Retrieval enhancement method for threat intelligence mapping knowledge domain

Abstract

The retrieval enhancement method for the threat intelligence knowledge graph provided by the invention comprises the following steps: preprocessing threat intelligence information to obtain block intelligence documents; performing entity extraction on the partitioned intelligence document to obtain an intelligence entity group; performing expansion classification and entity attribute information completion on the entities in the intelligence entity group to obtain completed intelligence entities, determining a relationship between the intelligence entities, and establishing a threat intelligence knowledge graph according to the relationship between the intelligence entities; performing entity matching and block intelligence document similarity matching according to question and answer statement input to obtain a related intelligence document block set; weighting, mixing and rearranging the partitioned intelligence documents in the related intelligence document block set to obtain a final related intelligence document block set, and generating an input answer corresponding to the question and answer statement according to the final related intelligence document block set. By applying the method, high-dimensional semantic hierarchy representation can be better carried out on heterogeneous data source intelligence, semantic information can be well understood and inquired, and therefore the quality of large model generation content is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a threat intelligence knowledge graph retrieval enhancement method. BACKGROUND

[0002] Network security threat intelligence is a strategic resource for enterprises to build proactive defense capabilities. In a narrow sense, threat intelligence mainly refers to technical threat indicators (Indicators of Compromise, IoC), and in a broad sense, threat intelligence can be extended to a systematic security knowledge system, including attacker tactics, techniques, and procedures (Tactics, techniques, and procedures, TTPs), attack tool chains, organizational background (such as APT groups), industry threat map, and other strategic information, and covering the whole process of intelligence collection, analysis, sharing, and response. Standardization (STIX / TAXII format) and ecological application of threat intelligence data, and cross-domain and cross-institutional sharing and circulation of intelligence (such as ISAC threat intelligence sharing platform, which plays an increasingly important role in helping enterprises upgrade from traditional single-point defense mode to global defense mode.

[0003] In the field of network security threat intelligence, how to achieve accurate prevention, efficient detection, and rapid mitigation of network attacks through deep mining of threat intelligence has always been a hot issue of research in the industry and academia. Knowledge graph and RAG technology show application potential in this regard, but there is still a large research gap in the coordination of threat intelligence deep mining and security scenario application. The main problems and challenges are as follows: Existing threat intelligence applications mainly focus on the utilization of single intelligence information, and there is still a lack of corresponding theoretical methods to build a dynamic correlation system for isolated IoC intelligence information, which leads to the inability of threat intelligence to support high-level analysis tasks.

[0004] Standardized representation and dynamic maintenance of multi-dimensional heterogeneous intelligence sources (system logs, CVE vulnerability databases, security analysis reports, etc.) face theoretical bottlenecks. Although current standardized frameworks such as STIX / TAXII provide unified representation and description capabilities for intelligence, there are still problems such as information loss and high maintenance cost in structured semantic modeling (such as causal chain expression of attack stages and defense strategies), multi-modal knowledge fusion (joint coding of text, code, and traffic features), and dynamic ontology evolution (such as rapid adaptation of new attack techniques). In the application of deep mining of threat intelligence, how to extract, uniformly represent, and enhance the maintainability of high-dimensional threat intelligence knowledge is a problem that needs to be solved.

[0005] There is a "semantic gap" between the large language model and the RAG technology in the threat intelligence mining scene, for example, there is a representation difference between the natural language output by the large model and the structured description format (such as STIX object, ATT&CK tactic label) required by threat intelligence.

[0006] Therefore, it is necessary to provide a threat intelligence knowledge graph retrieval enhancement method capable of better representing high-dimensional semantic levels of heterogeneous data source intelligence and better understanding query semantic information. SUMMARY

[0007] The purpose of the present application is to provide a method for better representing high-dimensional semantic levels of heterogeneous data source intelligence and better understanding query semantic information to improve the quality of answer generation.

