Vulnerability event intelligence early warning method and device based on large model

Abstract

The invention discloses a vulnerability event intelligence early warning method and device based on a large model, and relates to the network security and artificial intelligence technology, and the method comprises the steps: obtaining data information related to a vulnerability event, and carrying out the knowledge extraction of the obtained data information, so as to obtain an entity and a relation related to a vulnerability; according to the extracted entity and relation related to the vulnerability, generating a vulnerability event by utilizing a set vulnerability information template; and inputting the generated vulnerability event into a pre-trained vulnerability intelligence large model to obtain a vulnerability brief report and a vulnerability early warning. According to the method, vulnerability early warning and brief reports can be quickly and accurately generated. The method can provide powerful support for the security management decision of the organization before the vulnerabilities are not widely utilized, and avoids the loss caused by the utilization of the vulnerabilities by attackers.

Description

Technical Field

[0001] The present application relates to the fields of network security and artificial intelligence technology, and in particular to a vulnerability event intelligence warning method and device based on a large model. Background Art

[0002] With the rapid development of the Internet and mobile Internet, the network environment has become increasingly complex, and attack behaviors have become more industrialized and gang-like. Traditional security strategies that focus on defending vulnerabilities are difficult to cope with new, persistent, and advanced network threats, so it is necessary to transform into a proactive, intelligence-centered security construction model. The data sources of the threat intelligence library include internal intelligence, professional institutions, and industry alliances. Internal intelligence comes from the interception of traditional security equipment, the analysis of the background security analysis system, and the discovery of the business risk control system; professional institutions provide multi-source intelligence and conduct manual judgment when intelligence conflicts; threat intelligence sharing by industry alliances is under research and exploration. In actual operations, it is a challenge to obtain accurate, timely, and diverse threat intelligence. At the same time, how to seamlessly integrate threat intelligence into the organization's own daily vulnerability handling processes and mechanisms is also one of the difficulties in technical implementation.

[0003] Knowledge extraction technology is an important branch in the field of natural language processing (NLP). It aims to extract valuable information from unstructured or semi-structured data sources and convert it into structured knowledge representation. This technology has been widely used in many fields, such as information retrieval, question-answering systems, knowledge graph construction, semantic networks, etc. With the popularization of the Internet and the advent of the big data era, people can easily obtain massive amounts of text data. However, these data are often unstructured and difficult to use directly for analysis and mining. Therefore, knowledge extraction technology came into being to convert these unstructured data into structured knowledge that can be understood by computers, thereby providing people with more intelligent services.

[0004] At present, vulnerability intelligence warning and analysis mainly rely on authoritative databases, security assessments, and vulnerability management tools. Although authoritative databases are accurate, there are a large number of vulnerabilities that are not included in databases such as CVE, CNNVD, and CNVD, and 0day data only accounts for a very small part of the included vulnerabilities. Therefore, it is necessary to collect uncollected vulnerability intelligence from various vendor announcements, security forums, communities, and other channels. Existing vulnerability intelligence analysis methods mainly rely on machine learning or manual analysis. Machine learning analysis of vulnerability intelligence requires a large amount of high-quality training data and has limited generalization capabilities. The ability to analyze and process the collected massive heterogeneous vulnerability intelligence data is limited, while manual analysis requires a lot of manpower and material resources and lacks efficiency.

[0005] There are many difficulties in using large models to directly analyze raw vulnerability intelligence. First, untrained large models perform poorly in areas related to network security vulnerability intelligence; second, unprocessed vulnerability intelligence data will affect the output of large models; and finally, large models consume too much computing power when faced with large amounts of input. Summary of the invention

[0006] The embodiment of the present application provides a vulnerability event intelligence warning method and device based on a large model, which analyzes and warns multiple vulnerability events through a fine-tuned large language model to form a vulnerability intelligence event warning method based on a large model.

[0007] The present application embodiment provides a vulnerability event intelligence warning method based on a large model, including:

[0008] Acquire data information related to vulnerability events, and perform knowledge extraction on the acquired data information to obtain entities and relationships related to the vulnerability;

[0009] Generate vulnerability events based on the extracted vulnerability-related entities and relationships using the set vulnerability intelligence template;

[0010] The generated vulnerability events are input into the pre-trained vulnerability intelligence model to obtain vulnerability briefings and vulnerability warnings.

[0011] Optionally, obtain data information related to the vulnerability event including:

[0012] parse the web page using a crawler and crawl specified content information, the content information including date, author, forum and content; and,

[0013] Use the BERT model to filter out data information related to vulnerability incidents from the crawled data information.

