Network security named entity and relation joint extraction method and device based on transfer learning

Abstract

The application discloses a network security named entity and relation joint extraction method and device based on transfer learning, comprising the following steps: performing network security named entity and relation joint labeling on network security threat intelligence, and constructing a network security threat intelligence corpus; pre-training a deep neural network based on a natural language corpus; combining the pre-trained deep neural network with a classifier to construct an initial joint extraction model; training the initial joint extraction model based on the network security threat intelligence corpus; and inputting target data into the trained joint extraction model to obtain network security named entity and relation joint extraction results. The application can label network security named entities and relations simultaneously, effectively avoids the error transmission problem existing in the serial extraction mode of first entity and then relation, reduces the dependence of network security field entity and relation extraction on expert experience, enhances the portability of the model, and reduces the disturbance caused by the small amount of network security field labeled data set to model training.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a network security named entity and relationship joint extraction method and device based on transfer learning. BACKGROUND

[0002] With the rapid development of information technology, the zero-day vulnerabilities, attack methods and concealment means available to network attackers are showing a diversified and diversified development trend. The new attack trend has brought serious attack consequences, such as the number of domestic and foreign advanced persistent threat (APT) related public reports increasing year by year. The new attack situation and serious attack consequences highlight the increasingly obvious drawbacks of traditional single-point protection, which cannot timely and accurately respond to new network security threats, and the attack-defense asymmetry situation is also becoming more and more serious.

[0003] Network security threat intelligence, as a kind of evidence knowledge for existing or imminent threats or hazards to assets, mechanisms, indicators, impacts and protective recommendations that can be implemented, can provide the basis for asset owners to make protective decisions against threats or hazards, and to some extent alleviate the attack-defense asymmetry situation. Typical examples include abuse.ch tracking the notorious botnet Zeus and sharing newly discovered command and control (C&C) servers as structured network security threat intelligence, thereby playing an important role in the defense of the global botnet Zeus.

[0004] Network security threat intelligence can be classified into structured network security threat intelligence and unstructured network security threat intelligence according to the structure form. The structured network security threat intelligence is accurate and normative, but it is not easy to be associated with other network security threat intelligence data for analysis due to the lack of a large amount of network security threat background information. The unstructured network security threat intelligence has rich network security threat background information, but it is in the form of a document report. Before using a machine for associated analysis, the unstructured network security threat intelligence needs to be converted into machine-readable intelligence. At present, the conversion process of the unstructured network security threat intelligence into machine-readable intelligence excessively depends on the experience of experts and has poor portability. In the field of general entity and relationship extraction, the entity information is extracted first, and then the relationship is further extracted based on the extracted entity information. This serial extraction method has the problem of error transmission. For example, Chinese patent application CN113128227A discloses an entity extraction method and device, which can only extract entity information and cannot extract relationship information. For example, Chinese patent application CN112926325A discloses a Chinese task relationship extraction based on BERT neural network, which can only extract person relationship information and cannot extract entity information. For example, Chinese patent application CN113158676A discloses a professional entity and relationship joint extraction method and system, and Chinese patent application CN111798987A discloses an entity relationship extraction method and device. Both of them extract entity information first, and then extract relationship based on the entity information, which has the problem of error transmission.

[0005] In view of the above problem of converting unstructured network security threat intelligence into machine-readable intelligence, the present patent proposes a network security threat intelligence joint extraction method based on transfer learning. The method first trains a deep neural network structure using a natural language field corpus to learn a word feature representation vector. Then, based on a network security threat intelligence annotated data set, the deep neural network structure is trained and optimized, and at the same time, based on the word feature representation vector output by the deep neural network structure, a conditional random field is used for label classification. The optimized deep neural network and the conditional random field are combined to form a final network security named entity and entity relationship extraction model. Finally, for new unstructured network security threat intelligence, the extraction model is used to complete the extraction of network security named entity and entity relationship, achieving the purpose of automatic conversion of unstructured network security threat intelligence into machine-readable intelligence. SUMMARY

[0006] The application aims to provide a network security named entity and relationship joint extraction method and device based on transfer learning, which utilizes natural language field corpus and a small amount of network security threat intelligence annotation data set to train a deep learning joint extraction model of network security named entity and relationship between entities, and can extract new unstructured network security threat intelligence by using the pre-trained deep learning joint extraction model, so as to realize automatic conversion of unstructured network security threat intelligence into machine-readable intelligence.

