Threat intelligence named entity recognition method based on machine reading understanding

Abstract

The invention discloses a threat intelligence named entity recognition method based on machine reading understanding, which comprises the following steps: performing sentence segmentation processing on threat intelligence, filtering sentences which do not contain network security professional vocabularies based on a network security professional lexicon, and obtaining a sentence set after filtering; sentences in the sentence set are taken one by one, and each entity in the sentences is marked with a question and answer pair; training a recognition model by using the labeled sentence set; and performing named entity recognition on the threat intelligence by using the trained recognition model. The threatening intelligence named entity recognition based on machine reading understanding can effectively solve the problems of fuzzy classification of threatening intelligence entities and entity nesting; the built problem is provided with entity hidden information, so that the recognition accuracy can be effectively improved; according to the method, entity recognition is converted into a classification matching problem from a sequence labeling problem, so that one sentence with a plurality of entities can generate a plurality of training samples, and the requirement on the number of sentences is reduced.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a threat intelligence named entity identification method based on machine reading comprehension. Background technique [0002] With the rapid development of network information technology, the security situation of cyberspace is becoming increasingly severe. To protect network security, we must not only outperform the attacker in technology, but also be ahead of the attacker in consciousness, pay enough attention to the "unknown unknown", and plan ahead. Opportunity to take. Therefore, the effective analysis of threat intelligence has important practical significance and scientific research value for the defense of organized, premeditated and various security threats. [0003] Threat intelligence analysis must be based on knowledge extraction and identify the corresponding entities and relationships. Currently named entity recognition NER mainly includes th...

AI Technical Summary

Problems solved by technology

[0004] On the one hand, the common problems of these traditional methods are that they cannot represent the ambiguity of words, and it is difficult to identify multi-layer nested entities, but there are a large number of such situations in threat intelligence and the classification of threat intelligence entities is relatively vague, which is also a threat A major difficulty in intelligence analysis

On the other hand, the current field-oriented NER research is relatively concentrated in scientific fields such as medicine and biology, and there is still little research in the field of threat intelligence for network security.

Images