Network threat intelligence analysis attack scene graph (ASG) generation method based on deep learning and natural language processing

Abstract

The invention discloses a network threat intelligence analysis attack scene graph (ASG) generation method based on deep learning and natural language processing. The method combines a deep learning model and a natural language processing technology, and improves the efficiency and accuracy of attack scene graph generation. The method comprises the steps that network threat intelligence is collected, an improved BERT-BiLSTM-CRF model is used for entity recognition, and threat attack entities are recognized in combination with a regular expression; carrying out core anaphora analysis by adopting a CR-M-SpanBERT model, and capturing a semantic context dependency relationship between entities; extracting a bidirectional context semantic dependency relationship of the text by using a dependency analysis technology, and generating an embedded representation in combination with RoBERTa-BiGRU; and finally, triple information is extracted based on a BERT-RE model, and an attack scene graph is generated. According to the method, the processing capability of the complex network threat intelligence data is improved, the robustness and adaptability are high, and the method is particularly suitable for multi-mode threat intelligence.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, in particular to technologies related to network threat intelligence analysis, and specifically to an attack scenario graph (ASG) generation method based on deep learning and natural language processing, which aims to use a variety of latest technologies to generate efficient and accurate attack scenario graphs to support network security protection and decision analysis. Background Art

[0002] With the increasing number of network threats, network threat intelligence analysis has become an important part of network security protection. As a visual security analysis tool, attack scenario graph (ASG) is widely used in threat tracing and security response, which can help analysts understand attack paths, vulnerability exploits, and attacker behaviors. However, existing attack scenario graph generation methods mainly rely on simple rule matching and basic semantic analysis techniques, which often lack sufficient robustness and adaptability when facing complex and multimodal network threat intelligence data.

[0003] Current technologies generally have the following limitations: First, they are unable to effectively process threat data that is highly complex and diverse, especially when encountering problems such as semantic ambiguity and unclear entity relationships, the accuracy and reliability of the system are low; second, traditional graph generation methods are inefficient, and performance bottlenecks in the calculation process make it impossible to fully apply them in actual network security protection; third, most existing technologies rely on fixed rules and are difficult to adapt to the ever-changing network threat situation.

[0004] With the development of natural language processing (NLP) and deep learning technology, network threat intelligence analysis methods based on deep learning have gradually been proposed. Through pre-trained deep learning models, entity relationships and semantic information in intelligence can be extracted more accurately, thus providing new possibilities for the generation of attack scenario graphs. Despite this, the current technologies focusing on attack scenario graph generation are still relatively scarce, and most of the technical means used are relatively old and far from keeping up with the latest developments in the field of network security. Therefore, there is an urgent need for an efficient attack scenario graph generation method that can integrate multiple contextual semantic relationships and combine modern deep learning and natural language processing technologies to improve the accuracy and response capabilities of threat intelligence analysis. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for efficiently and accurately generating an attack scenario graph (ASG), especially when processing complex multimodal network threat data, so as to improve the efficiency and accuracy of the generation process.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0007] Data collection and preprocessing: Collect network threat intelligence information and perform entity recognition through a pre-trained deep learning model based on an improved BERT-BiLSTM-CRF structure combined with regular expressions to identify complex threat attack entities. Regular expressions can quickly match and standardize specific patterns in network threat intelligence (such as time, IP address, hash value, etc.), enhance the accuracy and efficiency of entity recognition, and at the same time improve the ability to understand complex entities through the context vector generated by the BERT model.

[0008] Entity recognition and labeling: By combining regular expressions with deep learning models, BIO labeling sequences are generated and input into the BERT-BiLSTM-CRF model for accurate entity recognition. This step ensures the efficient capture of complex threat entities (such as dates, IP addresses, file hashes, etc.) and corrects unreasonable labels to ensure the logical consistency of the labeling results.

[0009] Core reference resolution: The CR-M-SpanBERT model is used to perform core reference resolution, capture the semantic contextual dependencies between entities, further improve the accuracy of entity recognition results, and provide accurate contextual information for subsequent dependency resolution and triple extraction.

[0010] Dependency parsing and semantic enhancement: Dependency parsing technology is used to extract bidirectional contextual semantic dependencies in the text, obtain five-tuple data such as subject, verb, object, etc. related to the threat entity, and combine RoBERTa-BiGRU to generate embedded representations to further enrich the semantic information of entity relationships and lay the foundation for the generation of attack scenario graphs.

[0011] Triple extraction and graph generation: The BERT-RE model is used to extract triple information, and the graph generation module is combined to generate the final attack scenario graph (ASG) based on the triples, converting network threat intelligence into structured visual graphs for analysts to conduct in-depth analysis.

