A method, device, equipment and storage medium for extracting threat report attack behaviors

Abstract

The present application discloses a method, apparatus, device and storage medium for extracting attack behaviors in threat reports, including: obtaining a threat report to be extracted, and preprocessing the threat report to be extracted by means of natural language processing to obtain target sentences related to attack behaviors in the threat report to be extracted; using a semantic role labeling tool to perform semantic analysis on the target sentences to obtain various entities with semantic labels corresponding to the target sentences, the causal relationships between the entities, and the information flow direction; generating an attack traceability graph representing the attack behaviors corresponding to the threat report to be extracted according to the entities, the causal relationships between the entities, and the information flow direction. The present application can effectively remove redundant information in the threat report and simply and quickly extract attack behaviors by automatically extracting entities and the causal relationships and information flow direction between them from the target sentences through semantic annotation and generating a traceability graph.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and particularly relates to a method, device, equipment and storage medium for extracting threat report attack behaviors. Background Art

[0002] Cyber Threat Intelligence (CTI) is an important basis for identifying and responding to cyber threats. It is usually included in texts such as technical reports, and these texts usually contain natural languages with information such as attack behaviors and impacts on systems. However, cyber threat reports usually contain a large amount of irrelevant text, and it is difficult for security personnel to extract truly effective information from a large amount of text.

[0003] The prior art has successfully extracted information related to attack behaviors from cyber threat reports in the form of Indicators of Compromise (IOCs) using natural language processing (NLP) techniques. However, this method ignores the importance of the relationships between IOCs and does not fully restore cyber attack behaviors. This is mainly because the descriptions related to attack behaviors in cyber threat reports may only account for a small part, and the other parts are filled with a large amount of irrelevant information. Moreover, the sentence structures used in cyber threat reports are quite different from the languages used in daily life, making it difficult for traditional natural language processing tools to process cyber threat reports. Furthermore, extracting global information from cyber threat reports requires understanding the relationships between attack behaviors.

[0004] Therefore, how to efficiently and comprehensively extract effective attack behaviors from complex cyber threat reports is a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, equipment and storage medium for extracting threat report attack behaviors, which can effectively remove redundant information in threat reports and simply and quickly extract attack behaviors. The specific solutions are as follows:

[0006] The first aspect of the present application provides a method for extracting threat report attack behaviors, including:

[0007] Obtain the threat report to be extracted, and preprocess the threat report to be extracted through natural language processing to obtain target sentences related to attack behaviors in the threat report to be extracted;

[0008] Use a semantic role labeling tool to perform semantic analysis on the target sentences to obtain each entity with semantic labels corresponding to the target sentences, the causal relationships between each entity, and the information flow direction;

[0009] Generate an attack traceability graph representing the attack behavior corresponding to the to-be-extracted threat report based on each of the entities, the causal relationships between each of the entities, and the information flow.

[0010] Optionally, the preprocessing of the to-be-extracted threat report by natural language processing includes:

[0011] Segment the sentences in the to-be-extracted threat report to split long sentences in the to-be-extracted threat report into short sentences;

[0012] Convert the same class of synonyms in the segmented sentences into a preset word corresponding to the class;

[0013] Convert all passive voice sentences after the conversion of synonyms into active voice.

[0014] Optionally, after converting all passive voice sentences after the conversion of synonyms into active voice, it further includes:

[0015] Identify the subjectless sentences in the sentences after voice conversion and perform subject restoration operations on the subjectless sentences so that all sentences have subjects;

[0016] Replace the pronouns in all sentences with subjects by using the referent entities corresponding to each pronoun;

[0017] Unify the expressions of similar sentence patterns in the sentences after replacement to obtain sentences with standardized sentence patterns.

[0018] Optionally, the performing subject restoration operations on the subjectless sentences so that all sentences have subjects includes:

[0019] Perform part-of-speech tagging and dynamic programming on the subjectless sentences and then determine a list of subject candidate words corresponding to the subjectless sentences according to the dictionary system;

[0020] Determine the candidate word corresponding to the subjectless sentence according to the distance between each candidate word in the subject candidate word list and the subjectless sentence, and use the candidate word as the subject of the subjectless sentence and perform subject restoration operations.

[0021] Optionally, the replacing the pronouns in all sentences with subjects by using the referent entities corresponding to each pronoun includes:

[0022] Determine the referent entity corresponding to each pronoun through the NeuralCoref system, and use the referent entity to replace the pronouns in all sentences with subjects.