[0008] In a first aspect, the present application provides a threat intelligence knowledge graph retrieval enhancement method, which comprises: obtaining threat intelligence information, preprocessing the threat intelligence information to obtain a block intelligence document; performing entity extraction processing on the block intelligence document to obtain an intelligence entity group; performing extended classification and entity attribute information completion on the entities in the intelligence entity group to obtain completed intelligence entities, determining the relationship between intelligence entities according to the entity attribute information of the intelligence entities, constructing triples according to the intelligence entities and the relationship between the intelligence entities, and establishing a threat intelligence knowledge graph according to the triples; performing entity matching and block intelligence document similarity matching according to the input of a question and answer sentence to obtain a relevant intelligence document block set; performing weighted mixed rearrangement on the block intelligence documents in the relevant intelligence document block set to obtain a final relevant intelligence document block set, and generating an answer corresponding to the input of the question and answer sentence according to the final relevant intelligence document block set.

[0009] The threat intelligence knowledge graph retrieval enhancement method provided by the present application has the beneficial effects that: intelligence information entities are extracted from multi-dimensional and heterogeneous information sources, MITRE CAR and CAPEC frameworks are used for constraint, a basic threat intelligence graph is generated, intelligence graphs and intelligence original documents are used as intelligence data sources, and a double-path recall retrieval enhancement generation (RAG) method is designed to recall intelligence content with high relevance to question and answer sentences from the intelligence data sources. The method can better represent high-dimensional semantic levels of heterogeneous data source intelligence and better understand query semantic information, thereby enhancing the quality of content generated by a large model.

[0010] In a possible embodiment, the entities in the intelligence entity group are expanded and classified, and entity attribute information is completed to obtain completed intelligence entities, and the relationship between the intelligence entities is determined according to the entity attribute information of the intelligence entities, including: designing entity completion prompt words, the entity completion prompt words are used to guide the large language model to complete the entity attribute according to the entity and the related intelligence documents and the expanded CAPEC classification description information to obtain the completed intelligence entities; and the relationship between the intelligence entities is determined according to the CAPEC framework self-owned relationship and the expanded CAPEC classification relationship according to the entity attribute information of the completed intelligence entities.

[0011] In another possible embodiment, the related intelligence document block set is obtained by performing entity matching and block intelligence document similarity matching according to the question and answer sentence input, including: extracting the entities in the question and answer sentence to obtain an entity set in the question and answer sentence, and performing text embedding on the question and answer sentence to obtain an embedded question and answer sentence vector; performing text embedding on any intelligence document to obtain an embedded block intelligence text vector; obtaining a related entity set by matching the entity set in the question and answer sentence with related nodes in the threat intelligence knowledge graph, and obtaining related intelligence document blocks according to the attribute information of the entities in the related entity set; calculating the similarity scores of the question and answer sentence vector and the block intelligence document vectors of any block intelligence document using the cosine similarity, and selecting the top K related intelligence document blocks according to the similarity scores, where K is a positive integer.

[0012] In other possible embodiments, the final related intelligence document block set is obtained by weighted mixed rearrangement of the block intelligence documents in the related intelligence document block set, including: performing weighted mixed rearrangement retrieval score calculation on the related intelligence document blocks retrieved from the threat intelligence knowledge graph and the related intelligence document blocks retrieved according to the question and answer sentence vector, and the retrieval score calculation satisfies the following formula: + wherein, represents the retrieval score after weighted mixed rearrangement, represents a retrieval score weight factor, represents an entity relevance score of the related entities obtained according to the threat intelligence knowledge graph, represents the similarity scores of the question and answer sentence vector and the block intelligence document vectors of any block intelligence document; the top m retrieval scores in the retrieval scores after weighted mixed rearrangement are selected, and the corresponding final related intelligence document block set is determined according to the m retrieval scores, where m is a positive integer.

[0013] The same text embedding model is applied when performing text embedding on the question and answer sentence and performing text embedding on any intelligence document.

[0014] The threat intelligence information is preprocessed to obtain a segmented intelligence document, including: performing character recognition on the threat intelligence information of non-text content and storing the threat intelligence information as a text intelligence document; and scanning all the threat intelligence documents, performing content segmentation on the text content in the documents in units of a set length threshold, and saving the text content as a segmented intelligence document.