[0012] The present invention also discloses an attack scenario graph generation system based on network threat intelligence analysis, which is characterized by comprising:

[0013] (1) Data collection module, which obtains CTI reports from major institutions that provide CTI reports;

[0014] (2) Entity recognition module, which recognizes entities in the collected data based on the BERT-BiLSTM-CRF structure and regular expressions;

[0015] (3) Semantic parsing module, which performs core reference parsing and semantic relationship mining based on the CR-M-SpanBERT model;

[0016] (4) Dependency parsing module, extracts quintuple data and generates embedded representation;

[0017] (5) Graph generation module, which generates attack scenario graph (ASG) based on the extracted triple information;

[0018] (6) Visualization module, used to output and present attack scenario graphs.

[0019] The present invention provides a method and system for efficiently and accurately generating an attack scenario graph (ASG). Compared with the prior art, the present invention abandons outdated rule matching and simple semantic analysis technology, and adopts the combination of the latest deep learning model and natural language processing technology, which greatly improves the efficiency and accuracy of attack scenario graph generation. The specific beneficial effects are as follows: (1) Through the combination of regular expressions and deep learning models, the present invention effectively improves the efficiency and accuracy of attack scenario graph generation, and solves the problems of inefficiency and low accuracy of existing methods when processing complex intelligence data. (2) Through the improved BERT-BiLSTM-CRF model, the accuracy and robustness of threat intelligence entity recognition are significantly improved, and the problem of insufficient entity recognition accuracy in the prior art is solved. (3) The CR-M-SpanBERT model is used to achieve accurate capture of semantic context, and the accuracy and relevance of entity relationships in the attack scenario graph are improved. (4) The attack scenario graph is generated by combining dependency parsing and embedded representation, which optimizes the efficiency and visualization effect of scene graph generation, and solves the problems of low efficiency and insufficient expression ability in traditional methods. (5) The application of the present invention in network threat intelligence analysis improves the availability and reliability of network attack tracing and protection decision-making. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is the overall flow chart of the present invention;

[0021] Figure 2 A flowchart of the process of collecting cyber threat intelligence information;

[0022] Figure 3 The core refers to the flowchart of the parsing process;

[0023] Figure 4 is a flowchart of the dependency parsing process;

[0024] Figure 5 is a flowchart of the triple extraction process;

[0025] Figure 6 Flowchart of the process of generating attack scenario graph. DETAILED DESCRIPTION

[0026] The following will be combined with the accompanying drawings of the present invention to clearly and completely describe the technical solution of the present invention. It should be pointed out that the described embodiments are only some embodiments of the present invention, and not all implementation methods are listed here. Based on the embodiments of the present invention, other embodiments obtained by those skilled in the art without doing creative work belong to the protection scope of the present invention.

[0027] according to Figure 1 As shown, the present invention provides a method and system for efficiently and accurately generating an attack scenario graph (ASG). First, network threat intelligence information is collected, and the data is subjected to entity recognition through a pre-trained deep learning model. The model is based on an improved BERT-BiLSTM-CRF structure and combines regular expressions to accurately identify threat attack entities. Next, the identified threat entities are subjected to core reference parsing, and the CR-M-SpanBERT model is used to capture the semantic contextual dependencies between entities. Subsequently, dependency parsing technology is used to extract bidirectional contextual semantic dependencies in the text, and five-tuple data such as subject, verb, and object related to the threat entity are obtained, and RoBERTa-BiGRU is combined to generate an embedded representation to enhance the semantic understanding ability. Next, the BERT-RE model is used to extract triple information to prepare for the construction of the final network threat-related attack scenario graph (ASG). Finally, an attack scenario graph (ASG) is generated. Entity recognition, core reference resolution, dependency resolution and triple extraction in the present invention are key steps in generating attack scenario graphs, which can efficiently and accurately construct attack scenario graphs (ASGs) related to network threats, and are of great significance to improving network security protection capabilities.

[0028] according to Figure 2 As shown in the figure, the implementation process of the attack scenario graph generation method based on network threat intelligence analysis is further described in detail. First, the BERT-BiLSTM-CRF model is used to perform entity recognition of network threat intelligence. The model includes a BERT module, an LSTM module, and a CRF module. The BERT module uses pre-trained word vectors to generate context representations, the bidirectional LSTM module captures long-term and short-term dependencies in the context, and the CRF module performs sequence labeling for entity recognition. The specific steps are as follows:

[0029] S1.1, data preprocessing stage, regular expressions are used to extract and standardize specific pattern entities in network threat intelligence. For example, entities such as time, IP address, hash value, etc. are matched by regular expressions and labeled as corresponding categories (such as "DATE", "IP_ADDRESS", "HASH"). These standardized entities are replaced with a unified format, and a BIO format annotation sequence is generated as the input of the deep learning model.