[0014] Optionally, extracting knowledge from the acquired data information includes:

[0015] Use the BERT model to encode the filtered data information to obtain the original sequence information;

[0016] Extracting a header entity from the original sequence information;

[0017] According to the relationship between the head entity and the original sequence information, obtain possible tail entities under any relationship;

[0018] The entity-relationship triplet with the greatest probability is taken as the extracted vulnerability-related entities and relations.

[0019] Optionally, performing knowledge extraction on the acquired data information specifically includes:

[0020] Segment the filtered data information;

[0021] The word segmentation results are encoded using the BERT model to obtain the hidden layer representation of each word segmentation;

[0022] The obtained hidden layer representation is decoded, and a binary classifier is used to determine the start and end positions of the head entity, wherein the binary classifier is used to calculate the probability of each word segment as the start position and the probability of each word segment as the end position. When the probability of the position is greater than a predetermined threshold, the head entity position is determined, satisfying:

[0023] p i_start =θ(W start x i +b start )

[0024] p i_end =θ(W end x i +b end )

[0025] Among them, p i_start represents the probability of word i as the starting position, p i_end Represents the probability of word i as the starting position;

[0026] According to the acquired head entity, the position of the tail entity corresponding to each relationship is decoded according to the Bert hidden layer vector and the identified head entity features to generate candidate triples;

[0027] The generated candidate triples are screened by predefined rules to obtain the triples of vulnerability-related entities and relations.

[0028] Optionally, based on the extracted vulnerability-related entities and relationships, using the set vulnerability intelligence template, vulnerability events are generated, including:

[0029] Pre-configure vulnerability intelligence templates based on intelligence event elements;

[0030] Calculate the edit distance of the same type of entities in the filtered triples. If the edit distance is less than or equal to the specified threshold, they are determined to be the same entity to determine the vulnerability triples;

[0031] The vulnerability triplet is filled in according to the vulnerability intelligence template to generate a vulnerability event.

[0032] Optionally, the generated vulnerability events are fed into a pre-trained vulnerability intelligence model to obtain vulnerability briefings and vulnerability warnings including:

[0033] Perform pre-training based on the specified base model;

[0034] For the pre-trained base model, use explicit prompt words to guide the model to generate targeted responses; and,

[0035] Combined with reinforcement learning methods, the pre-trained base model generates multiple answers to obtain a vulnerability intelligence large model, wherein the vulnerability intelligence large model has a built-in selector to output a specified number of answers.

[0036] Optionally, also include:

[0037] Build a vulnerability knowledge base;

[0038] Based on the vulnerability intelligence big model and the vulnerability knowledge base, early warnings are issued for risk vulnerabilities, and warnings and briefings are output.

[0039] An embodiment of the present application also proposes a vulnerability event intelligence warning device based on a large model, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the vulnerability event intelligence warning method based on a large model as described above are implemented.

[0040] This application proposes a vulnerability event intelligence warning method based on a large model, which uses the trained vulnerability intelligence large model to learn and analyze a large number of vulnerability events, and can quickly and accurately generate vulnerability warnings and briefings. It can provide strong support for the organization's security management decisions before the vulnerability is widely exploited, and prevent attackers from exploiting the vulnerability to cause losses.

[0041] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0043] Figure 1 The following is a basic flow diagram of the vulnerability event intelligence warning method according to an embodiment of the present application;

[0044] Figure 2 The following is a schematic diagram of the architecture of the vulnerability event intelligence warning method according to an embodiment of the present application;

[0045] Figure 3 This is a schematic diagram of the crawler and preprocessing of the vulnerability event intelligence warning method according to an embodiment of the present application;

[0046] Figure 4 It is a schematic diagram of triple extraction of the vulnerability event intelligence warning method according to an embodiment of the present application;

[0047] Figure 5 Schematic diagram of vulnerability event construction of the vulnerability event intelligence warning method of the embodiment of the present application

[0048] Figure 6 The following is a schematic diagram of the vulnerability intelligence big model warning process of the vulnerability event intelligence warning method according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0050] The present application embodiment provides a vulnerability event intelligence warning method based on a large model, such as Figure 1 , Figure 2 As shown, including:

[0051] In step S101, data information related to the vulnerability event is obtained, and knowledge extraction is performed on the obtained data information to obtain entities and relationships related to the vulnerability. In some embodiments, obtaining data information related to the vulnerability event includes:

[0052] A crawler is used to parse web pages and crawl specified content information, wherein the content information includes date, author, forum, and content; and a BERT model is used to filter out data information related to vulnerability events from the crawled data information.

