A dictionary construction method for fast entity identification in network security field

Abstract

A dictionary construction method for rapid entity recognition in the field of network security. First, a network security ontology is constructed. A crawler system is used to obtain the original corpus in the network security field. After some text sequences are manually annotated with BIO, the existing entity annotated corpus in the network security field is formed. After extracting entities from it, a basic dictionary is constructed. Subsequently, the existing vocabulary related to entity types in the network security field is integrated to expand the basic dictionary. Then, on the one hand, an autonomous learning method is used to select a large amount of data from an unlabeled data set, and a deep learning model is used to automatically annotate on a large scale. On the other hand, an active learning method is used to select a small amount of data from an unlabeled data set, and a dictionary is used to guide accurate automatic annotation before manual inspection. Finally, the automatic recognition tool is used again to extract new words from the newly annotated data, and a cycle of annotation-extraction-annotation is performed, thereby achieving large-scale, fully automatic, accurate and fast data annotation and dictionary expansion.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security knowledge graph construction, and in particular relates to a dictionary construction method for rapid entity identification in the network security field. Background Art

[0002] Today's society is entering a new era of the Internet of Everything. While data information has become an important strategic resource and a new production factor, the threats and risks in cyberspace are also increasing. In order to effectively grasp the overall situation of network security and conduct an overall assessment and trend analysis of the current cyberspace security situation, government agencies, related enterprises and other institutions have released a large number of network security text sequences on vulnerabilities, attacks, viruses and other aspects. However, this knowledge is typical fragmented knowledge and needs to be analyzed and processed to form structured data to have stronger decision-making support. In view of the above background, the research on the construction of network security knowledge graphs for remote network security expert data has been favored. Network security knowledge graphs can present network security knowledge in the form of graphs, which are more systematic and relational, thereby helping researchers to quickly perceive and analyze network security situations. The core link of constructing network security knowledge graphs is information extraction, that is, named entity recognition and entity relationship extraction for massive unstructured network security text sequences.

[0003] Named entity recognition is a basic work for information extraction and knowledge graph construction. The core goal is to extract proper names such as names of people and places and meaningful quantitative phrases such as time and date in natural sentences and classify them. After more than 20 years of research and development, a variety of technologies have emerged in the field of named entity recognition, including rule-based and dictionary-based methods, machine learning-based methods, and deep learning-based methods. Rule-based and dictionary-based methods can achieve high accuracy in specific tasks, but require a lot of manpower to construct rules and dictionaries, and cannot be well transferred; machine learning-based methods can overcome these drawbacks, but still require a large number of high-quality manually labeled training sets and manually constructed features; and deep learning-based methods, including convolutional neural networks (CNNs), recurrent neural networks (RNNs), and long short-term memory networks (LSTMs), can automatically extract features through end-to-end learning, but still rely on a large number of high-quality manually labeled corpora. It can be seen that large-scale text annotation is essential for effective model training. However, in the field of network security, the construction of the Chinese network security knowledge graph has just started, and the annotated corpus in this field is extremely scarce. Summary of the invention

[0004] In order to overcome the shortcomings of the above-mentioned prior art and apply deep learning models for effective supervised learning, the purpose of the present invention is to provide a dictionary construction method for rapid identification of entities in the field of network security, which can quickly and accurately machine-annotate texts in the field of network security.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is:

[0006] A dictionary construction method for rapid entity recognition in the field of network security, comprising:

[0007] Step 1, build a basic dictionary: build a network security domain ontology, determine the entity types for entity recognition and dictionary construction based on the ontology, integrate the existing network security domain corpus, build an unlabeled dataset U and a labeled dataset L, use automatic recognition tools to identify entities from the labeled dataset L, and build a basic dictionary D;

[0008] Step 2: Expand the basic dictionary: Expand the basic dictionary D using the existing vocabulary related to entity types in the network security field;

[0009] Step 3: Select S text sequences with richer information from the unlabeled dataset U through active learning sampling for dictionary-guided annotation, and then manually check to obtain a new labeled dataset S;

[0010] Step 4: Select T valid text sequences with the largest confidence from the unlabeled dataset U through autonomous learning sampling and label them based on the deep learning model to obtain a new labeled dataset T;

[0011] Step 5: Update the labeled dataset L and the unlabeled dataset U, use the automatic recognition tool to extract new entities from the newly labeled dataset S, T, and update the basic dictionary D;

[0012] Step 6: Iterate steps 3 to 5 to achieve fast and accurate entity recognition and dictionary expansion.

