Few-shot cybersecurity event detection method by data augmentation with prompting question answering

The cybersecurity field lacks sufficient annotated data for event recognition, and the scenarios and semantics are complex, making it difficult to construct accurate event recognition models. A few-shot cybersecurity event detection method by data augmentation with prompting question answering was proposed. Firstly, event representation knowledge was obtained using prompt information and combined with label words to map cybersecurity event types. New data was generated from unlabeled text to expand the training data. Then, the generated high-confidence pseudo-annotated instances and raw data were used to fine-tune the model to enhance its semantic understanding of cybersecurity events. Experimental verification was conducted on two datasets in cybersecurity. The result showes that the proposed method’s substantial superiority in low-resource network security event detection tasks compared to other baseline methods.