Vib-ner enables out-of-vocabulary recognition in cybersecurity threat intelligence

Cybersecurity researchers have unveiled a new artificial intelligence model that dramatically improves how machines identify never-before-seen threat terms buried in unstructured security reports, a longstanding weak point in automated cyber defense. The model, called VIB-NER, was developed by a team at the National Security Research Institute at Shihezi University in Xinjiang, China, and is described in a study published in the journal Cybersecurity. By combining an information-theoretic technique known as the variational information bottleneck with a mutual information-based loss function, the system achieves F1 scores of around 79 percent, recall of 77 percent, and precision of 80 percent on cybersecurity threat intelligence entity extraction tasks—a 4 to 8 percent improvement over mainstream models such as E-NER. Just as striking, the model cuts the time consumed per training batch by half compared with existing approaches.

The work addresses a problem that has grown increasingly urgent as cyberattacks multiply in both volume and sophistication. Zero-day attacks, emerging exploitation techniques, and traditional security risks now intertwine to produce composite incidents such as data breaches, system intrusions, and financial fraud, threats that imperil individuals, enterprises, and national security alike. Since Gartner formalized the concept of Cyber Threat Intelligence, or CTI, in 2013, security organizations have sought to build knowledge systems encompassing threat scenarios, attack mechanisms, indicator features, impact assessments, and disposal strategies. The promise of CTI is substantial: precise threat response solutions and a significant reduction in the workload of security analysts through automated analysis, strengthening proactive defense at the tactical level.

The obstacle is that threat intelligence overwhelmingly exists as unstructured text—vast in scale, decentralized, fragmented, and full of hidden relationships. Attackers constantly invent new tactics, from enticing users to execute malicious files to exploiting undisclosed vulnerabilities, and the pipeline from intelligence collection to distribution can stretch across months. The result is a flood of out-of-vocabulary, or OOV, terms: hash values, vulnerability identifiers, novel malware names, and hacker group designations that no model has encountered during training. Named entity recognition, the natural language processing task of locating and classifying names within text, is the critical first step in converting this textual deluge into machine-readable threat knowledge graphs. Yet traditional NER models, which lean heavily on explicit entity mention information, suffer severe performance degradation when confronted with these unfamiliar terms.

“Named entity recognition technology has demonstrated excellent performance in extracting specific threat information, particularly in dealing with datasets that contain many out-of-vocabulary words, with span prediction models showing more pronounced effects,” the researchers note. However, these advanced span prediction approaches have received inadequate attention in the CTI field specifically. The team’s central question was how to construct a novel span prediction learning framework that better handles the OOV issues endemic to threat intelligence datasets—where the morphological structure of professional OOV words like hash values and vulnerability numbers differs fundamentally from general-domain vocabulary, and where the long-range dependencies of advanced persistent threat report texts place heavy demands on contextual modeling.

VIB-NER’s architecture builds on the span-based approach to NER, which treats entity recognition as a text span classification problem rather than tagging each token in a sequence. The model comprises three core modules: a token representation layer, a span representation layer, and a span classification layer. For every possible span in a sentence, the span representation layer combines boundary embeddings—the encoded representations of the span’s start and end tokens—with a learnable length embedding that captures the span’s size. The token representation layer then encodes these inputs using non-contextual word embeddings passed through a contextual encoder such as a transformer, with BERT-large serving as the base encoder in the team’s experiments.

The innovation lies in what happens next. The researchers inserted a Variational Information Bottleneck layer between span enumeration and classification. An encoder function processes each initial span representation to produce a K-dimensional mean vector and a K-by-K covariance matrix, together describing the probability distribution of a latent variable. Through the reparameterization trick—adding scaled standard normal noise—the layer samples a compressed latent representation that retains task-relevant information while discarding redundant detail. In information-theoretic terms, the model seeks an encoding that maximizes mutual information with the target entity labels while constraining redundancy with the raw input, a trade-off balanced by a Lagrange multiplier. The first objective urges the latent representation to retain the key information needed to predict entity labels—for example, distinguishing malware hashes from normal file hashes in CTI texts—while the second forces it to discard task-irrelevant noise.