[0013] Preferably, in step 1, by combining the target data source, the core concept set is divided into three dimensions: basic dimension, threat dimension, and vulnerable dimension, and the relationship between the core entity concept and the entity concept is defined to construct a network security domain ontology, wherein the basic dimension is the basic category involved in the network security field, including software, system, and hardware; the vulnerable dimension includes the security risks or threats and risks of assets in software and hardware; the threat dimension includes various attack events, attack links, attack methods, and various attack results caused in network security events.

[0014] Preferably, the core entity concepts are 16 categories, namely software (SW), hardware (HW), system (OS), version (VER), location name (LOC), organization name (ORG), attacker (AR), host (Host), address (Address), vulnerability number (VI), vulnerability type (VN), attack method (AT), malware (MW), result (CSQ), malware type (MWT) and network flow (FW); there are 8 relationships between the entity concepts, namely own, contain, belong to, run, exist, cause, utilize and locate; based on the ontology, 14 entity types are determined for entity recognition and dictionary construction, including: {software name (SW), hardware (HW), system (OS), version (VER), location name (LOC), organization name (ORG), vulnerability number (VI), vulnerability type (VN), attacker (AR), attack method (AT), malware (MW), result (CSQ), malware type (MWT), network flow (FW)}.

[0015] Preferably, in step 1, a crawler system is used to obtain existing network security field corpus from major network security information websites and response centers. The data obtained by the crawler system is deduplicated and sorted to form an unlabeled data set U, and then some text sequences are selected for manual annotation using the BIO annotation method, that is, each data element is annotated as a sequence of "BX", "IX" or "O", where B and I represent the element position in the entity type, X represents the entity type, and O represents other non-entity elements. After manual annotation, a labeled data set L is formed.

[0016] Preferably, in the automatic recognition tool, for each text sequence X in the annotated data set L, characters marked not as "O" are detected, the scope and entity type of the entity are identified, and entities within the entity type determined for entity recognition and dictionary construction are selected, with the entity name as the key and the labeled entity type as the value, and stored in the dictionary in the format of {key, value} to complete the construction of the basic dictionary D.

[0017] Preferably, in step 2, the existing vocabulary related to entity types in the network security field is collected and annotated and uniformly stored in the basic dictionary D to complete its expansion. The vocabulary includes: an Internet company name vocabulary, a common software, hardware and operating system vocabulary, and a vulnerability type vocabulary.

[0018] Preferably, in step 3, active learning sampling is performed as follows:

[0019] First, the named entity recognition model BERT-BiLSTM-CRF is trained using the labeled dataset L, denoted by M, and then the unlabeled dataset U is predicted by the model M; then based on the active sampling strategy Filter out S unlabeled text sequences with richer information from the unlabeled dataset U, use a dictionary to machine-annotate them, and for each unlabeled text sequence, traverse the expanded basic dictionary D. If it contains an entity, the corresponding entity is labeled as this type. For entities that are not included in the dictionary or are incorrectly labeled, correct the annotations after manual inspection, and add the annotated data to the labeled dataset L to obtain a new annotated dataset S.

[0020] Preferably, the active sampling strategy In , for any input sequence X, Y represents all possible label sequences, and P(y|X) represents the probability that the model predicts that the label sequence corresponding to the current input sequence is y. The calculation formula is as follows:

[0021]

[0022] Where: Score(y,X) represents the score of the tag sequence y, including EmissionScore and TransitionScore;

[0023] Normalized by sequence length, the normalized minimum confidence of the corresponding label sequence for any input sequence X is:

[0024]

[0025] Where: y * Indicates the label sequence with the highest probability corresponding to the current input sequence; P(y * |X) indicates that the model predicts that the label sequence corresponding to the current input sequence is y * The probability of N is the length of the input sequence X. Represents confidence. The smaller its value is, the greater the uncertainty of the model's prediction of the current input sequence is, thereby screening out S text sequences with greater information from the unlabeled dataset U.

