Network threat intelligence-oriented annotation corpus generation method and electronic device

Abstract

The invention provides a network threat intelligence-oriented annotation corpus generation method and an electronic device, and the method comprises the steps of extracting a safety entity in a structured threat intelligence data training set, mapping each piece of structured threat intelligence data into a (head entity, relation type and tail entity) triple, and obtaining a head entity set and atail entity set; extracting security entities in the to-be-labeled text, and obtaining sentences containing at least one security entity belonging to the head entity set and at least one security entity belonging to the tail entity set; judging a relationship type contained in the sentence; annotating each (head entity, relationship type and tail entity) triple of all sentences to obtain an initial annotation data set, and then obtaining a denoised annotation data set. According to a remote supervision theory, existing structured network threat intelligence data is utilized to label unlabeledcorpora, large-scale training corpora are generated, and an automatic denoising and cross validation method is provided to solve the problem that noise data exists in the labeled corpora.

Description

technical field [0001] The invention belongs to the field of computer network security, and in particular relates to a method and an electronic device for generating marked corpus for network threat intelligence. Background technique [0002] With the development of information science and technology, the integration of network information space and social and economic life is gradually deepening, the scope of influence of network security threats is becoming wider and wider, and the consequences of customized network attacks are also more serious. At the same time, global cyberspace frequently suffers from increasingly complex and covert attacks. For example, in recent years, the number and scope of advanced persistent threats (Advanced Persistent Threat) and targeted attacks (Targeted Attack) worldwide have shown an increasing trend, posing a great threat to cyberspace. Facing the increasingly complex and severe network security situation, Cyber ​​Threat Intelligence (Cyb...

AI Technical Summary

Problems solved by technology

[0008] Aiming at the technical problems existing in the prior art, the purpose of the present invention is to provide a network threat intelligence-oriented labeling corpus generation method and an electronic device. Annotate the corpus for automatic annotation, generate large-scale training corpus, and propose automatic denoising and cross-validation methods to solve the problem of noisy data in the annotated corpus

Images