[0023] Optionally, after unifying the similar sentence patterns in the replaced sentence to obtain a sentence with a standardized sentence pattern, the method further includes:

[0024] Construct a BERT model and a BiLSTM model to respectively perform redundancy removal processing on the obtained sentence with a standardized sentence pattern by using the BERT model and the BiLSTM model;

[0025] Use a system entity extractor to detect the sentence after redundancy removal processing to determine a sentence with a complete semantics.

[0026] Optionally, the generating an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationship between each of the entities, and the information flow direction includes:

[0027] Use a system entity extractor to screen each of the entities to filter non-system entities;

[0028] Classify and merge the entities according to the semantic labels of each of the filtered entities, so as to classify the entities with the same type of semantic label into the same type of nodes, and merge the same entities in the same type of nodes;

[0029] Generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationship between each of the entities, and the information flow direction after node merging.

[0030] A second aspect of the present application provides a threat report attack behavior extraction device, including:

[0031] A preprocessing module, configured to obtain a threat report to be extracted, and perform preprocessing on the threat report to be extracted by means of natural language processing to obtain a target sentence related to an attack behavior in the threat report to be extracted;

[0032] Semantic annotation, configured to perform semantic analysis on the target sentence by using a semantic role annotation tool to obtain each entity with a semantic label corresponding to the target sentence, the causal relationship between each of the entities, and the information flow direction;

[0033] A graph generation module, configured to generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationship between each of the entities, and the information flow direction.

[0034] A third aspect of the present application provides an electronic device, which includes a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the foregoing threat report attack behavior extraction method.

[0035] A fourth aspect of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the foregoing threat report attack behavior extraction method is implemented.

[0036] In the present application, first, a threat report to be extracted is obtained, and the threat report to be extracted is preprocessed by natural language processing to obtain target statements related to attack behaviors in the threat report to be extracted; then, a semantic role labeling tool is used to perform semantic analysis on the target statements to obtain various entities with semantic labels corresponding to the target statements, the causal relationships and information flows between the entities; finally, an attack traceability graph representing the attack behaviors corresponding to the threat report to be extracted is generated according to the entities, the causal relationships between the entities, and the information flows. It can be seen that in the present application, after preprocessing the threat report, target statements related to attack behaviors in the threat report are obtained. On this basis, a semantic annotation tool is used for further processing to automatically extract entities representing attack behaviors and the causal relationships and information flows between them from the target statements, and at the same time, they are visually displayed in the form of a traceability graph, which can effectively remove redundant information in the threat report and simply and quickly extract attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0038] Figure 1 It is a flowchart of a threat report attack behavior extraction method provided by the present application;

[0039] Figure 2 It is a schematic diagram of a specific threat report attack behavior extraction method provided by the present application;

[0040] Figure 3 It is a schematic structural diagram of a threat report attack behavior extraction device provided by the present application;

[0041] Figure 4 It is a structural diagram of an electronic device for threat report attack behavior extraction provided by the present application. Detailed implementation manners

[0042] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0043] The prior art has successfully extracted information related to attack behaviors from network threat reports in the form of Indicators of Compromise (IOCs) using natural language processing (NLP) technology. However, this method ignores the importance of the relationships between IOCs and fails to fully restore network attack behaviors. This is mainly because the descriptions related to attack behaviors in network threat reports may only account for a small part, and the other parts are filled with a large amount of irrelevant information. Moreover, the sentence structures used in network threat reports are quite different from those in daily life, making it difficult for traditional natural language processing tools to process network threat reports. Furthermore, extracting global information from network threat reports requires understanding the relationships between attack behaviors. To address the above technical deficiencies, the present application provides a threat report attack behavior extraction solution. After preprocessing the threat report, target sentences related to attack behaviors in the threat report are obtained. On this basis, a semantic annotation tool is further used to automatically extract entities representing attack behaviors and the causal relationships and information flows between them from the target sentences, and at the same time, visualize them in the form of a traceability graph, which can effectively remove redundant information in the threat report and simply and quickly extract attack behaviors.

