Entity identification method and device, equipment and storage medium

Abstract

The invention provides an entity recognition method and device, equipment and a storage medium. The method comprises the steps of obtaining original threat intelligence texts; for each original threat intelligence text, marking each segmented word in the original threat intelligence text according to the entity type of the entity to which the segmented word belongs to obtain a training sample; and inputting the training sample into an entity recognition model, and training the entity recognition model by using each segmented word in the training sample and the entity mark corresponding to the segmented word to obtain a trained entity recognition model, wherein a loss function used by the entity recognition model in the training process is used for reducing the spatial distance between segmented words with the same entity mark and increasing the spatial distance between segmented words with different entity marks; and inputting to-be-recognized threat intelligence texts into the trained entity recognition model to obtain an entity recognition result. The recognition accuracy of specific types of entities in the threat intelligence field can be improved.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular, to an entity identification method, device, equipment and storage medium. Background technique [0002] In the field of information security technology, APT (Advanced Persistent Threat, Advanced Persistent Threat) attack means that the attacker uses long-term intelligence collection, information monitoring, etc. Cyber-attacks by demanding technological industry sectors. Due to the strong concealment of APT attacks, in order to better deal with APT attacks, different technology industry departments need to share the threat intelligence collected by them. , attackers, malware, vulnerabilities, and other indicators of attack collected data sets. In this way, exchanging "space" for "time" through threat intelligence sharing is conducive to the adoption of a coordinated approach between different technology industry departments to jointly respond to APT attacks an...

AI Technical Summary

Problems solved by technology

However, for threat intelligence, unlike common text data, the text data of threat intelligence usually has a longer length, and the length of each sentence is far longer than that of ordinary text data. The distance between the two target type entities in the text data is often very far, resulting in a serious imbalance in the distribution of data labels in the sample data.

In this way, when the existing entity recognition model is directly used for entity recognition, due to the serious imbalance in the distribution of data labels in the sample data, the accuracy of the existing entity recognition model for threat intelligence entity recognition results will be low.

Images