[0030] Example: Original text: "December 1, 2024, source IP address is 192.168.1.1";

[0031] After the BIO mark: "B-DATE I-DATE O B-IP_ADDRESS I-IP_ADDRESS O".

[0032] Table 1 Regular expression definition

[0033] Entity Type Regular Expressions time `\d{4}-\d{2}-\d{2}` IP address `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` Hash value (MD5) `[a-f0-9]{32}` Hash value (SHA1) `[a-f0-9]{40}` e-mail `[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}` Registry Path `HKLM\\[A-F0-9]{40}`

[0034] S1.2, initialize the BERT-BiLSTM-CRF model, and pre-train the BERT module through the masked language model (MLM) to enhance the model's understanding of contextual semantics. Then, learn the logical relationship between events through the next sentence prediction (NSP) task.

[0035] S1.3, use the BERT model to generate contextual semantic representations of vocabulary in cyber threat intelligence, represented as high-dimensional vectors.

[0036] Specifically, for a given network threat intelligence text sequence X = {x1, x2, ..., x n}, randomly mask 15% of the vocabulary, generate the masked sequence X mask The training goal is to maximize the masked vocabulary x i The conditional probability of the masked words is predicted through contextual semantics, thereby enhancing the model's understanding of the proper nouns in the field of network security;

[0037] P(x i |X mask )=softmax(W h ·h i +b h )

[0038] Next, the model is trained using the Next Sentence Prediction (NSP) task. Given two sentences S1 and S2, the NSP task predicts whether S2 is the logical successor of S1. Its loss function is:

[0039]

[0040] Among them, y i Indicates whether it is a positive sample, P i It is the classifier output of the BERT model, enabling it to learn the logical relationship between events, such as attack paths, causal chains of threat events, etc.

[0041] Finally, the pre-trained BERT model is used as a feature extractor to generate contextual semantic representations of the vocabulary in cyber threat intelligence, represented as high-dimensional vectors.

[0042] S1.4, captures semantic information through a bidirectional LSTM module, including modeling time-step dependencies, filtering features related to cyber threat intelligence, and enhancing the semantic representation of input information.

[0043] Specifically, the bidirectional LSTM module takes the context vector generated by the BERT model as input, and gradually processes each word in the sequence. It simultaneously models short-term and long-term semantic dependencies through forward and backward propagation. The bidirectional LSTM uses forget gates, input gates, and output gates to filter key features related to network threat intelligence and suppress irrelevant noise information. For example, when processing threat intelligence with time stamps, priority can be given to "attack time" and "vulnerability discovery date", and the output feature representation is: Finally, the forward and backward hidden state vectors of the LSTM are spliced ​​into a comprehensive semantic representation for further entity recognition. The formula is as follows:

[0044] f t =σ(W f ·[h t-1 ,x t ]+b f ),

[0045] i t =σ(W i ·[h t-1 ,x t ]+b i ),

[0046]

[0047] O t =σ(W o ·[h t-1 ,x t ]+b o ),

[0048]

[0049] h t =o t *tanh(C t ).

[0050] Here, ft, it, ot are the activation values ​​of the forget gate, input gate and output gate respectively, σ is the Sigmoid activation function, and W and b are the corresponding weight matrices and biases.

[0051] S1.5, use the CRF module to sequence the features output by LSTM, calculate the scores of the input feature sequence and the label sequence, and use Softmax to calculate the normalized probability of the label sequence. Finally, the Viterbi algorithm is used to find the optimal label path.

[0052] Specifically, the conditional random field (CRF) module is used to sequence the output features. Its scoring function, given the input feature sequence X = {x1, x2, ..., x n} and the corresponding label sequence Y = {y1,y2,…,y n}, the scoring function of CRF is:

[0053]

[0054] Among them, P iyi Represents the score of the current input feature, A yi -1,yi represents the transfer score between adjacent labels;

[0055] Normalized probability calculation, calculate the normalized probability of the label sequence through Softmax:

[0056]

[0057] Finally, decoding optimization is performed to find the optimal label path through the Viterbi algorithm:

[0058]

[0059] S1.6, model post-processing, in the CRF output results, regular expressions are used to verify and correct unreasonable label sequences. For example, if "I-IP_ADDRESS" appears at the beginning of a sentence in the label sequence, it is corrected to "B-IP_ADDRESS"; if the year part is missing in the date label sequence, it is considered an invalid label and deleted. The final entity label is output, including key entities such as malware names and attack targets and their categories.