[0044] Figure 1 It is a flowchart of a threat report attack behavior extraction method provided by an embodiment of the present application. Refer to Figure 1 As shown, the threat report attack behavior extraction method includes:

[0045] S11: Obtain a threat report to be extracted, and preprocess the threat report to be extracted through natural language processing to obtain target sentences related to attack behaviors in the threat report to be extracted.

[0046] In this embodiment, first, a threat report to be extracted is obtained, and then the threat report to be extracted is preprocessed through natural language processing to obtain target sentences related to attack behaviors in the threat report to be extracted. Among them, the natural language processing method includes standardizing, disambiguating, and removing redundancy from the threat report to be extracted. The specific process can be referred to Figure 2 As shown.

[0047] Standardize the threat report to be extracted, and convert the sentences in the report into a more concise form. First, segment the sentences in the threat report to be extracted to split the long sentences in the threat report to be extracted into short sentences. Sentence splitting is a process of splitting sentences in the report and dividing long sentences into short sentences. Then, convert the same type of synonyms in the segmented sentences into a preset word corresponding to this type, that is, the process of synonym conversion. There are many synonyms in the threat report to be extracted, and these synonyms refer to the same entity. In this step, different synonyms can be converted into a specific word. Finally, convert all the passive voice sentences after synonym conversion into the active voice. Converting the passive voice in the threat report to be extracted into the active voice facilitates the identification of the subject and the object.

[0048] For natural language processing, the usage of elliptical sentences, pronouns, etc. will affect the semantics. In this embodiment, the sentences are processed to eliminate the ambiguity in the sentences. First, determine the subject elliptical sentences in the sentences after voice conversion and perform a subject restoration operation on the subject elliptical sentences so that all sentences have a subject. This step completes the missing subject. Sentences in the report often use elliptical sentences, which lack a subject or an object, making it difficult for traditional NLP tools to analyze sentences based on the components of the sentences. The solution is to first find all the subject elliptical sentences in the report, then find the candidate word list, and select the most likely subject according to the distance. Specifically, after performing part-of-speech tagging (POS) and dynamic programming (DP) on the subject elliptical sentences, determine the subject candidate word list corresponding to the subject elliptical sentences according to the dictionary system. Determine the candidate word corresponding to the subject elliptical sentence according to the distance between each candidate word in the subject candidate word list and the subject elliptical sentence, and use this candidate word as the subject of the subject elliptical sentence and perform a subject restoration operation. Then, perform pronoun elimination. Pronoun elimination is to convert a pronoun into the entity it refers to. Ignoring a pronoun will cause the pronoun to appear at the position of the entity it indicates in the origin graph. That is, use the referring entity corresponding to each pronoun to replace the pronoun in all sentences with a subject, where the referring entity corresponding to each pronoun can be determined through the NeuralCoref system, and use the referring entity to replace the pronoun in all sentences with a subject. The NeuralCoref system can perform pronoun elimination well, especially after standardization and elimination of subject elliptical sentences. Finally, unify the expression of similar sentence patterns in the replaced sentences to obtain sentences with standardized sentence patterns. In the threat report to be extracted, in order to avoid repeated sentence patterns, there are usually multiple expressions for the same meaning. This step converts the expressions with the same meaning into expressions that may appear in the report, and it can also be solved by combining POS and DP with the CTI dictionary.

[0049] Redundancy removal means removing the parts unrelated to the attack description in the threat report to be extracted, which is divided into two parts: removing sentence redundancy and removing word redundancy. First, a BERT model and a BiLSTM model are constructed to perform redundancy removal on the sentences with standardized sentence patterns by using the BERT model and the BiLSTM model respectively. It is not difficult to understand that the BERT model can consider the context information of each word. In the first part, the BiLSTM model is used to distinguish the semantics of sentences and distinguish the semantics of words in the sentences. In the second part, unnecessary words are removed. The above steps may cause the sentence to lose important semantics. The solution is to remove a sentence component only when this component does not contain entities that can be generated by the System Entity Extractor (SEE). That is, it is necessary to use the system entity extractor to detect the sentences after redundancy removal to determine the sentences with complete semantics.

[0050] S12: Use a semantic role labeling tool to perform semantic analysis on the target sentence to obtain each entity with a semantic label corresponding to the target sentence, the causal relationship between each of the entities, and the information flow direction.

