# Define the MLP model
### The CSI Extractor  
The CSI extractor extracts all the cybersecurity intelligence details (CSIs) from threat-articles with the HBKSL method. The HBKSL is designed to locate the key sentence for a CSI-candidate or a CSI-candidate group. We define the domain, URL, hash, CVE records, and IP in the article as CSI-candidate, as these data have a possibility to be CSI. A CSI-candidate group means CSI-candidate data in list format, which cannot be extracted by existing methods, and we defined the key sentence as the sentence that can determine whether the CSI-candidates are valid or not.  
As Figure 2 shows, a CSI group cannot be extracted according to their embedded sentences. However, the sentence \"Below is a list with the date, IP address, and domain... \" indicates the following CSI-candidates are valid. By utilizing the HTML tag distribution characteristics of the CSIs and its relevant key sentence, GCO has achieved good coverage of the CSIs.  
As Figure 6 shows, \"fix-mo.tk\" and \"flv.79 highstreet.co.uk\" can be validated by their relevant key sentence, and the two CSIs have the same HTML properties. We define a CSI-candidate with its embedded HTML tag, HTML attribute, the parent tag of the HTML tag, and the attribute of the parent tag as a CSI-dataset. The CSI-datasets with the same HTML properties are clustered into a CSI-candidate group. Then we apply the HBKSL method and a hierarchical keyword matching (HKM) method on the CSI-candidate groups to extract the CSIs with its relevant details, e.g., type. The working flow of the CSI Extractor is shown in Figure 7.  
</p><-p>The ETTest gate occasionally changes IP addresses, but since January 2016, this campaign used the 85.93.0.0.024 block. So far this year, the TLD for these domains has most often been \(x\), but other TLDs are also used. Below is a list with the date, IP address, and domain we have seen for the ETTest gate URL</p>  
<ul>  
<l>2014-09-22: 148.251.56[.]156 - fiv.79 highstrect.col[.]uk</l>  
<l>2014-10-02: 148.251.56[.]156 - fiv.78-mcd.[.]uk</l>  
<l>2015-06-08: 194.15.126[.]7 - jona[.]g=/l>  
<l>2015-11-10: 31.184.192[.]206 - yuscent[.]mk</l>  
<l>2015-12-04: 31.184.192[.]206 - ve  
```
Input: CSI-candidate group, present_CSI_candidate; Input: preprocessed HTML document; Output: key_sentence;
1. function find_text_based_html(present_CSI, html)
2. pre_items \(\leftarrow\) present_CSI_candidate.tag.find_previous_tag()
3. ifpre_items.text not NULL then
4. key_sentence \(\leftarrow\) pre_items.text
5. return key_sentence
6. parent_items \(\leftarrow\) present_CSI_candidate.tag.find_parent_tag()
7. ifparent_items.text not NULL then
8. key_sentence \(\leftarrow\) parent_items.text
9. return key_sentence
10. uncle_items \(\leftarrow\) present_CSI_candidate.tag.find_nearest_uncle_tag()
11. ifuncle_items.text not NULL then
12. key_sentence \(\leftarrow\) uncle_items.text
13. return key_sentence
14. return NULL
```  
**Algorithm 1**HTML-based key sentence location.  
According to the HTML structure, the key sentence embedded tag can be the previous tag of the CSI-candidate contained tag, as well as the parent tag and the nearest uncle tag. The nearest uncle tag means the tag is in the same hierarchy with the parent tag and ahead of the parent tag. Figure 8 shows the relationship between nodes detailly in the example. The <p> tag is the nearest uncle tag of the <li> tag in Figure 6.