[0060] according to Figure 3 As shown, the present invention provides an attack scenario graph (ASG) generation method based on network threat intelligence analysis. In particular, in step S2, the CR-M-SpanBERT model implements core reference resolution through five stages: input preparation, context dependency modeling, Mention representation generation, reference relationship discrimination and output, and further optimizes the entity recognition result output by the BERT-BiLSTM-CRF model. The specific steps are as follows:

[0061] S2.1, input preparation phase, receiving the output results from step S1, including the identified threat entities and their initial context embedding representations, and organizing the threat entities and their corresponding context information into a candidate mention set as the input of CR-M-SpanBERT;

[0062] S2.2, context dependency modeling stage, firstly, the context information of each mention is converted into a high-dimensional vector representation through multiple embedding technology, then semantic embedding, syntactic embedding and position embedding are performed, and the SpanBERT model is used to generate semantic representation, combining syntactic dependency and position encoding to capture the semantic dependency between entities;

[0063] S2.3, Mention representation generation stage, based on the self-attention mechanism, generates a context-aware embedding representation for each mention, combining semantic, syntactic and position embeddings, and comprehensively considering the semantic and contextual relationships between candidate mentions;

[0064] S2.4, the phase of identifying the referential relationship, first construct candidate mention pairs, score the referential possibility of each pair of mentions through a feed-forward neural network (FFNN), generate a referential score matrix, and optimize the referential score through softmax, and finally select the best referential entity for each mention;

[0065] Specifically, CR-M-SpanBERT completes the work of the Mention representation generation and reference relationship discrimination stages through the following process. In the Mention representation generation, based on the self-attention weight, a context-aware embedding representation is generated for each mention, which is specifically implemented by the following formula:

[0066] Z mention =Φ c (Z semantic ,Z syntactic ,Z positional )

[0067] Among them, Z semantic , Z syntactic and Z positional denote semantic, syntactic and position embedding respectively, Φ c is the multiple embedding fusion function.

[0068] The workflow of the referential relationship identification stage is as follows: first, candidate mention pairs are constructed, the referential possibility of each pair of mentions is scored through a feedforward neural network (FFNN), and a score matrix of candidate mention pairs is generated. Then, the best referential entity of each mention is selected by combining the attention mechanism. The specific process includes:

[0069] Calculate the reference score and generate the reference score for the mention pair. The formula is as follows:

[0070]

[0071] Soft attention optimization, using softmax to normalize the referent score and select the most likely referent entity;

[0072] Supervised learning optimization uses the cross entropy loss function to train the model so that the correct reference relationship has the highest score.

[0073] S2.5, output stage, generates each threat entity and its referential relationship chain to form a clear semantic chain, such as associating "it" with "malware name" for use in subsequent dependency resolution steps;

[0074] In the present invention, the multi-stage processing method of the CR-M-SpanBERT model can accurately capture the referential relationship between threat entities, and enhance the semantic dependency between entities through self-attention mechanism and supervised learning optimization, thereby effectively constructing an attack scenario graph (ASG). This method is of great significance for improving the parsing ability of network threat intelligence and the construction accuracy of attack scenario graphs.

[0075] according to Figure 4 As shown, the present invention provides an attack scenario graph (ASG) generation method based on network threat intelligence analysis. In particular, in step S3, dependency parsing technology constructs an attack scenario graph by extracting bidirectional contextual semantic dependencies in the text. This can not only help extract bidirectional contextual semantic relationships (such as subject, verb, and object, etc.) in the text, but also provide accurate grammatical structure support for triple generation. By modeling the grammatical dependencies between entities, the specific steps are as follows:

[0076] S3.1, receiving threat entities and their reference chains from S2;

[0077] S3.2, dependency parsing technology extracts grammatical dependencies (such as subject, predicate and object) in the text by analyzing the contextual dependencies between threat entities, and constructs bidirectional contextual semantic relationships. Specifically, dependency parsing technology first identifies the grammatical relationships between words in the text, such as determining the structure of "attacker (subject) - exploit (predicate) - vulnerability (object)", thereby providing accurate grammatical support for subsequent triple generation. The extraction of dependency relationships not only includes common grammatical roles (such as subject, predicate and object), but also considers contextual conditions (C) and time tags (T) to generate five-tuple data (S, P, O, C, T), where S represents the subject (such as attacker), P represents the predicate (such as "exploit" or "attack"), and O represents the object (such as vulnerability or target);

