),":[84],"Random":[85,144],"Forest":[86],"(RF),":[87],"larger":[90],"general-domain":[91],"DeBERTa-Large":[92],"baselines":[93],"trained":[94],"under":[95],"matched":[96],"conditions.":[97],"knowledge":[99,148,233],"retrieval":[100,196,234],"module":[101],"then":[102],"augments":[103],"candidate":[104],"external":[107,187,232],"context":[108],"drawn":[109],"Wikipedia":[111,122],"Wikidata":[113,125,128],"using":[114],"three":[115],"Best":[116],"Matching":[117],"25":[118],"(BM25)":[119],"strategies:":[120],"sparse":[121,124],"retrieval,":[123,126],"entity-attribute":[129],"lookup.":[130],"Evaluated":[131],"DNRTI":[134],"benchmark":[135],"SecureBERT":[138],"encoder":[139,229],"coupled":[140],"to":[141,157,242],"Conditional":[143],"Field":[145],"(CRF)":[146],"layer,":[147],"augmentation":[149],"raises":[150],"entity-level":[151],"F1":[152],"87.16%":[154],"(no":[155],"retrieval)":[156],"93.01%,":[158],"attaining":[159],"recall":[162],"(93.44%)":[163],"among":[166],"reported":[167],"methods;":[168],"gains":[170],"are":[171],"most":[172],"pronounced":[173],"proper-noun":[175],"entity":[176],"types":[177],"such":[178],"hacker":[180],"organisations":[181],"affected":[183],"geographic":[184],"areas,":[185],"where":[186],"descriptions":[188],"resolve":[189],"aliases":[190],"ambiguity.":[192],"analyse":[194],"each":[195],"strategy,":[197],"report":[198],"category-level":[199],"results,":[200],"candidly":[202],"delineate":[203],"framework\u2019s":[205],"limitations,":[206],"including":[207],"report-versus-tweet":[209],"domain":[210],"gap,":[211],"English-only":[212],"coverage,":[213],"absence":[216],"of":[217],"statistical":[218],"significance":[219],"testing.":[220],"Overall,":[221],"study":[223],"shows":[224],"pairing":[226],"domain-adapted":[228],"lightweight":[231],"is":[235],"an":[236],"effective":[237],"computationally":[239],"economical":[240],"route":[241],"improving":[243],"extraction.":[245]},"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2026-11-08T00:00:00"}