[0053] In step S102, vulnerability events are generated based on the extracted entities and relationships related to the vulnerability and using the set vulnerability intelligence template.

[0054] In step S103, the generated vulnerability event is input into the pre-trained vulnerability intelligence model to obtain a vulnerability briefing and vulnerability warning.

[0055] This application uses a pre-trained and fine-tuned large language model to analyze and warn of multiple vulnerability events, forming a vulnerability intelligence event warning method based on a large model.

[0056] This application constructs a vulnerability knowledge extraction model to filter the crawled massive heterogeneous texts and extract vulnerability-related entities and relationships from them. Figure 3 As shown, knowledge extraction of the acquired data information includes:

[0057] The BERT model is used to encode the original sequence information based on the filtered data information. The deep bidirectional Transformer structure of the BERT pre-trained model can capture the contextual relationship of words in the text. BERT has learned rich representations of words through pre-training on a large amount of text data. These representations can reflect the meaning and importance of words in different contexts. When task-specific data is input into the pre-trained BERT model, the model can use these context-related representations to understand the text. The classifier uses the model built by the machine learning algorithm combined with rules to classify the text as irrelevant articles or vulnerability-related articles based on the BERT output.

[0058] Extracting a head entity from the original sequence information, and acquiring a possible tail entity under any relationship according to the relationship between the head entity and the original sequence information;

[0059] The entity-relationship triplet with the greatest probability is used as the extracted vulnerability-related entity and relationship. Specifically, the specified vulnerability relationship triplet can be extracted from the text through the entity and relationship joint extraction model, such as <software, existence, vulnerability>.

[0060] In some embodiments, extracting knowledge from the acquired data information specifically includes:

[0061] Segment the filtered data information, such as Figure 4 As described above, unstructured text data is extracted from web pages through a crawler tool using an automated script, and continuous text is segmented into independent words.

[0062] The word segmentation results are encoded using the BERT model to obtain the hidden layer representation of each word segmentation;

[0063] The obtained hidden layer representation is decoded, and a binary classifier is used to determine the start and end positions of the head entity, wherein the binary classifier is used to calculate the probability of each word segment as the start position and the probability of each word segment as the end position. When the probability of the position is greater than a predetermined threshold, the head entity position is determined, which is recorded as 1, satisfying:

[0064] p i_start =θ(W start x i +b start )

[0065] p i_end =θ(W end x i +b end )

[0066] Among them, p i_startrepresents the probability of word i as the starting position, p i_end Indicates the probability of word i being the starting position. If the probability of this position is less than the predetermined threshold, it is recorded as 0.

[0067] According to the acquired head entity, the position of the tail entity corresponding to each relationship is decoded according to the Bert hidden layer vector and the identified head entity features to generate candidate triples that satisfy:

[0068] p i_start =θ(W start (x i +v sub )+b start )

[0069] p i_end =θ(W end (x i +v sub )+b end )

[0070] Predefined rules screen the produced candidate triples and filter out unreliable triples to obtain triples of entities and relations related to vulnerabilities.

[0071] In some embodiments, Figure 5 As shown in the figure, based on the extracted entities and relationships related to the vulnerability, the vulnerability events generated by using the set vulnerability intelligence template include:

[0072] Configure the vulnerability intelligence template in advance according to the intelligence event elements. The specific intelligence event elements should include: time, place, person, thing, cause, and result. When describing a vulnerability event, based on the timeliness, accuracy, diversity, and practicality of the intelligence event elements and the vulnerability intelligence itself, a vulnerability intelligence event template is proposed: "<Date>, <Poster> posted on <Forum> that <Software> developed by <Manufacturer> has a <Vulnerability>, which was discovered by <Security Organization> through <Vulnerability Mining / Mining Method>, and the vulnerability may be used for <Attack Method>". This template covers the necessary elements of vulnerability intelligence and can accurately describe a vulnerability event. In the embodiment of the present application, the configuration of the vulnerability intelligence template can also be performed after the vulnerability is matched, and the execution order of the steps is not limited.

[0073] The edit distance of the same type of entities in the filtered triples is calculated. If the edit distance is less than or equal to the specified threshold, they are determined to be the same entity to determine the vulnerability triples.