[0078] S3.3, using the RoBERTa-BiGRU model to generate quintuple embeddings. First, the generated quintuple data (S, P, O, C, T) is converted into serialized text to ensure that it can be used as the input of the RoBERTa model. Specifically, the components of each quintuple (subject, predicate, object, contextual condition, time tag) are converted into a format that meets the input requirements of the language model. The RoBERTa model captures the semantic relationship in the quintuple by generating a contextual embedding representation for each token. Then, BiGRU performs bidirectional processing on the output embedding of RoBERTa to extract forward and backward dependency information. By concatenating the forward hidden state of BiGRU (h i F ) and the backward hidden state (h i B ), forming a comprehensive semantic representation (h i =[h i F ||h i B ]), the representation is further filtered through a gating mechanism to suppress irrelevant noise information and focus on features related to threat entities;

[0079] S3.4, the generated five-tuple embedding representation is used for relationship optimization. The embedding vector similarity is calculated for the subject (S), predicate (P) and object (O) in each five-tuple to evaluate the semantic relationship between entities. Combined with the embedding of context conditions (C) and time tags (T), each element in the five-tuple is weighted based on these semantic information. Specifically, for each pair of subject, predicate and object, their vector similarity is calculated, and the weight value is adjusted according to the influence of context conditions and time tags. Finally, the optimized five-tuple embedding is output. This process improves the accuracy of entity relations when generating triples through the careful calculation of relationship weights, providing higher quality input for the BERT-RE model in step S4.

[0080] according to Figure 5 As shown, the present invention further provides an attack scenario graph (ASG) generation method based on network threat intelligence analysis, especially in step S4, a more concise triple (such as "attacker-exploit-vulnerability") is extracted from the incoming quintuple through the BERT-RE model, thereby forming the basic data of the final attack scenario graph. The specific steps are as follows:

[0081] S4.1, receiving the output five-tuple embedding representation from S3 (including subject S, predicate P, object O, context condition C and time tag T);

[0082] S4.2, semantically filter the quintuples based on contextual conditions (C) and time tags (T) to retain entity relationship data with high confidence;

[0083] S4.3, use the BERT-RE model to predict the relationship for each quintuple. First, use the BERT embedding layer to generate the semantic features of the input text, and independently optimize the embedding representations of the subject, predicate, and object to ensure the accuracy of the entity relationship. Then, use the SoftMax classifier to score all possible relationships and optimize the relationships through the cross-entropy loss function. The goal of the cross-entropy loss function is to maximize the probability of the correct relationship, thereby improving the accuracy of relationship classification. Finally, output a set of classified triplets and annotate the relationship type of each triple (such as "attack", "utilization", "association", etc.).

[0084] S4.4, optimize the triple prediction results by combining the five-tuple embedding to eliminate redundant and contradictory data;

[0085] S4.5, the optimized triple set will be used as the basic input for attack scenario graph generation and enter the next step of graph structure construction. In this step, we will extract the node set V and edge set E from the triple set generated by S4, and map these triples to nodes and edges in the graph, and finally construct the preliminary structure of the attack scenario graph (ASG).

[0086] like Figure 6 As shown in S5, the specific steps of the attack scenario graph generation process are as follows:

[0087] S5.1, graph structure initialization step, extracting the node set V and edge set E from the triple set (EntityHead, Relation, EntityTail) generated in S4, mapping the subject (EntityHead) and object (EntityTail) in the triple to nodes, mapping the relation (Relation) in the triple to edges, and attaching the relation type as the edge attribute;

[0088] S5.2, use the embedding vector output by the BERT-RE model to initialize the attributes of nodes and edges. For nodes, combine contextual information (such as attackers, targets, vulnerabilities and other specific semantic roles) to generate high-dimensional embedding representations. For edges, use the embedding vectorization processing of the relationship type to capture the semantic associations between nodes.

[0089] S5.3, message passing and embedding optimization step, uses message passing network (MPNN) to iteratively optimize the graph structure, and captures global semantic consistency through the message passing mechanism of nodes and edges. Different from the traditional rule-based graph optimization method, the message passing network (MPNN) can gradually adjust the structure and relationship of the graph through information transmission between nodes, making the entire attack scenario graph (ASG) more accurate and consistent during the generation process. MPNN optimizes the nodes and edges in the graph in an adaptive manner, which can effectively correct the semantic inconsistency or data loss problems that may occur in traditional methods, thereby significantly improving the accuracy and robustness of the graph. The node update formula is as follows:

[0090]

[0091] Where hi(l) represents the embedding of node i at layer l, N(i) represents the neighbor nodes of node i, eij represents the embedding of edges, f represents the node embedding update function, g represents the message passing function, which is used to generate messages from neighbor node j to node i. The message passing update process includes calculating the embedding vector of each edge eij and aggregating all messages from neighbor nodes for node i.