[0026] Preferably, in step 4, autonomous learning sampling is as follows:

[0027] First, the named entity recognition model BERT-BiLSTM-CRF is trained using the labeled dataset L, denoted by M, and then the unlabeled dataset U is predicted by the model M; then the autonomous sampling strategy is adopted Select T valid text sequences with the maximum confidence from the unlabeled dataset U. After the text sequences are selected, the model M is used to identify entities and then machine labeled to obtain a new labeled dataset T.

[0028] Preferably, the autonomous sampling strategy The calculation formula is as follows:

[0029]

[0030] Where: (y * |X) represents the sequence prediction with the highest confidence of the prediction result of model M for the input sequence X, N represents the length of the input sequence X, e_num(y * ) represents the number of entity tokens in the predicted label sequence. The higher the number, the more entity information the sequence X contains.

[0031] Existing entity annotations in the field of network security are all completed by manual annotation. Compared with the existing technology, the benefits of the present invention are as follows:

[0032] (1) Traditional manual annotation methods are time-consuming and labor-intensive. The dictionary-guided annotation and deep learning model annotation proposed in the present invention have a high degree of automation, which greatly reduces labor and time costs.

[0033] (2) The present invention adopts a method that combines active learning and autonomous learning to screen out high-quality, information-rich unlabeled samples, thereby improving labeling efficiency; and adopts a labeling method that combines dictionary-guided labeling and deep learning model labeling to improve labeling accuracy.

[0034] (3) The network security entity dictionary can be automatically expanded as data is annotated. As the dictionary expands, its efficiency in guiding annotation becomes higher and higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of the process of constructing a network security entity dictionary of the present invention;

[0036] Figure 2 It is the constructed ontology of network security domain;

[0037] Figure 3 It is the design diagram of the crawler system;

[0038] Figure 4 It is the operation process of obtaining vulnerability description information from CNNVD (National Vulnerability Information Database). DETAILED DESCRIPTION

[0039] The following is a detailed description of the embodiments of the present invention in conjunction with the accompanying drawings and embodiments. It should be noted that the embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the embodiments of the present invention can be combined with each other in the absence of conflict.

[0040] The specific implementation process of the present invention includes a basic dictionary construction process, a basic dictionary expansion process, an active learning sampling and dictionary guidance annotation process, an autonomous learning sampling and model annotation process, a dictionary update process and an iterative process. Figure 1 The dictionary construction process for rapid entity recognition in the field of network security of the present invention is shown, and the steps are as follows:

[0041] 1. Basic dictionary construction process

[0042] Construct a network security domain ontology, determine the entity types for entity recognition and dictionary construction based on the ontology, integrate the existing network security domain corpus, construct an unlabeled dataset U and a labeled dataset L, use automatic recognition tools to identify entities from the labeled dataset L, and construct a basic dictionary D. The specific process is as follows:

[0043] (1) Considering the effective representation and unified management of multi-source heterogeneous network security data, combined with the target data source, the core concept set is divided into three dimensions: basic dimension, threat dimension, and vulnerable dimension to construct the network security domain ontology. The basic dimension refers to the basic categories such as software, system, and hardware involved in the network security field; the vulnerable dimension mainly refers to the security risks or threats and risks of some assets including software and hardware; the threat dimension refers to various attack events, attack links, attack methods, and various attack results caused in network security incidents. By defining 16 types of core entity concepts {software (SW), hardware (HW), system (OS), version (VER), location name (LOC), organization name (ORG), attacker (AR), host (Host), address (Address), vulnerability number (VI), vulnerability type (VN), attack method (AT), malware (MW), result (CSQ), malware type (MWT), and network flow (FW)} and the relationship between 8 entity concepts {own, contain, belong to, run, exist, cause, use, and be located}, the network security domain ontology is finally constructed as follows: Figure 2 As shown in the figure. Based on this ontology, 14 entity types are determined for entity recognition and dictionary construction, including {software name (SW), hardware (HW), system (OS), version (VER), location name (LOC), organization name (ORG), vulnerability number (VI), vulnerability type (VN), attacker (AR), attack method (AT), malware (MW), result (CSQ), malware type (MWT), network flow (FW)}.