[0051] Since the language used in the field of cyberspace security is highly specialized, it is very difficult for traditional natural language processing tools to understand, such as punctuation marks, professional terms, and other language structures. Many threat reports do not use traditional sentence delimiters, and it is difficult for NLP tools to distinguish the boundaries of sentences; professional terms in the field of cyberspace security have their unique meanings, and traditional NLP tools are difficult to understand their special meanings; different language structures and language usage skills will cause traditional NLP tools to misclassify sentence components. Therefore, it is necessary to introduce semantic analysis to understand the semantic relationship between entities in the sentence.

[0052] In this embodiment, after obtaining the target sentence that is brief, clear, and standard, use a semantic role labeling tool to perform semantic analysis on the target sentence to obtain each entity with a semantic label corresponding to the target sentence, the causal relationship between each of the entities, and the information flow direction. The semantic role labeling tool (Semantic Role Labeling, SRL) can associate each entity in the sentence with its semantic label. After SRL processing, the initiator and recipient of the action in the sentence can be correctly marked. At the same time, some pre-set rules can also be added to distinguish the causal relationship and the direction of the information flow.

[0053] S13: Generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationship between each of the entities, and the information flow direction.

[0054] In this embodiment, an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted is generated according to each of the entities, the causal relationships between each of the entities, and the information flow direction. The attack traceability graph can also be referred to as an origin graph, which includes a set of node-edge-node triples and a direction set. The construction process is as follows: First, a system entity extractor is used to screen each of the entities to filter out non-system entities; then, according to the semantic tags of each of the filtered entities, the entities are classified and merged, so that the entities with the same type of semantic tags are grouped into the same type of nodes, and the same entities in the same type of nodes are merged. That is, the same SRL parameter in the text is merged into the same node and non-system entities are removed using SEE. Finally, an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted is generated according to each of the entities after node merging, the causal relationships between each of the entities, and the information flow direction. This step effectively extracts the attack information in the report, and the extracted attack information is displayed in the form of an origin graph, and the generated origin graph can be matched with the manually generated origin graph. In addition, the generated origin graph can further be used as the input of a threat detection system.

[0055] It can be seen that in the embodiment of the present application, first, a threat report to be extracted is obtained, and the threat report to be extracted is preprocessed by natural language processing to obtain target statements related to the attack behavior in the threat report to be extracted; then, a semantic role labeling tool is used to perform semantic analysis on the target statements to obtain each entity with semantic tags corresponding to the target statements, the causal relationships between each of the entities, and the information flow direction; finally, an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted is generated according to each of the entities, the causal relationships between each of the entities, and the information flow direction. After preprocessing the threat report in the embodiment of the present application, target statements related to the attack behavior in the threat report are obtained. On this basis, a semantic annotation tool is further used to automatically extract the entities representing the attack behavior and the causal relationships and information flow direction between them from the target statements, and at the same time, it is visually displayed in the form of a traceability graph, which can effectively remove redundant information in the threat report and simply and quickly extract the attack behavior.

[0056] See Figure 3 As shown, the embodiment of the present application also correspondingly discloses a threat report attack behavior extraction device, including:

[0057] A preprocessing module 11, configured to obtain a threat report to be extracted, and preprocess the threat report to be extracted by natural language processing to obtain target statements related to the attack behavior in the threat report to be extracted;

[0058] The semantic annotation 12 is used to perform semantic analysis on the target statement by using a semantic role annotation tool, so as to obtain each entity with a semantic label corresponding to the target statement, the causal relationship and information flow between each of the entities;

[0059] The graph generation module 13 is used to generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationship and the information flow between each of the entities.

[0060] It can be seen that in the embodiment of the present application, the threat report to be extracted is first obtained, and the threat report to be extracted is preprocessed by means of natural language processing to obtain the target statement related to the attack behavior in the threat report to be extracted; then the semantic role annotation tool is used to perform semantic analysis on the target statement to obtain each entity with a semantic label corresponding to the target statement, the causal relationship and the information flow between each of the entities; finally, an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted is generated according to each of the entities, the causal relationship and the information flow between each of the entities. In the embodiment of the present application, after preprocessing the threat report, the target statement related to the attack behavior in the threat report is obtained. On this basis, the semantic annotation tool is used for further processing to automatically extract the entities representing the attack behavior and the causal relationship and information flow between them from the target statement, and at the same time, it is visually displayed in the form of a traceability graph, which can effectively remove the redundant information in the threat report and simply and quickly extract the attack behavior.