[0092] S5.4, the global graph optimization step, after several layers of message passing, generates the final embedding representation of the node set V and the edge set E. The optimization goal is to minimize the embedding loss function of the nodes and edges:

[0093]

[0094] Where Loss is the loss function of relationship prediction, f is the combined function of nodes and edges, which is used to generate relationship prediction values, and Relation is the true relationship label of the edge;

[0095] S5.5, in the graph post-processing and visualization step, the node and edge attributes of the generated graph are calibrated to ensure that the graph structure conforms to the semantic rules in the field of network security. The calibration process includes correcting possible semantic inconsistencies, such as adjusting node attributes or edge types to make them more in line with actual security analysis needs. Finally, use graph visualization tools (such as Graphviz or NetworkX) to display the generated attack scenario graph for user understanding and further analysis.

[0096] Through the above technical means, the present invention can efficiently and accurately identify entity relationships in network threat intelligence and generate an attack scenario graph (ASG). This method can not only help network security experts accurately analyze the causal chain of threat events, but also provide data support for automated security protection systems and improve defense capabilities.

[0097] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for generating an attack scenario graph (ASG) based on network threat intelligence analysis, characterized in that: The attack scenario graph generation method based on network threat intelligence analysis comprises: S1, collects network threat intelligence information and performs entity recognition through a pre-trained deep learning model. The model is based on an improved BERT-BiLSTM-CRF structure. In the model input stage, regular expressions are combined to match and standardize entities of specific patterns (such as time, IP address, hash value), and a BIO annotation sequence is generated to input the BERT-BiLSTM-CRF model; among them, the BERT module generates word vectors through pre-training, and combines bidirectional LSTM and CRF for entity recognition. S2, performs core reference resolution on the identified threat entities, using the CR-M-SpanBERT model to capture the semantic contextual dependencies between entities; S3, using dependency parsing technology to extract bidirectional contextual semantic dependencies in the text, obtain five-tuple data such as subject, verb, and object related to the threat entity, and generate embedded representations in combination with RoBERTa-BiGRU; S4, using the BERT-RE model to extract triples in preparation for building the final attack scenario graph (ASG) related to network threats; S5, attack scenario graph (ASG) generation.

2. According to claim 1, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis, characterized in that: In S1, at the model input stage, regular expressions are combined to match and standardize entities of specific patterns in network threat intelligence (such as time, IP address, hash value), and generate BIO annotation sequences to input into the BERT-BiLSTM-CRF model. The BERT-BiLSTM-CRF model includes a BERT module, an LSTM module, and a CRF module. Specifically, in this model, the word vector obtained by BERT pre-training is used as input information, and the bidirectional LSTM (Long Short-Term Memory) and CRF are combined to identify entities in the input information.

3. According to claim 2, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis is characterized in that: In S1, the BERT model is pre-trained through the following process: First, a masked language model (MLM) is trained on a large-scale network threat intelligence corpus. For a given network threat intelligence text sequence X = {x1, x2, ..., x n }, randomly mask 15% of the vocabulary, generate the masked sequence X mask The training goal is to maximize the masked vocabulary x i The conditional probability of the masked words is predicted through contextual semantics, thereby enhancing the model's understanding of the proper nouns in the field of network security; P(x i |X mask )=softmax(W h ·h i +b h ) Next, the model is trained using the Next Sentence Prediction (NSP) task. Given two sentences S1 and S2, the NSP task predicts whether S2 is the logical successor of S1. Its loss function is: Among them, y i Indicates whether it is a positive sample, P i It is the classifier output of the BERT model, enabling it to learn the logical relationship between events, such as attack paths, causal chains of threat events, etc. Finally, the pre-trained BERT model is used as a feature extractor to generate contextual semantic representations of the vocabulary in cyber threat intelligence, represented as high-dimensional vectors.

4. According to claim 2, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis is characterized in that: In S1, the bidirectional LSTM module captures semantic information through the following process: Time-step dependency modeling: The bidirectional LSTM module takes the context vector generated by the BERT model as input, processes each word in the sequence step by step, and models both short-term and long-term semantic dependencies through forward and backward propagation; Information enhancement mechanism: Bidirectional LSTM uses forget gate, input gate and output gate to filter key features related to network threat intelligence and suppress irrelevant noise information. For example, when processing threat intelligence with time stamps, priority can be given to "attack time" and "vulnerability discovery date"; Output feature representation: Finally, the forward and backward hidden state vectors of LSTM are concatenated into a comprehensive semantic representation for further entity recognition. The formula is as follows: f t =σ(W f ·[h t-1 ,x t ]+b f ), i t =σ(W i ·[h t-1 ,x t ]+b i ), The t =σ(W o ·[h t-1 ,x t ]+b o ), h t =o t *tanh(C t ). Here, ft, it, ot are the activation values ​​of the forget gate, input gate and output gate respectively, σ is the Sigmoid activation function, and W and b are the corresponding weight matrices and biases.