[0044] (2) The crawler system is used to obtain semi-structured and unstructured network security text information from 10 network security information websites and response centers, including the National Security Vulnerability Platform (CNVD), the National Security Vulnerability Database (CNNVD), Security Guest, the National Computer Virus Center (CVERC), the Green Alliance Threat Intelligence Analysis Platform, the FreeBuf Security Forum, the Tencent Security Center, the Sangfor Security Center, the 360 ​​Security Response Center, and the Dalian University of Technology Network and Informatization Center. The crawler system mainly includes URL management, content download, web page parsing, data storage, thread management, and exception handling. The crawler system design is as follows: Figure 3 As shown. The basic crawling process is:

[0045] a) Select one or part of the seed URLs as the initial URL link queue and put them into the URL queue to be crawled;

[0046] b) Take out the URL in order, resolve it through DNS to get the IP address, download the HTML source code and page information, and if a new URL is obtained in this process, put it into the queue of URLs to be crawled, so as to realize cyclic crawling;

[0047] c) When crawling websites with large amounts of data, you should also consider using thread management to increase the crawling rate;

[0048] d) The obtained page content needs to be parsed through natural language processing and other technologies to remove noise data, so as to obtain specific content and store it in the database according to corresponding rules.

[0049] Take the crawling process of obtaining vulnerability description information from CNNVD (National Vulnerability Information Database) as an example. Figure 4 As shown in the figure, the scheduler uniformly manages, schedules, and monitors; the engine obtains the URL web link to be crawled from the scheduler and sends a download request to the downloader; the downloader grabs the web content and downloads it locally; the parser parses the grabbed content, extracts the required structured and unstructured information, and gives it to the data pipeline for storage and processing; and the engine is responsible for controlling the data flow and response of each component.

[0050] After deduplication and sorting, the data obtained by the crawler system eventually formed a self-built Chinese network security text sequence set U, which includes about 170,000 vulnerability descriptions from 8 data source websites and more than 1,000 network security expert reports. Then, some text sequences were selected and manually annotated using the BIO annotation method, that is, each data element was annotated as a sequence of "BX", "IX" or "O", where B and I represent the element position in the entity type, X represents the entity type, and O represents other non-entity elements. After manual annotation, a labeled data set L of existing entities in the network security field was formed.

[0051] (3) Using automatic recognition tools, for each text sequence X in the annotated dataset L, detect the characters that are not labeled as "O", identify the scope and entity type of the entity, select the entity type within the above 14 types, use the entity name as the key and the labeled entity type as the value, and store it in the dictionary in the format of {key, value} to complete the construction of the basic dictionary D.

[0052] 2. Basic dictionary expansion process

[0053] The basic dictionary D is expanded by using the existing vocabulary related to entity types in the field of network security. Specifically, the existing vocabulary related to entity types in the field of network security is integrated, including the vocabulary of Internet company names, the vocabulary of commonly used software, hardware and operating systems, and the vocabulary of vulnerability types, which are collected and annotated and uniformly stored in the basic dictionary D.

[0054] 3. Active learning sampling and dictionary-guided annotation process

[0055] Through active learning sampling, S text sequences with richer information are selected from the unlabeled data set U for dictionary-guided annotation, followed by manual inspection to obtain the new labeled data set S. The specific process is as follows:

[0056] (1) First, a named entity recognition model M is trained using a labeled dataset L of entities in the existing network security field. Then, the unlabeled dataset U is predicted using the model M. At the same time, S unlabeled samples are selected from U based on the active sampling strategy Q, and then manually annotated and added to L. The model is iteratively trained until the stopping condition is met.