[0015] The entity attribute information of the intelligence entity includes an entity name, an entity type, a related intelligence document ID, a CAPEC type mapping ID, an entity observation time, and additional information.

[0016] In a second aspect, the present application further provides a retrieval enhancement device of a threat intelligence knowledge graph, the device comprising: An intelligence segmentation unit is configured to obtain threat intelligence information, and preprocess the threat intelligence information to obtain a segmented intelligence document.

[0017] An entity extraction unit is configured to perform entity extraction processing on the segmented intelligence document to obtain an intelligence entity group.

[0018] A knowledge graph construction unit is configured to perform extended classification and entity attribute information completion on the entities in the intelligence entity group to obtain completed intelligence entities, determine the relationships between the intelligence entities according to the entity attribute information of the intelligence entities, construct triples according to the intelligence entities and the relationships between the intelligence entities, and establish a threat intelligence knowledge graph according to the triples.

[0019] An intelligence document block matching unit is configured to perform entity matching and segmented intelligence document similarity matching according to a question and answer statement input to obtain a relevant intelligence document block set.

[0020] An answer generation unit is configured to perform weighted mixed rearrangement on the segmented intelligence documents in the relevant intelligence document block set to obtain a final relevant intelligence document block set, and generate an answer corresponding to the question and answer statement input according to the final relevant intelligence document block set.

[0021] In a third aspect, the present application further provides a computer readable storage medium, the computer readable storage medium storing a computer program, and the computer program is executed by a processor to implement the retrieval enhancement method of the threat intelligence knowledge graph.

[0022] In a fourth aspect, the present application further provides an electronic device, comprising: a processor and a memory; the memory is configured to store a computer program; and the processor is configured to execute the computer program stored in the memory, so that the electronic device executes the retrieval enhancement method of the threat intelligence knowledge graph.

[0023] The beneficial effects of the above-mentioned second to fourth aspects can be referred to the description of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 A flowchart of a threat intelligence knowledge graph retrieval enhancement method provided by an embodiment of the present application is shown in the figure. Figure 2 A flowchart of a threat intelligence knowledge graph retrieval enhancement method provided by an embodiment of the present application is shown in the figure. Figure 3 A schematic diagram of a threat intelligence knowledge graph retrieval enhancement device provided by an embodiment of the present application is shown in the figure. Figure 4 An electronic device structure schematic diagram provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0025] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the common meanings understood by those of ordinary skill in the art to which the present application belongs. The similar words such as “comprise” used herein mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0026] To solve the problems in the prior art, the embodiments of the present application provide a threat intelligence knowledge graph retrieval enhancement method.

[0027] The embodiments provide a threat intelligence knowledge graph retrieval enhancement method. Referring to Figure 1 and Figure 2 , the method comprises: S101: obtaining threat intelligence information, and pre-processing the threat intelligence information to obtain a block intelligence document.

[0028] In a possible embodiment, the pre-processing of the threat intelligence information to obtain a block intelligence document comprises: performing character recognition on the threat intelligence information that is non-text content and storing the threat intelligence information as a text intelligence document; scanning all threat intelligence documents, and performing content blocking on the text content in the documents in units of a set length threshold and saving the text content as a block intelligence document.

[0029] In a specific embodiment, threat intelligence information has multiple sources, such as security logs, analysis reports, and environmental information, and the information of these sources is usually in the form of files such as text, PDF, DOC, and JSON. For information of file sources such as PDF, if it contains non-text content such as pictures, perform OCR text recognition on the non-text content, and store the recognized text content in a new intelligence document, so as to convert intelligence information containing non-text content into a text intelligence document. Then, scan all intelligence documents, and divide the text content in the documents into units according to a set threshold length . After division, save the divided units as divided intelligence documents. The set threshold length can be adjusted according to the text length of the threat intelligence information.

[0030] Exemplarily, the file naming of the divided intelligence documents is named by the HASH of the source intelligence document plus an independent serial number. When the source intelligence document contains a file linked externally (such as an executable file EXE and a compressed log), the format of the externally linked file is maintained and renamed as the HASH of the source intelligence document plus an independent serial number.