5. According to claim 2, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis, characterized in that: In S1, the conditional random field (CRF) module is used to sequence the output features. The specific process includes: Scoring function, given an input feature sequence X = {x1, x2, ..., x n } and the corresponding label sequence Y = {y1,y2,…,y n }, the scoring function of CRF is: Among them, P i·yi Represents the score of the current input feature, A yi-1,yi Represents the transfer score between adjacent labels; Normalized probability calculation, calculate the normalized probability of the label sequence through Softmax: Finally, decoding optimization is performed to find the optimal label path through the Viterbi algorithm: Finally, the CRF layer is used to combine regular expression features and BERT vectors to output the optimized entity recognition results, output entity labels, and finally output the key entities and their categories in network threat intelligence.

6. According to claim 1, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis, characterized in that: In S2, the CR-M-SpanBERT model implements core reference resolution through the input preparation stage, context dependency modeling stage, Mention representation generation stage, reference relationship judgment stage, and output stage. This stage identifies and corrects possible incorrect annotations or semantic mismatches in the BERT-BiLSTM-CRF model, thereby improving the accuracy of entity recognition.

7. According to claim 6, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis, characterized in that: In S2, CR-M-SpanBERT completes the input preparation and context dependency modeling phases through the following process: In the input preparation phase, CR-M-SpanBERT accepts the output results from step S1, including the identified threat entities and their initial context embedding representations. The threat entities and their corresponding context information will be organized into a candidate mention set as the input of CR-M-SpanBERT; In the context dependency modeling stage, we first use multiple embedding techniques to convert the context information of each mention into a high-dimensional vector representation. Then, we perform semantic embedding, syntactic embedding, and position embedding. Semantic representation uses the SpanBERT pre-trained model dedicated to the threat intelligence field to generate a semantic representation for each mention. Syntactic embedding generates the syntactic context information of the mention based on the syntactic dependency relationship (such as the subject-verb-object structure) provided in step S1. Position embedding encodes the relative position of the mention in the text to reflect its relationship with other entities. Through the self-attention mechanism, CR-M-SpanBERT fuses information from different dimensions to more accurately capture the semantic dependencies between entities.

8. According to claim 6, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis, characterized in that: In S2, CR-M-SpanBERT completes the work of Mention representation generation and reference relationship discrimination through the following process; In the Mention representation generation, based on the self-attention weight, a context-aware embedding representation is generated for each mention. The specific process is implemented by the following formula: WITH mention =Φ c (WITH semantic ,WITH syntactic ,WITH positional ) Among them, Z semantic , Z syntactic and Z positional denote semantic, syntactic and position embedding respectively, Φ c is the multiple embedding fusion function.

9. The attack scenario graph (ASG) generation method according to claim 8, characterized in that: In S2, the workflow of the reference relationship determination stage is as follows: First, candidate mention pairs are constructed, and the reference possibility of each pair of mentions is scored through a feed-forward neural network (FFNN). The input of FFNN includes the semantic features, syntactic information, and contextual embedding information of each pair of mentions. Based on these features, FFNN generates a reference score to evaluate whether the candidate mention pairs refer to the same entity. Then, combined with the attention mechanism, the best reference entity of each mention is selected. The specific process includes: Calculate the reference score and generate the reference score for the mention pair. The formula is as follows: Soft attention optimization, using softmax to normalize the referent score and select the most likely referent entity; Supervised learning optimization uses the cross entropy loss function to train the model so that the correct reference relationship has the highest score.

10. According to claim 6, a method for generating an attack scenario graph (ASG) based on network threat intelligence analysis, characterized in that: In S2, CR-M-SpanBERT completes the output process through the following process: The output includes each threat entity and its referential relationship chain. For example, associating "it" with "malware name" generates a clear semantic chain for subsequent dependency resolution steps.

11. The method for generating an attack scenario graph (ASG) based on network threat intelligence analysis according to claim 1, characterized in that: In S3, dependency parsing technology extracts bidirectional contextual semantic dependencies in text through the following process: Receive threat entities and their referential chains from S2, analyze the contextual dependencies between threat entities through dependency parsing technology, and extract the bidirectional semantic dependencies of subject, predicate, and object; Combine the context condition (C) and the time tag (T) to output a five-tuple data (S, P, O, C, T), where S represents the subject (such as attacker), P represents the predicate (such as "exploit" or "attack"), and O represents the object (such as vulnerability or target); The RoBERTa-BiGRU model is used to generate five-tuple embeddings that capture contextual semantic features as input to subsequent steps.