[0057] The classic NER model BERT-BiLSTM-CRF is selected as the network security named entity recognition model of the present invention, represented by M. The named entity recognition model M is trained using the existing network security field entity annotation dataset L, and then the unlabeled dataset U is predicted by the model M. For any input sequence X, Y represents all possible label sequences, and the P(y|X) model predicts the probability that the label sequence corresponding to the current input sequence is y, and the calculation formula is as follows:

[0058]

[0059] y * Indicates the label sequence with the highest probability corresponding to the current input sequence; P(y * |X) indicates that the model predicts that the label sequence corresponding to the current input sequence is y * The probability is calculated using Formula 1. Then the sequence length is normalized to obtain the normalized minimum confidence of the corresponding label sequence for any input sequence X:

[0060]

[0061] Where: N represents the length of the input sequence X, Represents confidence. The smaller its value is, the greater the uncertainty of the model's prediction of the current input sequence is, so that S text sequences with more information can be screened out from the unlabeled dataset U.

[0062] (2) Obtained through active sampling strategy After filtering out the S unlabeled text sequences, perform dictionary-guided annotation on each text. By traversing the network security entity dictionary, if a certain entity is included, the corresponding entity is labeled as this type. For entities that are not included in the dictionary or are incorrectly labeled, the annotation is corrected after manual inspection.

[0063] 4. Autonomous learning sampling and model labeling process

[0064] Through autonomous learning sampling, T text sequences with the highest confidence and validity are selected from the unlabeled dataset U for deep learning-based model annotation to obtain a new labeled dataset T. The specific process is as follows:

[0065] (1) Define the autonomous sampling strategy as Select T text sequences with the maximum confidence and effectiveness (Maximum Confidence and Effectiveness, MCE) from the unlabeled dataset U. The calculation formula is as follows:

[0066]

[0067] Where: (y * |X) represents the sequence prediction with the highest confidence of the prediction result of model M for the input sequence X, N represents the length of the input sequence X, e_num(y * ) represents the number of entity tokens in the predicted label sequence. The higher the number, the more entity information the sequence X contains.

[0068] (2) Obtained through active sampling strategy After the T unlabeled text sequences are screened out, they are recognized using model M and then machine labeled.

[0069] 5. Dictionary update process

[0070] Update the labeled dataset L and the unlabeled dataset U:

[0071] L=L+S+T;U=UST Formula 4

[0072] Then, an automatic recognition tool is used to extract new entities from the newly annotated datasets S and T and add them to the dictionary to complete the dictionary update.

[0073] 6. Iteration process

[0074] Iterate steps 3, 4, and 5 to achieve fast and accurate entity recognition and dictionary expansion.

Claims

1. A dictionary construction method for rapid entity identification in the field of network security, characterized in that: include: Step 1, build a basic dictionary: build a network security domain ontology, determine the entity types for entity recognition and dictionary construction based on the ontology, integrate the existing network security domain corpus, build an unlabeled dataset U and a labeled dataset L, use automatic recognition tools to identify entities from the labeled dataset L, and build a basic dictionary D; Step 2: Expand the basic dictionary: Expand the basic dictionary D using the existing vocabulary related to entity types in the network security field; Step 3: Select S text sequences with richer information from the unlabeled dataset U through active learning sampling for dictionary-guided annotation, and then manually check to obtain a new labeled dataset S; Step 4: Select T valid text sequences with the largest confidence from the unlabeled dataset U through autonomous learning sampling and label them based on the deep learning model to obtain a new labeled dataset T; Step 5: Update the labeled dataset L and the unlabeled dataset U, use the automatic recognition tool to extract new entities from the newly labeled datasets S and T, and update the basic dictionary D; Step 6: Iterate steps 3 to 5 to achieve fast and accurate entity recognition and dictionary expansion. Wherein, in step 3, active learning sampling is as follows: First, the named entity recognition model BERT-BiLSTM-CRF is trained using the labeled dataset L, denoted by M, and then the unlabeled dataset U is predicted by the model M; then based on the active sampling strategy Filter out S unlabeled text sequences with richer information from the unlabeled dataset U, and use the dictionary to machine-label them. For each unlabeled text sequence, traverse the expanded basic dictionary D. If it contains an entity, the corresponding entity is labeled as this type. For entities that are not included in the dictionary or are labeled incorrectly, manually check and correct the labels, and add the labeled data to the labeled dataset L to obtain a new labeled dataset S. The active sampling strategy In , for any input sequence X, Y represents all possible label sequences, and P(y|X) represents the probability that the model predicts that the label sequence corresponding to the current input sequence is y. The calculation formula is as follows: Where: Score(y,X) represents the score of label sequence y, including the emission score and the transfer score; Normalized by sequence length, the normalized minimum confidence of the corresponding label sequence for any input sequence X is: Where: y * Indicates the label sequence with the highest probability corresponding to the current input sequence; P(y * |X) indicates that the model predicts that the label sequence corresponding to the current input sequence is y * The probability of N is the length of the input sequence X. Represents confidence. The smaller its value is, the greater the uncertainty of the model's prediction of the current input sequence is, thus S text sequences with greater information content are selected from the unlabeled dataset U; In step 4, autonomous learning sampling is as follows: First, the named entity recognition model BERT-BiLSTM-CRF is trained using the labeled dataset L, denoted by M, and then the unlabeled dataset U is predicted by the model M; then the autonomous sampling strategy is adopted Select T valid text sequences with the maximum confidence from the unlabeled dataset U. After the text sequences are selected, use the model M to identify entities and perform machine labeling to obtain a new labeled dataset T. The autonomous sampling strategy The calculation formula is as follows: Where: (y * |X) represents the sequence prediction with the highest confidence of the prediction result of model M for the input sequence X, N represents the length of the input sequence X, e_num(y * ) represents the number of entity tokens in the predicted label sequence. The higher the number, the more entity information the sequence X contains.