[0031] S102: Perform entity extraction processing on the divided intelligence documents to obtain an intelligence entity group.

[0032] In a specific embodiment, for each divided intelligence document obtained after division, the divided intelligence document is denoted as , , and an independent serial number of the divided document is denoted as . Perform entity extraction processing on the divided intelligence document by applying an entity extraction model, and the obtained intelligence entity group is denoted as . The extraction of the intelligence entity group satisfies the following formula: , wherein denotes the entity extraction model.

[0033] Exemplarily, for a single intelligence entity extracted from an intelligence text block, the attribute constraints of the intelligence entity can be represented by the following formula:

[0034] , wherein denotes an entity name, denotes an entity type, denotes an associated intelligence document ID (using the HASH of the intelligence document), denotes a CAPEC type mapping ID, denotes a time when the entity is observed, denotes additional information. Among them, part of the attribute information can be obtained when the intelligence entity is extracted, and part of the attribute information needs to be supplemented subsequently.

[0035] In one possible embodiment, the bert-base-NER entity extraction model fine-tuned using the expanded MITRE CAR framework corpus is used for entity extraction processing of the chunked intelligence document. The expanded MITRE CAR corpus used by the model mainly expands three entity types, including asset (Asset), network (Network), and personnel (Person). Asset refers to resources such as hosts, servers, business names, etc. that contain value and are easy targets for attackers. Network refers to network topology and other network-related information. Personnel refers to the executor of the operation, usually a person or a representative object.

[0036] S103: performing expanded classification and entity attribute information completion on the entities in the intelligence entity group to obtain completed intelligence entities, determining the relationships between the intelligence entities according to the entity attribute information of the intelligence entities, constructing triples according to the intelligence entities and the relationships between the intelligence entities, and establishing a threat intelligence knowledge graph according to the triples.

[0037] In one possible embodiment, the expanded classification and entity attribute information completion are performed on the entities in the intelligence entity group to obtain completed intelligence entities, and the relationships between the intelligence entities are determined according to the entity attribute information of the intelligence entities, including: designing entity completion prompt words, which are used to guide the large language model to perform entity attribute completion on the entities and related intelligence documents and expanded CAPEC classification description information to obtain completed intelligence entities; and determining the relationships between the intelligence entities according to the CAPEC framework own relationships and the expanded CAPEC classification relationships according to the entity attribute information of the completed intelligence entities.

[0038] In one possible embodiment, the entity attribute information of the intelligence entity includes the entity name, the entity type, the associated intelligence document ID, the CAPEC type mapping ID, the time when the entity is observed, and additional information.

[0039] In one possible embodiment, a large language model is applied to perform expanded CAPEC classification on the entities in the intelligence entity group and to complete the entity attribute information. The large language models that can be used include but are not limited to Deepseek-R1, Qwen2.5-max, and GPT-4o. When a large language model is applied to perform expanded classification of entities and to complete information, a completion prompt word for guiding the large language model to complete entity attributes according to entities and related intelligence documents and expanded CAPEC classification description information is needed. The design content of the completion prompt word includes constraints on the output format of the large model, task requirements, an indication that the current task is named entity extraction for threat intelligence, a need to comply with the attribute specification of , and provision of context information. Specifically, the context information includes the chunked document Source intelligence documents, extracted intelligence entities The CAPEC classification description includes both the original CAPEC classification pattern type information and the extended CAPEC classification pattern type information. The original CAPEC classification pattern is divided into two types: Attack and Defense. The extended CAPEC classification mainly expands the original CAPEC framework pattern classification to include five new pattern types: Resource, Skill, Asset, CWE, and CVE.

[0040] For example, when performing extended classification of an entity, the classification is first determined by using the original CAPEC classification model type information. If there is no matching classification in the original CAPEC classification model type, the extended CAPEC classification is used to determine the classification.