This bottleneck mechanism is paired with a dynamic loss function based on mutual information maximization that quantifies the statistical dependency between span representations and entity labels. During training, the combined objective guides the model to dynamically balance the threshold between feature compression and information retention. The researchers found that model performance improves markedly when the adjustment coefficients are low, with the best results at a gamma value of 1e-5; as the value increases further, performance declines, indicating that excessive bottleneck constraints can weaken the model’s generalization to unknown domain entities. The design ensures the model remains focused on the core NER task while simultaneously enhancing representation quality, avoiding both the reduced classification performance caused by over-compression and the noise residue left by insufficient compression.

To validate the approach, the team first benchmarked VIB-NER against state-of-the-art models on general-domain datasets with high OOV rates, including WNUT 2017, TwitterNER, Conll03-Typos, and Conll2003-OOV—the last generated by replacing test-set entities with out-of-vocabulary entities never seen in training. Baselines included SpanNER, DataAug, InferNER, MIN, CoFEE, SA-NER, T-NER, MINER, E-NER, and ACRF-NER, a recent method that applies conditional random fields over aggregated word embeddings. VIB-NER surpassed the performance bottlenecks of conventional approaches across the high-OOV datasets and maintained its lead even on TwitterNER, where the OOV rate is lower. The model also proved robust across different pre-trained encoders, delivering improved recognition performance with BERT, RoBERTa, and ALBERT as underlying language models.

The second validation effort produced a new resource for the field: CTINER, a specialized named entity recognition dataset for network threat intelligence. Recognizing that open-source automatic annotation tools could not fully recognize the field’s numerous specialized terms, the researchers adopted a manual methodology. Three annotators with CTI expertise performed the initial labeling, achieving a Cohen’s kappa coefficient of 0.84 on a 10 percent validation sample, indicating high consistency, with subsequent verification by security experts. The annotation effort covered 1,582 threat reports spanning August 2008 to December 2024, executed using the Brat annotation tool. The resulting dataset contains 12,984 sentences, 280,134 tokens, and 49,565 entities across 13 categories, including hacker organizations, advanced persistent threats, sample files, security teams, tools, operating systems, vulnerabilities, and network addresses. To resolve ambiguities, the team leveraged a knowledge base grounded in the MITRE ATT&CK framework and adhering to the STIX standard, which enables clear differentiation between entity categories such as threat actor, campaign, and tool.

Compared with the existing DNRTI dataset, CTINER offers a higher OOV rate, more targeted category coverage under a standardized classification framework, and greater scale in labeled sentences across training, test, and development splits. In cross-dataset experiments, ablation studies isolated the contributions of the three core factors: the span-based architecture, which enhances the ability to process long texts; VIB compression, which alleviates the OOV problem; and mutual information optimization, which strengthens entity boundary recognition in scenarios with imbalanced labels. VIB-NER outperformed both SpanNER and MINER on the CTI data. The researchers acknowledge that indicator values on CTINER were lower than on DNRTI—but, they argue, this precisely confirms the new dataset’s value, since its high OOV rate and imbalanced label distribution genuinely reproduce the technical difficulties of the CTI domain.

The efficiency gains proved equally significant. The variational information bottleneck imposes information-theoretic constraints that compel the model to discard redundant information unrelated to the target task during encoding, achieving sparse representations that curb overfitting to non-significant features in high-dimensional inputs. This lets the model grasp universal data patterns quickly and reduces the need for frequent adjustments and retraining. Comparative charts of training time show VIB-NER processing more batches per unit of time than SpanNER and E-NER, with overall training duration substantially lower—a consequence of the dynamic mutual information loss precisely guiding the training direction, accelerating convergence, and avoiding ineffective training steps.

The researchers trained their model on an NVIDIA GeForce RTX 4060 GPU, using a learning rate of 5e-5, a dropout rate of 0.2, a bottleneck output dimension of 50, a maximum input length of 128 tokens, and a cap of four on enumerated entity length, with final reports based on the average of the three best-performing checkpoints. Looking ahead, the team says future work will focus on few-shot and unsupervised learning methods to break through the data bottleneck in cybersecurity named entity recognition, where unified datasets remain scarce and manual annotation costs remain high. For defenders facing adversaries who generate novel threat vocabulary faster than any dictionary can track, the message is clear: the tools that read the internet’s dark corners must learn to compress away noise and hold on to what matters—and VIB-NER offers a mathematically grounded way to do exactly that.