[0074] For the vulnerability relationship triple: After the extraction of vulnerability knowledge, triples such as <software, has, security vulnerability>, <security organization, mentions, vulnerability>, <manufacturer, develops, software>, <vulnerability discovery tool / discovery method, discovers, vulnerability>, <vulnerability, is exploited by, attack method> are obtained. The embodiments of the present application further match the same entities. Specifically:

[0075] Calculate the edit distance of entities of the same type in the triple. If the edit distance is less than or equal to the specified threshold, such as 2, it is determined to be the same entity. For example: In the two triples <OpenSSL, has, a vulnerability that can obtain encrypted communication content> and <Google, mentions, the encrypted content leakage vulnerability>, calculate the edit distance of the entities of the vulnerability type, and if the edit distance is less than or equal to 2, it is determined that the vulnerabilities referred to by these two triples are the same vulnerability.

[0076] Fill the vulnerability triple according to the vulnerability intelligence template to generate a vulnerability event. For example: In April 201x, a vulnerability regarding the encryption library under the OpenSSL team was reported on Reddit. This vulnerability was discovered by Google and can be used to steal sensitive information.

[0077] Based on the foregoing embodiments, further input multiple vulnerability events into the vulnerability intelligence large model, use prompt words to require the large model to give vulnerability warnings and vulnerability briefings, and manually confirm the output results. If the determination is qualified, it is stored in the vulnerability knowledge base; if the determination is unqualified, it is discarded. Specifically, in some embodiments, as Figure 6 shown, input the generated vulnerability events into the pre-trained vulnerability intelligence large model to obtain vulnerability briefings and vulnerability warnings including:

[0078] Perform pre-training based on a specified base model. The base model, such as Baichuan-13B, performs well in Chinese and English, occupies less video memory resources, and has strong dialogue capabilities. The pre-training data includes: manufacturer vulnerability security announcements, vulnerability authoritative libraries (CVE, CNNVD, CNVD), self-built vulnerability discovery tool sets, Common Attack Pattern Enumeration and Classification (CAPEC), ExploitDB, and other basic network security vulnerability-related knowledge data.

[0079] Supervised training data: A set of vulnerability events constructed by machines and humans to enable the model to understand various types of vulnerability events and security instructions. Fine-tuning: Based on Baichuan-13B, on the basis of using QLoRA for pre-training, combined with the SFT method, complete model training on the manually constructed vulnerability event data set.

[0080] For the pre-trained base model, use explicit prompt words to guide the model to generate targeted responses; and,

[0081] Combined with reinforcement learning methods, the pre-trained base model generates multiple answers to obtain a vulnerability intelligence large model, wherein the vulnerability intelligence large model has a built-in selector to output a specified number of answers.

[0082] In a specific example, in order to improve the output quality of the model, the embodiment of the present application adopts two strategies:

[0083] By using more specific prompts to guide the model, it can focus more on user needs and generate more targeted responses. Then, combined with reinforcement learning methods, the model will generate multiple answers, and users can manually select the best answer, and then conduct reinforcement learning to continuously improve the model alignment capability.

[0084] The vulnerability intelligence model has a built-in selector that outputs three different answers each time. Users can choose the best answer based on their needs, which also provides valuable data for subsequent fine-tuning, helping the model to further improve the quality of the output. These methods work together to help ensure that the model output meets user expectations and plays a greater role in areas such as network security.

[0085] In some embodiments, it also includes: establishing a vulnerability knowledge base. For example, the established vulnerability knowledge base may include information from authoritative databases such as CVE, CNNVD, CNVD, ExploitDB, and also include manually collected and sorted vulnerability mining, vulnerability events, vulnerability announcements and other information.

[0086] Based on the vulnerability intelligence big model and the vulnerability knowledge base, early warnings are issued for risk vulnerabilities, and early warnings and briefings are output. Specifically, based on the aforementioned multiple vulnerability events, the vulnerability intelligence big model is input, and with the assistance of the vulnerability knowledge base, early warnings are issued for recent medium and high risk vulnerabilities based on the vulnerability intelligence big model.

[0087] The warning content includes: the software version involved, vulnerability type, vulnerability discussion, possible attack methods, etc.; and generates a recent vulnerability briefing, which includes: the number of software involved, the number of new vulnerabilities, the manufacturers involved, etc. After the warning and briefing are completed, the user will confirm it. If it is confirmed that there is no network, it will be stored in the vulnerability knowledge base; if it is wrong, it will be discarded.

[0088] This application proposes a solution to extract vulnerability-related intelligence from massive heterogeneous data on the Internet. First, the crawled unstructured data is classified into two categories, and then the triples of specific relationships are extracted through the entity and relationship joint extraction model. This improves the accuracy of extracted vulnerability intelligence and paves the way for subsequent vulnerability intelligence large model warnings and briefings.