[0041] The expanded CAPEC classification of entities using a large language model and the completion of entity attribute information satisfy the following formula: ,in, Indicates that the expanded CAPEC classification mapping and attribute completion of the intelligence entity have been completed. For all Need to satisfy the attribute constraints of intelligence entities, Represents a large language model, Indicates the completion hint word used. Represents context information.

[0042] The intelligence entity set after completing the expanded CAPEC classification mapping and attribute completion is recorded as }, establishing a relationship network between intelligence entities means for the head and tail intelligence entities , and define the relationship as , the triples obtained according to the head entity, the tail entity and the relationship between the head and tail entities are expressed as ,in, , that is, the constructed intelligence entity graph network is a directed graph network.

[0043] The relationship between the two entities at the head and tail is determined according to the CAPEC framework self-owned relationship and the extended CAPEC classification relationship. Specifically, the CAPEC framework defines five types of relationships for entities of two types of attack (Attack) and defense (Defense), including a pre-order relationship (precedes) indicating a pre-order dependency of execution, a dependency relationship (requires) indicating a dependency of resources and capabilities, an attack mode combination (combines), a similar attack mode (similar_to), and a mitigation (mitigates) indicating that the defense can mitigate the attack. Therefore, the relationship between the two entities at the head and tail can be determined according to the CAPEC framework self-owned relationship. For the five extended mode types, i.e., resources (Resource), skills (Skill), assets (Asset), CWE, and CVE, the extended relationship is used to determine the entity relationship .

[0044] Exemplarily, when the CAPEC classification information in the entity attribute information is the original mode type, the relationship of the entity is determined using the CAPEC framework self-owned relationship to determine the entity relationship, and when the CAPEC classification information in the entity attribute information is the extended mode type, the extended relationship is used to determine the entity relationship.

[0045] According to all the triples The threat intelligence knowledge graph can be represented as , wherein represents a set of intelligence entities, i.e. }, represents a set of directed edges between entities, i.e. .

[0046] S104: According to the entity matching and similarity matching of the segmented intelligence document according to the question and answer statement input, a set of related intelligence document blocks is obtained.

[0047] In a possible embodiment, according to the entity matching and similarity matching of the segmented intelligence document according to the question and answer statement input, a set of related intelligence document blocks is obtained, including: extracting entities in the question and answer statement to obtain a set of entities in the question and answer statement, and performing text embedding on the question and answer statement to obtain an embedded question and answer statement vector; performing text embedding on any intelligence document to obtain an embedded segmented intelligence text vector; matching related nodes in the threat intelligence knowledge graph according to the set of entities in the question and answer statement to obtain a set of related entities, and obtaining related intelligence document blocks according to the attribute information of the entities in the set of related entities; using cosine similarity to calculate the similarity score of the question and answer statement vector and the segmented intelligence document vector of any segmented intelligence document, and selecting the K highest scoring related intelligence document blocks according to the similarity score, K being a positive integer.

[0048] In one specific embodiment, the same text embedding model is applied to text embedding of the question-answer statement and to text embedding of any intelligence document.

[0049] Exemplarily, when the question-answer statement is input, entities in the question-answer statement are extracted, specifically, the extraction of entities in the question-answer statement is performed using the same bert-base-NER entity extraction model fine-tuned on the expanded MITRE CAR framework corpus as in the entity extraction processing of the chunked intelligence document in S102. The entity extraction satisfies the following formula: wherein, } represents the extracted entity set, is any entity therein, and At this time, only attributes, represent the question-answer statement. According to the entity set , the attribute is matched with the related nodes in the threat intelligence knowledge graph . The matching can be represented as: . The set of related entities obtained by matching is denoted as , and further, the BFS breadth-first search algorithm is used to search for neighbor entities of the related entities within 2 hops. The expanded search set can be represented by the following formula: , and the searched expanded entities are merged into the related entity set : For each entity of , the entity relevance score is recorded. The entity relevance score is calculated according to whether it is directly matched, the number of search hops, and attribute relevance. And for each related entity , the associated intelligence document block is obtained according to its attribute . The set of related entities corresponds to the set of related document blocks , and the relevance score set is

