## 4 Experimental Design and Analysis
### Entity Recognition Result Analysis  
To verify the performance of the CSBERT-IDCNN-BiLSTM-CRF network security named entity recognition model proposed in this paper, different models were selected for experiments on the same dataset. The experimental results are shown in Table 3. The network security entity recognition model proposed by [PERSON] et al. [21] is used as a benchmark model. The remaining models include mainstream sequence labeling models such as the BiLSTM-CRF, CNN-BiLSTM-CRF model with convolutional neural networks introduced, and IDCNN-BiLSTM-CRF proposed in this paper for sequence labeling tasks. Furthermore, by introducing the BERT model and the cybersecurity pre-trained CSBERT model, \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter Name** & **Numerical Value** \\ \hline Pretrained Model Dropout & 0.1 \\ Dropout of LSTM layer & 0.5 \\ Dropout of IDCNN layer & 0.5 \\ Weight decay & 0.01 \\ Word vector & 768 \\ LSTM hidden layer size & 256 \\ Number of tags & 23 \\ Epoch & 100 \\ Batch size & 32 \\ IDCNN input maximum length & 120 \\ BERT learning rate & 0.00002 \\ IDCNN learning rate & \(5\times\) Bert learning rate \\ LSTM learning rate & \(5\times\) Bert learning rate \\ Fully connected layer learning rate & \(5\times\) Bert learning rate \\ CRF layer learning rate & \(100\times\) Bert learning rate \\ Warm up & 0.1 \\ Optimizer & AdamW \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Experimental hyperparameter settings. Figure 9: Proportion of each entity category. a more comprehensive and precise comparative analysis was conducted, thereby accentuating the superior capability of this model in the recognition of Chinese cybersecurity entities. Model performance is evaluated and analyzed based on precision, F1 score, and recall using a classical evaluation system. Through the line chart, the changes of various evaluation indicators between different models can be displayed more intuitively. The statistical graph of model performance is shown in Figure 10:  
The experiment was conducted on the nine models mentioned above. As shown in the figure, in the task of network security named entity recognition, the mainstream BiLSTM-CRF model performs better than [PERSON]'s proposed network security entity recognition model. [PERSON]'s strategy of improving small-sample information security in the field by introducing active learning did indeed yield results slightly higher than those of the classic BiLSTM-CRF model. [PERSON] used dictionary correction to improve representation outcomes, adding a correction step on top of the classic BiLSTM-CRF model and significantly increasing the model's accuracy. However, due to differences in Chinese and English structures, using BiLSTM-CRF cannot effectively capture Chinese sequence information and local features. From the results of these two models, without addressing the  
Figure 10: Comparison of multi-model effects. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **P (\%)** & **F1 (\%)** & **R (\%)** \\ \hline [PERSON] [21] & 71.34 & 73.32 & 75.37 \\ [PERSON] [24] & 70.23 & 75.12 & 80.13 \\ [PERSON] [25] & 70.62 & 75.71 & 81.37 \\ BiLSTM-CRF & 69.72 & 74.29 & 80.11 \\ CNN-BiLSTM-CRF & 71.39 & 75.42 & 79.31 \\ [PERSON] [26] & 71.81 & 76.02 & 79.59 \\ IDCNN-BiLSTM-CRF & 72.37 & 76.42 & 80.33 \\ \hline BERT+IDCNN-BiLSTM-CRF & 83.89 & 85.65 & 87.7 \\ CSBERT+IDCNN-BiLSTM-CRF & 85.89 & 87.3 & 88.88 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Experimental results of each model. effective capture of Chinese sequence information and local features, improvements based solely on the classic BiLSTM-CRF model are limited for Chinese entity recognition. After introducing CNN, the CNN-BiLSTM-CRF model has obtained the ability to capture local features and to some extent process Chinese specific structures to obtain sequence information.