[0061] In some specific embodiments, the preprocessing module 11 specifically includes:

[0062] The standardization sub-module is used to perform sentence segmentation on the threat report to be extracted, so as to segment the long sentences in the threat report to be extracted into short sentences, convert the same class of synonyms in the segmented sentences into a preset word corresponding to the class, and convert all passive voice sentences after the synonym conversion into active voice;

[0063] The disambiguation sub-module is used to determine the subject ellipsis sentences in the sentences after voice conversion and perform subject restoration operations on the subject ellipsis sentences so that all sentences have subjects, replace the pronouns in all sentences with subjects with the corresponding referent entities, and unify the similar sentence patterns in the sentences after replacement to obtain sentences with standardized sentence patterns;

[0064] A redundancy elimination sub-module is used to construct a BERT model and a BiLSTM model, so as to respectively perform redundancy elimination processing on the obtained sentences with standardized sentence patterns by using the BERT model and the BiLSTM model, and use a system entity extractor to detect the sentences after redundancy elimination processing to determine sentences with complete semantics.

[0065] In some specific embodiments, the disambiguation sub-module specifically includes:

[0066] A subject ellipsis sentence elimination unit is used to perform part-of-speech tagging and dynamic programming on the subject ellipsis sentence, and then determine a list of subject candidate words corresponding to the subject ellipsis sentence according to a dictionary system. According to the distance between each candidate word in the subject candidate word list and the subject ellipsis sentence, a candidate word corresponding to the subject ellipsis sentence is determined, and this candidate word is used as the subject of the subject ellipsis sentence and a subject restoration operation is performed;

[0067] A pronoun elimination unit is used to determine the referential entity corresponding to each pronoun through a NeuralCoref system, and use the referential entity to replace the pronoun in all sentences with a subject.

[0068] In some specific embodiments, the graph generation module 13 specifically includes:

[0069] A screening unit is used to screen each of the entities by using a system entity extractor to filter non-system entities;

[0070] A merging unit is used to classify and merge the entities according to the semantic tags of each of the filtered entities, so as to classify the entities with the same type of semantic tags into the same type of nodes, and merge the same entities in the same type of nodes;

[0071] A generation unit is used to generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities after node merging, the causal relationship between each of the entities, and the information flow direction.

[0072] Furthermore, an embodiment of the present application also provides an electronic device. Figure 4 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment, and the content in the figure cannot be considered as any limitation on the scope of use of the present application.

[0073] Figure 4Schematic diagram of the structure of an electronic device 20 provided by an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the threat report attack behavior extraction method disclosed in any of the foregoing embodiments.

[0074] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, and specific limitations are not imposed here; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application needs, and specific limitations are not imposed here.

[0075] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, a random access memory, a magnetic disk, or an optical disc, etc. The resources stored thereon can include an operating system 221, a computer program 222, and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0076] Among them, the operating system 221 is used to manage and control each hardware device on the electronic device 20 and the computer program 222 to enable the processor 21 to perform operations and processing on the massive data 223 in the memory 22. It can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the threat report attack behavior extraction method executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. The data 223 can include threat reports collected by the electronic device 20.

[0077] Furthermore, an embodiment of the present application also discloses a storage medium in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the threat report attack behavior extraction method disclosed in any of the foregoing embodiments are implemented.

[0078] In the present specification, the various embodiments are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts among the various embodiments can be referred to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method part.

[0079] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the said element.

