## 3 Chinese Network Security Named Entity Recognition Method Based on CSBERT-IDCNN-BiLSTM-CRF
### Theoretical Analysis of the CSBERT-IDCNN-BiLSTM-CRF Model
#### 3.1.3 Use DCNN to Stack and FORM IDCNN Module  
Although the use of the BiLSTM-CRF model has achieved excellent results in multiple NER tasks and has become one of the baselines for NER tasks, there are some unstructured features in Chinese cybersecurity text data that differ from public domain texts. Specifically, these features include the following two types:  
1. Complexity  
Text data in the field of network security is often mixed with Chinese, English, numbers, and special symbols. 2. Repetition  
When describing software and programs, there is often a lot of repetitive content, which increases the difficulty of entity recognition [30]. Due to the inclusion of these two special features, BiLSTM cannot fully extract sequential information from Chinese network security texts. Therefore, this paper proposes a model that incorporates BiLSTM-CRF and introduces CNN. However, when using the original CNN to handle sequence labeling problems, there are two main issues. Firstly, traditional CNN adds pooling operations after convolution operations to reduce data dimensions and minimize model performance requirements. However, adding pooling operations when processing text sequences can lead to loss of sequence information. Secondly, natural language is mostly composed of sentences. Deep learning requires the ability to process long textual data. The receptive field of CNN is small and can only increase by stacking convolutional layers, which easily leads to overfitting problems [31]. To avoid the above-mentioned problems, a different type of convolutional neural network (DCNN) was chosen instead of traditional CNN [32]. DCNN introduces the dilation mechanism in the convolutional kernel, replacing pooling operations to reduce information loss. With the same size of convolutional kernel, it increases receptive field and enhances the model's ability to process long text data. Calculate the receptive field of dilated convolution, as shown in Formula (5). \[F_{i+1}=\left(2^{i+w}-1\right)\times\left(2^{i+w}-1\right) \tag{5}\]  
where them, \(F\) represents the size of the receptive field, \(i\) is the stride, and \(w\) is the dilation width. Iterated Dilated Convolutional Neural Network (IDCNN) [33] stacks dilated convolution modules on top of DCNN to obtain greater text processing capability. The structure of the dilated convolution module is shown in Figure 5.  
The IDCNN module in this paper is composed of four identical DCNN modules stacked together. Each DCNN module contains three layers of convolution with dilation widths of 1, 1, and 2 respectively. The parameters are shared where the four DCNN modules. The receptive field of the IDCNN model will exponentially increase as the DCNN modules are stacked, and the growth rate of the receptive field is much higher than that of the number of layers to reduce the probability of overfitting issues occurring. The IDCNN-BiLSTM-CRF feature extraction module combines the local features and sequence features of the text, making more full use of the text information, integrating multiple granularities of text features, and improving the performance of network security entity recognition. Given a sequence \(X=\left\{x_{1},\,x_{2},......,\,x_{n}\right\}\) consisting of n characters and the final encoded sequence \(H=\left\{h_{1},\,h_{2},......,\,h_{n}\right\}\), with dilation width \(W_{j}=\left\{1,\,2,\,4\right\}\) for dilated convolutions where \(j=1,\,2,\,3\), perform dilated convolution operations on sequence \(X=\left\{x_{1},\,x_{2},......,\,x_{n}\right\}\). Let \(C^{{}^{\prime}}_{k}\) represent the \(j\)-th layer with dilation width \(k\) for dilated convolution layers. After performing dilated convolution operation using the first layer \(C^{1}{}_{1}\) as an example, the output sequence \(X_{j}\) is obtained. \[X_{j}=C^{1}{}_{1}X \tag{6}\]  
And \(X\) represents the input sequence.