[0050] The question-answer statement is text embedded, specifically, satisfying the following formula: wherein, represents the embedded question-answer statement vector, represents the embedding model. At the same time, for any chunked intelligence document , text embedding is performed to obtain an intelligence source vector database . The chunked intelligence text vector after text embedding is represented as: wherein the embedding model used for text embedding of the question-answer sentence and the text embedding of any chunked intelligence document is the same, and the specific embedding model that can be used includes but is not limited to Jina V2, BGE-M3, and fine-tuned embedding model. The cosine similarity is used to calculate the similarity score of the question-answer sentence vector and any chunked intelligence document vector : wherein represents the similarity score of the intelligence document chunk and the question-answer sentence . The Top-K algorithm is used for ranking and selecting the K intelligence document chunks with the highest scores, and the formula for Top-K score ranking can be expressed as follows: wherein is the set of K highest similarity scores, and the corresponding set of intelligence document chunks is recorded as .

[0051] S105: The final set of relevant intelligence document chunks is obtained by weighted mixed rearrangement of the chunked intelligence documents in the set of relevant intelligence document chunks, and the answer corresponding to the question-answer sentence input is generated according to the final set of relevant intelligence document chunks.

[0052] In one possible embodiment, the final set of relevant intelligence document chunks is obtained by weighted mixed rearrangement of the chunked intelligence documents in the set of relevant intelligence document chunks, which includes: weighted mixed rearrangement of the relevant intelligence document chunks retrieved from the threat intelligence knowledge graph and the relevant intelligence document chunks retrieved according to the question-answer sentence vector, and the retrieval score calculation of the weighted mixed rearrangement satisfies the following formula: + wherein represents the retrieval score after weighted mixed rearrangement, represents the retrieval score weight factor, represents the entity relevance score of the relevant entity obtained according to the threat intelligence knowledge graph, represents the similarity score of the question-answer sentence vector and the chunked intelligence document vector of any chunked intelligence document; the highest m retrieval scores in the retrieval scores after weighted mixed rearrangement are selected, and the corresponding final set of relevant intelligence document chunks is determined according to the m retrieval scores, and m is a positive integer.

[0053] In one specific embodiment, the relevant intelligence document chunks retrieved from the threat intelligence knowledge graph and the relevant intelligence document chunks retrieved according to the question-answer sentence vector are weighted mixed rearranged. Specifically, the retrieval score calculation of the weighted mixed rearrangement of the relevant intelligence document chunks retrieved through the two retrieval paths satisfies the following formula: + wherein, represents a weighted mixed rearranged search score, represents a search score weight factor, represents an entity relevance score of a related entity obtained according to a threat intelligence knowledge graph, represents a similarity score of a question and answer sentence vector and a block intelligence document vector of an arbitrary block intelligence document. Since the searches on the two paths are parallel and irrelevant, the final search score is determined only by one score and .

[0054] The search score set after the weighted calculation is denoted as . At the same time, the intelligence document block set corresponding to the search score is denoted as . The score set is sorted, and the top scores are selected as the final search score set, and the score sorting formula satisfies: wherein, represents the top search score set, and the corresponding final relevant intelligence document block set is denoted as , and .

[0055] All relevant documents in are input into a large language model as context and a question and answer sentence to generate an answer, which satisfies the following formula: wherein, represents the output result of the large language model, represents the large language model used to generate the answer.

[0056] The threat intelligence knowledge graph retrieval enhancement method of the present application is aimed at heterogeneous source threat intelligence. By using a large language model and a fine-tuned embedding model, and combining the MITRE CAR framework, a knowledge graph entity extraction and attribute completion method is proposed, which can better represent high-dimensional semantic levels of heterogeneous data source intelligence, greatly reduce the loss probability of original semantic information of intelligence, and improve the maintainability of intelligence.

