Exploring the Limits of Transfer Learning with Unified Model in the Cybersecurity Domain

TL;DR

This paper introduces UTS, a generative multi-task NLP model trained on diverse cybersecurity texts, which enhances threat detection and adapts efficiently to new tasks with limited data.

Contribution

The paper presents UTS, a unified multi-task generative model for cybersecurity NLP tasks, addressing data scarcity and enabling quick adaptation to unseen tasks.

Findings

UTS improves performance on multiple cybersecurity datasets.

UTS can be adapted to new tasks with few examples.

The model handles diverse text sources effectively.

Abstract

With the increase in cybersecurity vulnerabilities of software systems, the ways to exploit them are also increasing. Besides these, malware threats, irregular network interactions, and discussions about exploits in public forums are also on the rise. To identify these threats faster, to detect potentially relevant entities from any texts, and to be aware of software vulnerabilities, automated approaches are necessary. Application of natural language processing (NLP) techniques in the Cybersecurity domain can help in achieving this. However, there are challenges such as the diverse nature of texts involved in the cybersecurity domain, the unavailability of large-scale publicly available datasets, and the significant cost of hiring subject matter experts for annotations. One of the solutions is building multi-task models that can be trained jointly with limited data. In this work, we introduce a generative multi-task model, Unified Text-to-Text Cybersecurity (UTS), trained on malware reports, phishing site URLs, programming code constructs, social media data, blogs, news articles, and public forum posts. We show UTS improves the performance of some cybersecurity datasets. We also show that with a few examples, UTS can be adapted to novel unseen tasks and the nature of data