12. The method for generating an attack scenario graph (ASG) based on network threat intelligence analysis according to claim 11, characterized in that: In S3, the specific steps of generating embedded representations by combining bidirectional contextual semantic dependencies with the RoBERTa-BiGRU model include: The five-tuple data (S, P, O, C, T) is converted into serialized text and input into the RoBERTa model. RoBERTa is used to generate the context embedding representation of each Token to capture the semantic relationship in the five-tuple. BiGRU is used to perform bidirectional processing on the output embedding of RoBERTa to extract the forward and backward dependency information of the text respectively. The forward hidden state (h i F ) and the backward hidden state (h i B ) to generate a comprehensive semantic representation (h i =[h i F ||h i B ]), the gating mechanism is used to further filter out features related to threat entities and suppress irrelevant noise information.

13. The method for generating an attack scenario graph (ASG) based on network threat intelligence analysis according to claim 11, characterized in that: In S3, the generated five-tuple embedding representation is used for the following relation optimizations: The embedding vector similarity of each quintuple is calculated for the subject (S), predicate (P), and object (O). Based on the embedding of the contextual conditions (C) and time tags (T), the entity relationship is weightedly analyzed, and the final optimized quintuple embedding is output as the input of the BERT-RE model in step S4.

14. The method for generating an attack scenario graph (ASG) based on network threat intelligence analysis according to claim 1, characterized in that: S4, extracts more concise triples (such as "attacker-exploit-vulnerability") from the input quintuples, thereby forming the basic data of the final attack scenario graph. The BERT-RE model extracts triples and generates relational data through the following steps: Receive the output five-tuple embedding representation from step S3 (including subject S, predicate P, object O, context condition C and time tag T), perform semantic filtering on the five-tuple based on the context condition (C) and time tag (T), and retain entity relationship data with high confidence; Use the BERT-RE model to predict the relationship of each quintuple and map the quintuple to a triple (EntityHead, Relation, EntityTail), where EntityHead is the subject S, Relation is the predicate P, and EntityTail is the object O; Combine quintuple embedding to optimize triple prediction results and eliminate redundant and contradictory data; Output the final set of triples as the basis for generating the attack scenario graph.

15. The method for generating an attack scenario graph (ASG) based on network threat intelligence analysis according to claim 14, characterized in that: S4, the relation prediction of the BERT-RE model includes the following details: The embedding layer of BERT-RE is used to generate semantic features of the input text, and the embedding representations of the subject, object, and predicate are independently optimized to ensure the accuracy of entity relationships. The SoftMax classifier is used to score all possible relationships, and the cross-entropy loss function is used to optimize the scores of correct relationships. The classified triples are output and the relationship types (such as "attack", "exploitation", "association", etc.) are labeled.

16. The method for generating an attack scenario graph (ASG) based on network threat intelligence analysis according to claim 1, characterized in that: S5, the specific steps of the attack scenario graph generation process are as follows: Graph structure initialization step: extract the node set V and edge set E from the triple set (EntityHead, Relation, EntityTail) generated by S4, map the subject (EntityHead) and object (EntityTail) in the triple to nodes, map the relation (Relation) in the triple to edges, and attach the relation type as the edge attribute; Use the embedding vectors output by the BERT-RE model to initialize the attributes of nodes and edges. For nodes, combine context information (such as attackers, targets, vulnerabilities, and other specific semantic roles) to generate high-dimensional embedding representations. For edges, use the embedding vectorization of the relationship type to capture the semantic associations between nodes. In the message passing and embedding optimization step, the message passing network (MPNN) is used to iteratively optimize the graph structure, and the global semantic consistency is captured through the message passing mechanism of nodes and edges. The node update formula is as follows: Among them, h i (l) represents the embedding of node i in layer l, N(i) represents the neighboring nodes of node i, and e ij represents the embedding of the edge, f represents the node embedding update function, and g represents the message passing function, which is used to generate messages from neighbor node j to node i. The message passing update process includes updating each edge e ij , calculate its embedding vector, and for node i, aggregate all messages from neighboring nodes; In the global graph optimization step, after several layers of message passing, the final embedding representation of the node set V and the edge set E is generated. The optimization goal is to minimize the embedding loss function of the nodes and edges: Where Loss is the loss function of relationship prediction, f is the combined function of nodes and edges, which is used to generate relationship prediction values, and Relation is the true relationship label of the edge; In the graph post-processing and visualization step, the node and edge attributes of the generated graph are calibrated to ensure that it conforms to the semantic rules in the field of network security. The generated attack scenario graph is displayed to the user using graph visualization tools (such as Graphviz or NetworkX) for easy understanding and analysis.

Images