[0007] The technical scheme of the application comprises:

[0008] A network security named entity and relationship joint extraction method based on transfer learning comprises the following steps:

[0009] 1) Network security named entity and relationship joint annotation is performed on network security threat intelligence to construct a network security threat intelligence corpus;

[0010] 2) A deep neural network is pre-trained based on a natural language corpus to obtain a pre-trained deep neural network for extracting word feature representation vectors;

[0011] 3) The pre-trained deep neural network is combined with a classifier to construct an initial joint extraction model;

[0012] 4) The initial joint extraction model is trained based on the network security threat intelligence corpus by using a transfer learning method to obtain a trained joint extraction model;

[0013] 5) Target data is input into the trained joint extraction model to obtain network security named entity and relationship joint extraction results.

[0014] Further, the network security threat intelligence corpus is constructed by the following steps:

[0015] 1) Network security threat intelligence is collected from network security threat intelligence blogs or forums, wherein the network security threat intelligence comprises structured network security threat intelligence and unstructured network security threat intelligence;

[0016] 2) The structured network security threat intelligence is annotated with network security named entity and relationship by using the structure rules of the intelligence itself to obtain structured network security threat intelligence annotation results;

[0017] 3) Some unstructured network security threat intelligence is manually annotated with network security named entity and relationship by using an annotation tool, and the remaining unstructured network security threat intelligence is automatically annotated based on summarized annotation rules;

[0018] 4) The manual annotation results and the rule annotation results are combined to obtain unstructured network security threat intelligence annotation results

[0019] 5) According to the structured network security threat intelligence annotation result and the unstructured network security threat intelligence annotation result, a network security threat intelligence corpus is constructed.

[0020] Further, the annotation rule comprises a regular expression or an annotation dictionary.

[0021] Further, the pre-training deep neural network is obtained through the following steps:

[0022] 1) The natural language corpus in the natural language corpus is segmented by using a natural language organization rule, and an initial dictionary is obtained;

[0023] 2) The segmented part of the natural language is masked;

[0024] 3) The masked natural language corpus is input into the deep neural network, and the masked segmentation is predicted to obtain the pre-training deep neural network.

[0025] Further, the natural language organization rule comprises a part of speech of a word, a dependency relationship between words, a position of a word and / or a punctuation symbol between words.

[0026] Further, before the initial joint extraction model is trained by using a transfer learning method, the network security threat intelligence in the network security threat intelligence corpus is segmented by using a word segmentation technology, an initial dictionary and a natural language organization rule.

[0027] Further, the construction method of the classifier comprises using a conditional random field algorithm.

[0028] Further, the network security threat knowledge graph is constructed by using the network security named entity and relationship joint extraction result, and the network security threat emergency response and defense are carried out based on the network security threat knowledge graph.

[0029] A storage medium, the storage medium stores a computer program, wherein the computer program is set to execute the above method when running.

[0030] An electronic device comprising a memory and a processor, wherein the memory stores a program for executing the above method.

[0031] Compared with the prior art, the advantages of the present application include:

[0032] 1) A network security named entity and relationship joint annotation method is proposed, which can simultaneously annotate network security named entities and relationships, which is beneficial to the joint extraction of network security named entities and relationships, and effectively avoids the error propagation problem existing in the serial extraction mode of first entity and then relationship;

[0033] 2) Introducing a transfer learning strategy, which can transfer the extracted knowledge or experience in the natural language field to the network security field, reduce the dependence of network security field named entity and relationship extraction on expert experience, enhance the portability of the model, and reduce the disturbance caused by the lack of labeled data set in the network security field. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 A network security named entity and relationship joint extraction method based on transfer learning.

[0035] Figure 2 A network security named entity and relationship joint labeling example of network security threat intelligence. DETAILED DESCRIPTION

[0036] First, the network security named entity and relationship joint labeling scheme is used to label the network security named entity and relationship in the network security threat intelligence, and the labeling process can be completed by manual labeling and rule labeling; then the natural language corpus is used to pre-train the deep neural network structure to extract the lexical feature representation vector; finally, the deep neural network structure is optimized using the network security named entity and relationship labeling data set, and the conditional random field classification labeling algorithm is trained at the same time, forming a deep neural network and conditional random field joint model to extract the network security named entity and relationship, and then using the network security named entity and relationship to construct the network security threat knowledge graph.

