Cybersecurity risks and malware threats are becoming increasingly dangerous and common . Despite the severity of the problem , there has been few NLP efforts focused on tackling cybersecurity . In this paper , we discuss the construction of a new database for annotated malware texts . An annotation framework is introduced based around the MAEC vocabulary for defining malware characteristics , along with a database consisting of 39 annotated APT reports with a total of 6,819 sentences . We also use the database to construct models that can potentially help cybersecurity researchers in their data collection and analytics efforts . In 2010 , the malware known as Stuxnet physically damaged centrifuges in Iranian nuclear facilities ( Langner , 2011 ) . More recently in 2016 , a botnet known as Mirai used infected Internet of Things ( IoT ) devices to conduct large-scale Distributed Denial of Service ( DDoS ) attacks and disabled Internet access for millions of users in the US West Coast ( US-CERT , 2016 ) . These are only two cases in a long list ranging from ransomeware on personal laptops ( Andronio et al . , 2015 ) to taking over control of moving cars ( Checkoway et al . , 2011 ) . Attacks such as these are likely to become increasingly frequent and dangerous as more devices and facilities become connected and digitized . Recently , cybersecurity defense has also been recognized as one of the " problem areas likely to be important both for advancing AI and for its long-run impact on society " ( Sutskever et al . , 2016 ) . In particular , we feel that natural language processing ( NLP ) has the potential for substantial contribution in cybersecurity and that this is a critical research area given the urgency and risks involved . There exists a large repository of malwarerelated texts online , such as detailed malware reports by various cybersecurity agencies such as Symantec ( DiMaggio , 2015 ) and Cylance ( Gross , 2016 ) and in various blog posts . Cybersecurity researchers often consume such texts in the process of data collection . However , the sheer volume and diversity of these texts make it difficult for researchers to quickly obtain useful information . A potential application of NLP can be to quickly highlight critical information from these texts , such as the specific actions taken by a certain malware . This can help researchers quickly understand the capabilities of a specific malware and search in other texts for malware with similar capabilities . An immediate problem preventing application of NLP techniques to malware texts is that such texts are mostly unannotated . This severely limits their use in supervised learning techniques . In light of that , we introduce a database of annotated malware reports for facilitating future NLP work in cybersecurity . To the best of our knowledge , this is the first database consisting of annotated malware reports . It is intended for public release , where we hope to inspire contributions from other research groups and individuals . The main contributions of this paper are : • We initiate a framework for annotating malware reports and annotate 39 Advanced Persistent Threat ( APT ) reports ( containing 6,819 sentences ) with attribute labels from the Malware Attribute Enumeration and Characterization ( MAEC ) vocabulary ( Kirillov et al . , 2010 ) . • We propose the following tasks , construct models for tackling them , and discuss the challenges : • Classify if a sentence is useful for inferring malware actions and capabilities , • Predict token , relation and attribute labels for a given malware-related text , as defined by the earlier framework , and • Predict a malware 's signatures based only on text describing the malware . In this paper , we presented a framework for annotating malware reports . We also introduced a database with 39 annotated APT reports and proposed several new tasks and built models for extracting information from the reports . Finally , we discuss several factors that make these tasks extremely challenging given currently available models . We hope that this paper and the accompanying database serve as a first step towards NLP being applied in cybersecurity and that other researchers will be inspired to contribute to the database and to construct their own datasets and implementations . More details about this database can be found at http://statnlp.org / research / re/.

Challenge: Regardless of the possible dangers of malware and the existence of related corpus, there are no annotated datasets hindering the development of NLP tools.
Approach: They present an annotation scheme for malware texts with its instancilization using an existing corpus, and evaluate existing models on the new data and tasks.
Outcome: Benchmark experiments with newly introduced data and tasks reveal several difficulties in existing models.