2. According to claim 1, the dictionary construction method for rapid entity identification in the field of network security is characterized in that: In the step 1, by combining the target data source, the core concept set is divided into three dimensions: basic dimension, threat dimension, and vulnerable dimension, and the relationship between the core entity concept and the entity concept is defined to construct a network security domain ontology, wherein the basic dimension is the basic category involved in the network security field, including software, system, and hardware; the vulnerable dimension includes the security risks or threats and risks of assets in software and hardware; the threat dimension includes various attack events, attack links, attack methods, and various attack results caused in network security events.

3. According to claim 2, the dictionary construction method for rapid entity identification in the field of network security is characterized in that: The core entity concepts are 16 categories, namely software (SW), hardware (HW), system (OS), version (VER), location name (LOC), organization name (ORG), attacker (AR), host (Host), address (Address), vulnerability number (VI), vulnerability type (VN), attack method (AT), malware (MW), result (CSQ), malware type (MWT) and network flow (FW); there are 8 relationships between the entity concepts, namely own, contain, belong to, run, exist, cause, utilize and locate; based on the ontology, 14 entity types are determined for entity recognition and dictionary construction, including: {software name (SW), hardware (HW), system (OS), version (VER), location name (LOC), organization name (ORG), vulnerability number (VI), vulnerability type (VN), attacker (AR), attack method (AT), malware (MW), result (CSQ), malware type (MWT), network flow (FW)}.

4. The dictionary construction method for rapid entity identification in the network security field according to claim 1 is characterized in that: In the step 1, a crawler system is used to obtain existing network security corpus from major network security information websites and response centers. The data obtained by the crawler system is deduplicated and sorted to form an unlabeled data set U. Subsequently, some text sequences are selected and manually labeled using the BIO labeling method, that is, each data element is labeled as a sequence of "BX", "IX" or "O", where B and I represent the element position in the entity type, X represents the entity type, and O represents other non-entity elements. After manual labeling, a labeled data set L is formed.

5. The dictionary construction method for rapid entity identification in the network security field according to claim 1 is characterized in that: In the automatic recognition tool, for each text sequence X in the labeled data set L, characters not labeled as "O" are detected, the scope and entity type of the entity are identified, and entities within the entity type determined for entity recognition and dictionary construction are selected. The entity name is used as the key and the labeled entity type is used as the value. The entity is stored in the dictionary in the format of {key, value} to complete the construction of the basic dictionary D.

6. The dictionary construction method for rapid entity identification in the network security field according to claim 1 is characterized in that: In step 2, the existing vocabulary related to entity types in the network security field is collected and annotated and uniformly stored in the basic dictionary D to complete its expansion. The vocabulary includes: an Internet company name vocabulary, a common software, hardware and operating system vocabulary, and a vulnerability type vocabulary.

Images