[0037] REFERENCE Figure 1 The detailed process is given below.

[0038] I. Use the network security named entity and relationship joint labeling scheme to label the network security threat intelligence, and the detailed process is as follows:

[0039] First, collect network security threat intelligence from typical network security threat intelligence blogs or forums; then manually label the network security named entity and relationship of the collected unstructured network security threat intelligence using the labeling tool, and summarize the labeling rules, and label the network security named entity and relationship of the collected structured network security threat intelligence using the structure rules of the intelligence itself; finally, automatically label the unstructured network security threat intelligence based on the labeling rules, and the labeled data is audited by experts to form a network security threat intelligence labeling data set.

[0040] Step 1: Collect network security threat intelligence from typical network security threat intelligence sources, screen network security threat intelligence blogs or forums with high contribution rate to open source network security threat intelligence platforms, and collect network security threat intelligence from these typical network security threat intelligence sources.

[0041] Second step: Manually label network security named entities and relations in unstructured network security threat intelligence (such as Figure 2 As shown in the figure, the unstructured threat intelligence "An XSS Vulnerability exists in System Center Operations Manager" is labeled as "O B-VulApp-1 O O O B-VulApp-2 I-VulApp-2 I-VulApp-2 I-VulApp-2", where B and I represent the position of the word in a network security named entity (Begin, Inside), VulApp represents the relationship that the application has a vulnerability, and 1 and 2 represent the first network security named entity and the second network security named entity in the VulApp relationship. Network security named entities and relations are manually labeled using named entity and relation labeling software, and labeling rules are generated. Network security named entities and relations are labeled using the structure rules of structured network security threat intelligence.

[0042] Among them, manual annotation can use open source or commercial entity and relation annotation software for annotation. For different sources of unstructured network security threat intelligence, different types of network security named entities and relations between entities, combined with expert analysis experience, network security named entity annotation rules and network security named entity relation annotation rules are designed.

[0043] Third step: Label network security named entities and relations based on rules, extract rules in the process of manually labeling network security named entities and relations, form various forms of labeling rules such as regular expressions and labeling dictionaries, and use the labeling rules to batch label unstructured network security threat intelligence.

[0044] II. Pre-training deep neural network structure using natural language corpus, the detailed process is as follows:

[0045] First step: Tokenize natural language corpus, tokenize natural language corpus based on the organization rules of natural language corpus (such as spaces, commas, periods and other punctuation marks between words), and form an initial dictionary nlpDict.

[0046] Second step: Mask some of the tokens in the natural language, randomly select a certain proportion of the corpus from the natural language corpus, and randomly select a certain proportion of the tokens in the corpus for masking.

[0047] Third step: Pre-training deep neural network, training deep neural network structure based on masked natural language corpus to achieve the purpose of predicting masked tokens. The trained deep neural network will be used to extract feature representation vectors of words in the subsequent steps.

[0048] III. Based on the network security threat intelligence annotation dataset, the transfer learning method is used to optimize the network security named entity and relationship joint extraction model (the model is composed of pre-trained deep neural network structure BERT and conditional random field classifier CRF), in order to achieve the purpose of network security named entity and relationship annotation, the detailed steps are as follows:

[0049] First step: using word segmentation technology, initial dictionary nlpDict extracted from natural language corpus and natural language organization rules to segment network security threat intelligence, specifically, the word segmentation technology is to split the network security threat intelligence specific vocabulary into existing vocabulary in the natural language field, in order to solve the problem that the network security threat intelligence specific vocabulary is not in the natural language field, that is, assuming w is the network security threat intelligence specific vocabulary composed of characters c1c2…c m , w = c1c2…c m , w1, w2, …, w k ∈ nlpDict, w1 = c1c2…c i , w2 = c i+1 c i+2 …c i+j , …, w k = c m-l c m-l+1 …c m , then w = w1, w2, …, w k .

[0050] Second step: build a deep neural network and conditional random field joint extraction model, add conditional random field algorithm based on pre-trained deep neural network structure, and input the word feature representation vector (H1, H2, …, H n ) extracted by deep neural network into conditional random field for label classification.

[0051] Third step: based on the segmented network security threat intelligence corpus, the parameter fine-tuning method of transfer learning is used to train the network security named entity and relationship joint extraction model, and the label marking result is used to realize the extraction of network security named entity and relationship.