[0057] For fragmented and context-missing intelligence information, on the basis of completed intelligence entity extraction, MITRE CAPEC framework is combined and type mode expansion is carried out. The isolated entity in the primary intelligence graph can be further mapped to the high-dimensional hierarchical attack mode graph, so that the advanced knowledge of intelligence can be better represented, and the hierarchical graph of attack mode is more conducive to the detection and defense of hidden and long attack chain type attacks (such as APT attacks).

[0058] A double-path hybrid retrieval method is adopted. First, sentence-level retrieval is performed according to the query statement, Top-K related intelligence documents are recalled, and entities in the query statement are extracted. Then, graph and related entity queries are performed to recall related documents. Finally, the double-path retrieval results are mixed and rearranged, and input into a large language model for question and answer context enhancement. The retrieval enhancement scheme of the threat intelligence knowledge graph can better understand the query semantic information, improve the relevance of the recall context and the question, improve the quality of the large model generated answer, and reduce the hallucination of the large model.

[0059] In summary, the retrieval enhancement method of the threat intelligence knowledge graph of the application extracts intelligence information entities from multi-dimensional and heterogeneous information sources, uses MITRE CAR and CAPEC framework for constraint, generates a basic threat intelligence graph, and uses intelligence graph and intelligence original document as intelligence data source. A double-path recall retrieval enhancement generation (RAG) method is designed to recall intelligence content with high relevance to the question and answer statement from the intelligence data source. The heterogeneous data source intelligence can be better represented at a high-dimensional semantic level, the query semantic information can be better understood, and the quality of the large model generated content can be enhanced.

[0060] Referring to the drawings accompanying the Figure 3 The embodiment also provides a retrieval enhancement device of a threat intelligence knowledge graph, which is used to implement the above method embodiment. The device comprises:

[0061] The intelligence blocking unit 201 is configured to acquire threat intelligence information and preprocess the threat intelligence information to obtain blocked intelligence documents.

[0062] The entity extraction unit 202 is configured to perform entity extraction processing on the blocked intelligence documents to obtain an intelligence entity group.

[0063] The knowledge graph construction unit 203 is configured to perform expansion classification and entity attribute information completion on the entities in the intelligence entity group to obtain completed intelligence entities, determine the relationships between the intelligence entities according to the entity attribute information of the intelligence entities, construct triples according to the intelligence entities and the relationships between the intelligence entities, and establish a threat intelligence knowledge graph according to the triples.

[0064] The information document block matching unit 204 is configured to perform entity matching and block information document similarity matching on the input question and answer statement to obtain a relevant information document block set.

[0065] The answer generating unit 205 is configured to perform weighted mixing and rearrangement on the block information documents in the relevant information document block set to obtain a final relevant information document block set, and generate an answer corresponding to the input question and answer statement according to the final relevant information document block set.

[0066] All relevant contents of each step involved in the above method embodiments can be cited to the function description of the corresponding function module, and will not be repeated here.

[0067] In some other embodiments of the present application, the embodiments of the present application disclose an electronic device, as shown in the figure. Figure 4 The electronic device 300 can include one or more processors 301, a memory 302, a display 303, one or more application programs (not shown), and one or more computer programs 304, wherein the above devices can be connected through one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301, and the one or more computer programs 304 include instructions that can be used to perform each step in the above Figure 1 , the figure and the corresponding embodiments.

[0068] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above division of functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0069] Each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0070] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, and various media that can store program codes.

[0071] The above is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A method for retrieval enhancement of a threat intelligence knowledge graph, the method comprising: The method comprises the following steps: obtaining threat intelligence information, preprocessing the threat intelligence information to obtain a segmented intelligence document; performing entity extraction processing on the segmented intelligence document to obtain an intelligence entity group; performing extended classification and entity attribute information completion on the entities in the intelligence entity group to obtain completed intelligence entities, determining the relationships between the intelligence entities according to the entity attribute information of the intelligence entities, constructing triples according to the intelligence entities and the relationships between the intelligence entities, and establishing a threat intelligence knowledge graph according to the triples; performing entity matching and similarity matching of the segmented intelligence document according to the input of a question and answer statement to obtain a relevant intelligence document block set; performing weighted mixed rearrangement on the segmented intelligence documents in the relevant intelligence document block set to obtain a final relevant intelligence document block set, and generating an answer corresponding to the input of the question and answer statement according to the final relevant intelligence document block set.

