Knowledge-enhanced named entity recognition for cyber threat intelligence: a multi-stage classification and retrieval framework

Cyber Threat Intelligence (CTI) increasingly appears as unstructured text across social media and open-source security reports, yet its volume and noise make timely, accurate extraction a persistent bottleneck for defenders. We present a multi-stage CTI processing framework that couples domain-specific classification with knowledge-enhanced Named Entity Recognition (NER). A classifier fine-tuned from SecureBERT, a cybersecurity-specific language model, first filters threat-relevant content, achieving 92.41% accuracy and a 93.36% F1-score on a public CTI classification corpus and achieving the highest observed performance for Support Vector Machine (SVM), Random Forest (RF), and the larger general-domain DeBERTa-Large baselines trained under matched conditions. A knowledge retrieval module then augments candidate text with external context drawn from Wikipedia and Wikidata using three Best Matching 25 (BM25) strategies: sparse Wikipedia retrieval, sparse Wikidata retrieval, and Wikidata entity-attribute lookup. Evaluated on the DNRTI benchmark with a SecureBERT encoder coupled to a Conditional Random Field (CRF) layer, knowledge augmentation raises entity-level F1 from 87.16% (no retrieval) to 93.01%, attaining the highest recall (93.44%) and F1-score among reported methods; the gains are most pronounced for proper-noun entity types such as hacker organisations and affected geographic areas, where external descriptions resolve aliases and ambiguity. We analyse each retrieval strategy, report category-level results, and candidly delineate the framework’s limitations, including the report-versus-tweet domain gap, English-only coverage, and the absence of statistical significance testing. Overall, the study shows that pairing a domain-adapted encoder with lightweight external knowledge retrieval is an effective and computationally economical route to improving CTI extraction.