[0052] Among them, for each segmented network security threat intelligence, first generate the initial embedding vector E = (E1, E2, …, E n ) of the intelligence, which is composed of the word order of the word w in nlpDict, the first sentence in the intelligence (usually 0), the position of the word in this intelligence, etc.; Then input the initial embedding vector into the network security named entity and relationship joint extraction model for calculation.

[0053] Four, for new unstructured network security threat intelligence, network security named entity and relationship joint extraction model is used to extract network security named entity and relationship, and then network security threat knowledge graph can be constructed by using the extracted network security named entity and relationship, and the network security threat emergency response and defense capability can be improved based on the network security threat knowledge graph.

[0054] Although specific embodiments of the present application and drawings are disclosed for illustrative purposes, those skilled in the art can understand that various substitutions, changes and modifications are possible without departing from the spirit and scope of the present application and the appended claims. Therefore, the present application should not be limited to the disclosed content of the best mode and drawings, and the scope of the present application is defined by the scope of the claims.

Claims

1. A method for jointly extracting network security named entities and relations based on transfer learning, comprising the following steps: 1) Jointly annotate cybersecurity named entities and relationships of cybersecurity threat intelligence to build a cybersecurity threat intelligence corpus; 2) Pre-training a deep neural network based on a natural language corpus to obtain a pre-trained deep neural network for extracting word feature representation vectors; wherein the pre-trained deep neural network is a pre-trained BERT model; wherein the pre-trained deep neural network based on a natural language corpus includes: Using the organizational rules of natural language, the natural language data in the natural language corpus is segmented to obtain an initial dictionary; Mask some word segments in natural language; Input the masked natural language corpus into the deep neural network, and obtain a pre-trained deep neural network for extracting word feature representation vectors by predicting the masked segmentation; 3) Combining the pre-trained deep neural network with a classifier to construct an initial joint extraction model; wherein the classifier is constructed using a conditional random field algorithm; 4) Based on the cybersecurity threat intelligence corpus, using a transfer learning method to train the initial joint extraction model to obtain a trained joint extraction model; wherein, based on the cybersecurity threat intelligence corpus, using a transfer learning method to train the initial joint extraction model includes: Using word segmentation technology, initial dictionary and natural language organization rules, the network security threat intelligence in the network security threat intelligence corpus is segmented to obtain several words; Generate an initial embedding vector for the word, where the initial embedding vector is composed of the word order of the word in the initial dictionary, the position of the sentence corresponding to the word in the cybersecurity threat intelligence, and the position of the word in the current piece of cybersecurity threat intelligence; Passing the initial embedding vector to a pre-trained deep neural network, and passing the extracted vocabulary feature representation vector into a conditional random field to classify the label of the relationship between entities; Based on the label classification of the relationship between entities, and using the parameter fine-tuning method of transfer learning, a trained joint extraction model is obtained; 5) Input unstructured cybersecurity threat intelligence into the trained joint extraction model to obtain the joint extraction results of cybersecurity named entities and relationships.

2. The method according to claim 1, wherein The following steps are used to build a cybersecurity threat intelligence corpus: 1) Collect cybersecurity threat intelligence from cybersecurity threat intelligence blogs or forums, including structured and unstructured cybersecurity threat intelligence. 2) For structured cybersecurity threat intelligence, use the structure rules of the intelligence itself to annotate cybersecurity named entities and relationships, and obtain the structured cybersecurity threat intelligence annotation results; 3) Use annotation tools to manually annotate some unstructured cybersecurity threat intelligence with cybersecurity named entities and relationships, and automatically annotate the remaining unstructured cybersecurity threat intelligence based on the summarized annotation rules; 4) Combine manual annotation results with rule-based annotation results to obtain unstructured network security threat intelligence annotation results; 5) Construct a cybersecurity threat intelligence corpus based on the annotation results of structured cybersecurity threat intelligence and unstructured cybersecurity threat intelligence.

3. The method according to claim 2, wherein The annotation rules include: regular expressions or annotation dictionaries.

4. The method according to claim 1, wherein The natural language organization rules include: word parts, dependencies between words, word positions and / or punctuation marks between words.

5. The method according to claim 1, wherein The network security threat knowledge graph is constructed by jointly extracting network security named entities and relationships, and emergency response and defense against network security threats are carried out based on the network security threat knowledge graph.

6. A storage medium storing a computer program, wherein: The computer program is configured to execute the method according to any one of claims 1 to 5 when executed.

7. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 5.

Images