A Method of Network Attack Named Entity Recognition based on Deep Active Learning

Abstract

In the face of data scarcity for network attack annotation and the possibility that static datasets may not anticipate future security threats, in this paper, we integrate active learning and deep learning techniques, and propose a method of network attack named entity recognition based on deep active learning. Considering that traditional active learning sampling strategies may ignore the inherent complexity of data, we propose a dual-dimension diversity sampling method that pays attention to both the internal and external diversity of unlabeled samples to promote the improvement of model generalization ability. Further, in order to fully mine valuable samples and achieve balanced sample selection in model training, we design a strategy that alternately applies experience-driven uncertainty sampling and dual-dimension diversity sampling. The advantages of the proposed method in improving the precision, recall and F1 value of named entity recognition tasks on self-built and public datasets are verified through ablation and comparison experiments.