[0089] By presetting templates and filling them according to triples, massive multi-source heterogeneous data can be converted into multiple vulnerability events containing key information and similar structures, which will help improve the efficiency of large model data analysis and improve the output stability of large models. The vulnerability event intelligence warning method of this application can quickly and accurately generate vulnerability warnings and briefings. It can provide strong support for the organization's security management decisions before the vulnerability is widely exploited, preventing attackers from exploiting the vulnerability to cause losses.

[0090] An embodiment of the present application also proposes a vulnerability event intelligence warning device based on a large model, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the vulnerability event intelligence warning method based on a large model as described above are implemented.

[0091] It should be noted that in the various embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0092] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0093] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0094] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A vulnerability event intelligence early warning method based on a large model, characterized in that: include: Acquire data information related to vulnerability events, and perform knowledge extraction on the acquired data information to obtain entities and relationships related to the vulnerability; Generate vulnerability events based on the extracted vulnerability-related entities and relationships using the set vulnerability intelligence template; The generated vulnerability events are input into the pre-trained vulnerability intelligence model to obtain vulnerability briefings and vulnerability warnings.

2. The vulnerability event intelligence early warning method based on a large model as claimed in claim 1 is characterized in that: The data information obtained related to the vulnerability incident includes: parse the web page using a crawler and crawl specified content information, the content information including date, author, forum and content; and, Use the BERT model to filter out data information related to vulnerability incidents from the crawled data information.

3. The vulnerability event intelligence early warning method based on a large model as claimed in claim 2 is characterized in that: Knowledge extraction from the acquired data information includes: Use the BERT model to encode the filtered data information to obtain the original sequence information; Extracting a header entity from the original sequence information; According to the relationship between the head entity and the original sequence information, obtain possible tail entities under any relationship; The entity-relationship triplet with the greatest probability is taken as the extracted vulnerability-related entities and relations.

4. The vulnerability event intelligence early warning method based on a large model as claimed in claim 3 is characterized in that: The knowledge extraction of the acquired data information specifically includes: Segment the filtered data information; The word segmentation results are encoded using the BERT model to obtain the hidden layer representation of each word segmentation; The obtained hidden layer representation is decoded, and a binary classifier is used to determine the start and end positions of the head entity, wherein the binary classifier is used to calculate the probability of each word segment as the start position and the probability of each word segment as the end position. When the probability of the position is greater than a predetermined threshold, the head entity position is determined, satisfying: p i_start =θ(W start x i +b start ) p i_end =θ(W end x i +b end ) Among them, p i_start represents the probability of word i as the starting position, p i_end Represents the probability of word i as the starting position; According to the acquired head entity, the position of the tail entity corresponding to each relationship is decoded according to the Bert hidden layer vector and the identified head entity features to generate candidate triples; The generated candidate triples are screened by predefined rules to obtain the triples of vulnerability-related entities and relations.

5. The vulnerability event intelligence early warning method based on a large model as claimed in claim 3 is characterized in that: Based on the extracted vulnerability-related entities and relationships, vulnerability events are generated using the set vulnerability intelligence template, including: Pre-configure vulnerability intelligence templates based on intelligence event elements; Calculate the edit distance of the same type of entities in the filtered triples. If the edit distance is less than or equal to the specified threshold, they are determined to be the same entity to determine the vulnerability triples; The vulnerability triplet is filled in according to the vulnerability intelligence template to generate a vulnerability event.

6. The vulnerability event intelligence early warning method based on a large model as claimed in claim 5 is characterized in that: Input the generated vulnerability events into the pre-trained vulnerability intelligence model to obtain vulnerability briefings and vulnerability warnings including: Perform pre-training based on the specified base model; For the pre-trained base model, use explicit prompt words to guide the model to generate targeted responses; and, Combined with reinforcement learning methods, the pre-trained base model generates multiple answers to obtain a vulnerability intelligence large model, wherein the vulnerability intelligence large model has a built-in selector to output a specified number of answers.

7. The vulnerability event intelligence early warning method based on a large model as claimed in claim 6 is characterized in that: Also includes: Build a vulnerability knowledge base; Based on the vulnerability intelligence big model and the vulnerability knowledge base, early warnings are issued for risk vulnerabilities, and warnings and briefings are output.

8. A vulnerability event intelligence warning device based on a large model, characterized in that: It includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the vulnerability event intelligence warning method based on a large model as described in any one of claims 1 to 7 are implemented.

Images