[0080] The threat report attack behavior extraction method, device, equipment and storage medium provided by the present invention have been introduced in detail above. Specific examples are used in this text to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for extracting threat report attack behaviors, characterized in that, Including: Obtain a threat report to be extracted, and preprocess the threat report to be extracted by means of natural language processing to obtain target sentences related to attack behaviors in the threat report to be extracted; Use a semantic role labeling tool to perform semantic analysis on the target sentences to obtain each entity with semantic labels corresponding to the target sentences, the causal relationships and information flows between each of the entities; Generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationships and the information flows between each of the entities; The preprocessing of the threat report to be extracted by means of natural language processing includes: performing sentence segmentation on the threat report to be extracted to segment long sentences in the threat report to be extracted into short sentences; converting the same type of synonyms in the segmented sentences into a preset word corresponding to the type; converting all passive voice sentences after the synonym conversion into active voice; determining subject ellipsis sentences in the sentences after the voice conversion and performing subject restoration operations on the subject ellipsis sentences so that all sentences have subjects; using the referent entities corresponding to each pronoun to replace the pronouns in all sentences with subjects; performing unified expression on similar sentence patterns in the sentences after replacement to obtain sentences with standardized sentence patterns; The attack traceability graph includes a node-edge-node triple set and a direction set, and the construction process of the attack traceability graph includes: using a system entity extractor to screen each of the entities to filter non-system entities; classifying and merging the entities according to the semantic labels of each of the filtered entities so as to classify the entities with the same type of semantic labels into the same type of nodes and merging the same entities in the same type of nodes; generating an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationships and the information flows between each of the entities after the node merging; 2. The threat report attack behavior extraction method according to claim 1, wherein The performing subject restoration operations on the subject ellipsis sentences so that all sentences have subjects includes: Performing part-of-speech tagging and dynamic programming on the subject ellipsis sentences and then determining a list of subject candidate words corresponding to the subject ellipsis sentences according to a dictionary system; Determining a candidate word corresponding to the subject ellipsis sentence according to the distance between each candidate word in the list of subject candidate words and the subject ellipsis sentence, and using the candidate word as the subject of the subject ellipsis sentence and performing a subject restoration operation.

3. The threat report attack behavior extraction method according to claim 1, wherein, The using the referent entities corresponding to each pronoun to replace the pronouns in all sentences with subjects includes: Determining the referent entities corresponding to each of the pronouns through a NeuralCoref system, and using the referent entities to replace the pronouns in all sentences with subjects.

4. The method for extracting threat report attack behaviors according to claim 1, wherein, After performing unified expression on similar sentence patterns in the sentences after replacement to obtain sentences with standardized sentence patterns, it further includes: Build a BERT model and a BiLSTM model to respectively perform redundancy removal processing on the obtained sentences with standardized sentence patterns using the BERT model and the BiLSTM model; Use a system entity extractor to detect the sentences after redundancy removal processing to determine the sentences with complete semantics.

5. The method for extracting threat report attack behaviors according to any one of claims 1 to 4, characterized in that, The generating an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationship between each of the entities, and the information flow direction includes: Use a system entity extractor to screen each of the entities to filter non-system entities; Classify and merge the entities according to the semantic tags of each of the filtered entities, so as to classify the entities with the same type of semantic tags into the same type of nodes, and merge the same entities in the same type of nodes; Generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities after node merging, the causal relationship between each of the entities, and the information flow direction.

6. A threat report attack behavior device, characterized in that, Includes: A preprocessing module, configured to obtain a threat report to be extracted, and perform preprocessing on the threat report to be extracted through natural language processing to obtain target sentences related to attack behavior in the threat report to be extracted; Semantic annotation, configured to perform semantic analysis on the target sentences using a semantic role annotation tool to obtain each entity corresponding to the target sentences with semantic tags, the causal relationship between each of the entities, and the information flow direction; A graph generation module, configured to generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities, the causal relationship between each of the entities, and the information flow direction; The preprocessing module is specifically configured to perform sentence segmentation on the threat report to be extracted to split long sentences in the threat report to be extracted into short sentences; convert the same type of synonyms in the segmented sentences into a preset word corresponding to this type; convert all passive voice sentences after synonym conversion into active voice; determine the subject ellipsis sentences in the sentences after voice conversion and perform subject restoration operations on the subject ellipsis sentences so that all sentences have subjects; replace the pronouns in all sentences with subjects with the corresponding referential entities; unify the expressions of similar sentence pattern sentences in the replaced sentences to obtain sentences with standardized sentence patterns; The attack traceability graph includes a set of node-edge-node triples and a set of directions. The threat report attack behavior device is further configured to use a system entity extractor to screen each of the entities to filter out non-system entities; classify and merge the entities according to the semantic tags of each of the filtered entities, so as to classify the entities with the same type of semantic tags into the same type of nodes, and merge the same entities in the same type of nodes; generate an attack traceability graph representing the attack behavior corresponding to the threat report to be extracted according to each of the entities after node merging, the causal relationships between the entities, and the information flow direction.

7. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the threat report attack behavior method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, For storing computer-executable instructions, when the computer-executable instructions are loaded and executed by a processor, the threat report attack behavior method according to any one of claims 1 to 5 is implemented.

Images