Annotated corpus generation method and electronic device for network threat intelligence

Abstract

The present invention provides a method and electronic device for generating tagged corpus oriented to network threat intelligence, including: extracting security entities in a training set of structured threat intelligence data, and mapping each structured threat intelligence data into <头实体、关系类型、尾实体>Triple group, get the head entity set and tail entity set; extract the security entity in the text to be marked, and obtain the sentence containing at least one security entity belonging to the head entity set and at least one security entity belonging to the tail entity set; judge whether the sentence contains relation type; for all sentences <头实体、关系类型、尾实体>The triplets are labeled to obtain the initial labeled data set, and then the denoised labeled data set. According to the remote supervision theory, the present invention uses existing structured network threat intelligence data to mark unmarked corpus to generate large-scale training corpus, and proposes automatic denoising and cross-checking methods to solve the problem of noise data in the marked corpus.< / 头实体、关系类型、尾实体>

Description

technical field [0001] The invention belongs to the field of computer network security, and in particular relates to a method and an electronic device for generating marked corpus for network threat intelligence. Background technique [0002] With the development of information science and technology, the integration of network information space and social and economic life is gradually deepening, the scope of influence of network security threats is becoming wider and wider, and the consequences of customized network attacks are also more serious. At the same time, global cyberspace frequently suffers from increasingly complex and covert attacks. For example, in recent years, the number and scope of advanced persistent threats (Advanced Persistent Threat) and targeted attacks (Targeted Attack) worldwide have shown an increasing trend, posing a great threat to cyberspace. Facing the increasingly complex and severe network security situation, Cyber ​​Threat Intelligence (Cyb...

AI Technical Summary

Problems solved by technology

[0008] Aiming at the technical problems existing in the prior art, the purpose of the present invention is to provide a network threat intelligence-oriented labeling corpus generation method and an electronic device. Annotate the corpus for automatic annotation, generate large-scale training corpus, and propose automatic denoising and cross-validation methods to solve the problem of noisy data in the annotated corpus

Images