SecureNLP - Malware Report Semantic Extraction

# SecureNLP - Malware Report Semantic Extraction
# Based on Phandi et al., SemEval 2018 (SecureNLP), MalwareTextDB corpus
# Paper: https://aclanthology.org/S18-1113/
# Dataset: https://competitions.codalab.org/competitions/17262
#
# SecureNLP defines four incremental SubTasks over sentences from APT
# malware reports:
#   SubTask 1: classify whether a sentence is relevant to malware
#              actions/capabilities (relevant vs. irrelevant)
#   SubTask 2: predict token labels (Action / Entity / Modifier)
#   SubTask 3: predict relation labels between tokens
#              (SubjAction, ActionObj, ActionMod, ModObj)
#   SubTask 4: predict MAEC attribute labels for Action tokens
#
# This showcase covers SubTask 1 (sentence relevance), SubTask 2 (token
# labels), and SubTask 4 (attribute category on Action tokens).
#
# Token Labels (SubTask 2):
# - Action: an event/verb describing malware behaviour (e.g. "implements",
#           "deploys", "transferred")
# - Entity: the initiator (Subject) or recipient (Object) of an Action,
#           or word phrases elaborating on the Action
# - Modifier: tokens linking to phrases that elaborate on the Action (e.g. "to")
#
# Attribute Categories (SubTask 4, from the MAEC vocabulary):
# - ActionName, Capability, StrategicObjectives, TacticalObjectives

annotation_task_name: "SecureNLP - Malware Report Semantic Extraction"
task_dir: "."

data_files:
  - sample-data.json

item_properties:
  id_key: "id"
  text_key: "text"

output_annotation_dir: "annotation_output/"
output_annotation_format: "json"

port: 8000
server_name: localhost

annotation_schemes:
  - annotation_type: radio
    name: sentence_relevance
    description: "SubTask 1: Is this sentence relevant to malware actions or capabilities?"
    labels:
      - "Relevant"
      - "Irrelevant"
    keyboard_shortcuts:
      "Relevant": "1"
      "Irrelevant": "2"
    tooltips:
      "Relevant": "The sentence describes a malware action or capability"
      "Irrelevant": "The sentence provides no information about malware behaviour"

  - annotation_type: span
    name: token_labels
    description: "SubTask 2: Highlight tokens as Action, Entity, or Modifier."
    labels:
      - "Action"
      - "Entity"
      - "Modifier"

  - annotation_type: multiselect
    name: attribute_category
    description: "SubTask 4: Which MAEC attribute categories apply to the Action tokens?"
    labels:
      - "ActionName"
      - "Capability"
      - "StrategicObjectives"
      - "TacticalObjectives"
    tooltips:
      "ActionName": "Specific named action from the MAEC vocabulary (211 labels)"
      "Capability": "Malware capability, e.g. data exfiltration (20 labels)"
      "StrategicObjectives": "Higher-level strategic objective of the action (65 labels)"
      "TacticalObjectives": "Tactical objective realising a capability (148 labels)"

annotation_instructions: |
  You will be shown a sentence from a malware / APT cybersecurity report.
  Following the SecureNLP protocol:
  1. Mark whether the sentence is Relevant (describes a malware action or
     capability) or Irrelevant.
  2. For relevant sentences, highlight tokens with the Action, Entity, or
     Modifier labels. Action is the malware event/verb; Entity is the
     Subject/Object of the Action; Modifier links to elaborating phrases.
  3. Select the MAEC attribute categories that apply to the Action tokens.

html_layout: |
  <div style="padding: 15px; max-width: 800px; margin: auto;">
    <div style="background: #f0f9ff; border: 1px solid #bae6fd; border-radius: 8px; padding: 16px; margin-bottom: 16px;">
      <strong style="color: #0369a1;">Sentence:</strong>
      <p style="font-size: 16px; line-height: 1.7; margin: 8px 0 0 0;">{{text}}</p>
    </div>
  </div>

allow_all_users: true
instances_per_annotator: 50
annotation_per_instance: 2
allow_skip: true
skip_reason_required: false