2. The method of claim 1, wherein, The method comprises the following steps: designing entity completion prompt words, which are used to guide a large language model to complete the intelligence entities according to the entities, relevant intelligence documents, and extended CAPEC classification description information; determining the relationships between the intelligence entities according to the entity attribute information of the completed intelligence entities, the relationships between the CAPEC framework and the extended CAPEC classification relationships.

3. The method of claim 1, wherein, The method comprises the following steps: extracting entities in the question and answer statement to obtain an entity set in the question and answer statement, performing text embedding on the question and answer statement to obtain an embedded question and answer statement vector, and performing text embedding on any intelligence document to obtain an embedded segmented intelligence text vector; matching relevant nodes in the threat intelligence knowledge graph according to the entity set in the question and answer statement to obtain a relevant entity set, and obtaining relevant intelligence document blocks according to the attribute information of the entities in the relevant entity set; calculating the similarity scores of the question and answer statement vector and the segmented intelligence document vectors of any segmented intelligence document using cosine similarity, and selecting K relevant intelligence document blocks with the highest scores according to the similarity scores, wherein K is a positive integer.

4. The method of claim 3, wherein, The method comprises the following steps: The retrieval score calculation of the weighted mixed rearrangement of the relevant intelligence document blocks retrieved from the threat intelligence knowledge graph and the relevant intelligence document blocks retrieved according to the question and answer sentence vector satisfies the following formula: + wherein, represents the retrieval score after weighted mixed rearrangement, represents a retrieval score weight factor, represents an entity relevance score of a relevant entity obtained according to the threat intelligence knowledge graph, represents a similarity score of the question and answer sentence vector and a block intelligence document vector of any block intelligence document. selecting the top m retrieval scores after weighted mixed rearrangement, and determining the final relevant intelligence document block set according to the m retrieval scores, wherein m is a positive integer.

5. The method of claim 3, wherein, The same text embedding model is applied when performing text embedding on the question and answer statement and any intelligence document.

6. The method of claim 1, wherein, The method comprises the following steps: performing character recognition on the threat intelligence information that is not text content and storing it as a text intelligence document; scanning all threat intelligence documents, segmenting the text content in the documents into blocks according to a set length threshold, and saving the segmented intelligence documents.

7. The method of claim 1, wherein, The entity attribute information of the intelligence entity includes an entity name, an entity type, a related intelligence document ID, a CAPEC type mapping ID, an entity observation time, and additional information. 8.A device for retrieval enhancement of a threat intelligence knowledge graph, characterized in that, The device comprises: An intelligence sub-block unit configured to acquire threat intelligence information, preprocess the threat intelligence information to obtain sub-block intelligence documents; An entity extraction unit configured to perform entity extraction processing on the sub-block intelligence documents to obtain an intelligence entity group; A knowledge graph construction unit configured to perform extended classification and entity attribute information completion on entities in the intelligence entity group to obtain completed intelligence entities, determine relationships between intelligence entities according to entity attribute information of the intelligence entities, construct triples according to the intelligence entities and the relationships between the intelligence entities, and establish a threat intelligence knowledge graph according to the triples; An intelligence document block matching unit configured to perform entity matching and sub-block intelligence document similarity matching according to a question and answer statement input to obtain a relevant intelligence document block set; An answer generation unit configured to perform weighted mixed rearrangement on sub-block intelligence documents in the relevant intelligence document block set to obtain a final relevant intelligence document block set, and generate an answer corresponding to the question and answer statement input according to the final relevant intelligence document block set.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, implements the threat intelligence knowledge graph retrieval enhancement method of any one of claims 1 to 7.

10. An electronic device, comprising: Comprise: A processor and a memory; The memory is configured to store a computer program; The processor is configured to execute the computer program stored in the memory, so that the electronic device executes the threat intelligence knowledge graph retrieval enhancement method of any one of claims 1 to 7.

Images