CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model

• Published in: Journal of cybersecurity and privacy Vol. 1; no. 4; pp. 615 - 637
• Main Authors: Ameri, Kimia, Hempel, Michael, Sharif, Hamid, Lopez Jr, Juan, Perumalla, Kalyan
• Format: Journal Article
• Language: English
• Published: Washington MDPI AG 04.11.2021
• Subjects: Automation; BERT; Classification; Cybersecurity; CYVET; Data mining; Datasets; Infrastructure; Language; Natural language; natural language processing; Neural networks; Sentiment analysis; transfer learning
• ISSN: 2624-800X; 2624-800X
• DOI: 10.3390/jcp1040031

We introduce CyBERT, a cybersecurity feature claims classifier based on bidirectional encoder representations from transformers and a key component in our semi-automated cybersecurity vetting for industrial control systems (ICS). To train CyBERT, we created a corpus of labeled sequences from ICS device documentation collected across a wide range of vendors and devices. This corpus provides the foundation for fine-tuning BERT’s language model, including a prediction-guided relabeling process. We propose an approach to obtain optimal hyperparameters, including the learning rate, the number of dense layers, and their configuration, to increase the accuracy of our classifier. Fine-tuning all hyperparameters of the resulting model led to an increase in classification accuracy from 76% obtained with BertForSequenceClassification’s original architecture to 94.4% obtained with CyBERT. Furthermore, we evaluated CyBERT for the impact of randomness in the initialization, training, and data-sampling phases. CyBERT demonstrated a standard deviation of ±0.6% during validation across 100 random seed values. Finally, we also compared the performance of CyBERT to other well-established language models including GPT2, ULMFiT, and ELMo, as well as neural network models such as CNN, LSTM, and BiLSTM. The results showed that CyBERT outperforms these models on the validation accuracy and the F1 score, validating CyBERT’s robustness and accuracy as a cybersecurity feature claims classifier.