Training method and extraction method of network model of network security entities and relations

Abstract

The present invention discloses a training method and extraction method of a network model of network security entities and relationships, which obtains sample data including multiple sentence samples and adds training labels to each sentence sample; uses each element in a target sequence set to train a first classifier to determine the entity category features of each element through the first classifier; constructs a candidate entity pair set based on each entity of the sentence sample; fuses the entity category features of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context features of the entity pair to determine the fusion features of the candidate entity pair; uses the fusion features of the candidate entity pair to train a second classifier to output the relationship classification of the entity pair using the second classifier; and jointly adjusts the parameters of the first classifier and the second classifier to complete the training. The method disclosed in the present invention recognizes entities while realizing automatic extraction of relationships between entities, and has low complexity.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a training method and an extraction method for a network model of network security entities and relationships. Background Art

[0002] APT attacks are a serious threat to the current network field, and the ability to respond to APT attacks is an important guarantee for network security. At present, the common method of building APT organization portraits is to analyze and collect APT organization information and APT organization behavior to generate APT organization labels. This method is inefficient and has low data structure, making it difficult to deal with current complex network attacks. There is an urgent need for a refined data usage method to facilitate the use of threat intelligence data to achieve the ability to respond to APT attacks efficiently in network security. With the development of natural language processing technology, named entity recognition (NER) and relation extraction (RE) have become very important in the field of network security. It helps researchers extract network threat information from unstructured text sources. The extracted network entities or key expressions can be used to model network attacks described in open source texts.

[0003] The existing solution is to identify named entities from text datasets, pre-train a character-level model based on the word2vec model using massive data, use the word2vec model to obtain low-dimensional vectors of character sequences, participate in the training of the Bi-LSTM and CRF combination model, and use the trained Bi-LSTM and CRF combination model for entity recognition. For relationship extraction, use the trained word2vec model, input the entities identified in the previous NER step, obtain the vector expression corresponding to the entity, concatenate the entity pair vectors, and finally use the fully connected layer to classify the relationship. However, the problem is that the robustness of the model using the word2vec model for character-level embedding expression is lower than that of the language model pre-trained using the transformer structure; using CRF as the classification layer cannot solve the problem of entity nesting; relationship extraction does not consider contextual issues and the generalization ability is too weak. Summary of the invention

[0004] The embodiment of the present invention provides a training method and an extraction method for a network model of network security entities and relationships, which determines entity category features through a first classifier and fuses entity category features and context features to complete the relationship classification between entity pairs.

[0005] An embodiment of the present invention provides a training method for extracting a network model of network security entities and relationships, comprising: obtaining sample data including multiple sentence samples, and adding training labels to each sentence sample; sampling each entity of the sentence sample in the sample data with the training labels added to obtain a target sequence set; using each element in the target sequence set to train a first classifier to determine the entity category feature of each element through the first classifier; constructing a candidate entity pair set based on each entity of the sentence sample; fusing the entity category feature of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context feature of the entity pair to determine the fusion feature of the candidate entity pair; using the fusion feature of the candidate entity pair to train a second classifier to output the relationship classification of the entity pair using the second classifier; and jointly adjusting the parameters of the first classifier and the second classifier to complete the training.

[0006] In some embodiments, sampling each entity of the sentence sample to obtain a target sample set includes:

[0007] Enumerate each entity of the sentence sample as a first sample set; and

[0008] Setting a sliding window, sampling based on each entity boundary of the sentence sample as a second sample set;

[0009] Selecting elements that do not belong to the sentence sample and do not belong to the second sample set from the first sample set as a third sample set;

[0010] A subset is extracted from the third sample set, and a union of the subset and the second sample set is used as the target sequence set.

[0011] In some embodiments, the size of the sliding window is set to the number of entities in the sentence sample.

[0012] In some embodiments, the training of the first classifier based on each element in the target sequence set is implemented by encoding based on a pre-trained language model.

[0013] In some embodiments, encoding based on a pre-trained language model includes:

[0014] Using the target sequence set of the sentence sample as the input sequence of the language model, and using the language model to insert a first identifier at a specified position of the input sequence to associate context information of the sentence sample; and

[0015] The language model is used to output a feature vector of each element in the target sequence set to complete encoding.

[0016] In some embodiments, constructing a candidate entity pair set based on each entity of the sentence sample is achieved by extracting a plurality of entity pairs based on the first sample set.

[0017] In some embodiments, the fusion feature of the candidate entity pair is determined based on the entity category feature of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context feature of the entity pair, including:

[0018] For the candidate entity pair, extract the feature vector of the candidate entity pair using maximum pooling;

[0019] Adding the feature vector of the candidate entity pair to the entity category feature of the candidate entity pair and calculating the average value to obtain a fused sub-feature of the entity pair;

[0020] The fused sub-features of the entity pair are concatenated with the context features of the entity pair to obtain the fused features of the candidate entity pair.

[0021] In some embodiments, jointly adjusting parameters of the first classifier and the second classifier to complete the training includes:

[0022] The sum of the loss of the first classifier and the loss of the second classifier is used as the target loss, and the parameters are adjusted to the optimal value during the training process; and

[0023] The parameters of the language model are adjusted during the training process.

[0024] The embodiments of the present disclosure also propose a method for extracting network security entities and relationships, which includes a first classifier and a second classifier trained by the training method described in each embodiment of the present disclosure, and includes the following steps: obtaining text data to be detected; encoding the text data to be detected, and determining entity category features of the text data to be detected using the first classifier; constructing a set of candidate entity pairs based on entities of sentences in the text data to be detected; fusing entity category features of each candidate entity pair in the candidate entity pair set, feature vectors corresponding to the candidate entity, and context features of the entity pair to determine the fusion features of the candidate entity pair; and using the fusion features of the candidate entity pair, using the second classifier to output the relationship classification of the entity pair.

[0025] The disclosed embodiment further provides a device for extracting network security entities and relationships, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is called and executed by the processor, the steps of the aforementioned method for extracting network security entities and relationships are implemented.

[0026] The method disclosed herein determines entity category features by training a first classifier, fuses entity category features and context features, and then trains a second classifier to complete the classification of relationships between entity pairs. The method disclosed herein can recognize entities while automatically extracting relationships between entities, and has low complexity.

[0027] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0029] Figure 1 is a basic flow chart of the training method disclosed herein;

[0030] Figure 2 This is a sub-flow chart for obtaining a target sample set according to the present disclosure. DETAILED DESCRIPTION

[0031] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0032] The scheme disclosed in the present invention is used to identify and classify entities and nested entities that are likely to exist in entities. An attack method description entity may include some APT organizations, malware, vulnerabilities, etc., and these entities may also include entities of different spans. In actual detection, entities of different spans need to be identified. For example, the sequence [sea, lotus, flower] is mapped to the span, with the following situations: "sea", "sea lotus", "lotus", "sea lotus". It is necessary to identify the entity type and non-entity type in the span during detection and classify the entity pairs of entity types by relationship.

[0033] Based on this, an embodiment of the present invention provides a training method for extracting a network model of network security entities and relationships, such as Figure 1 As shown, the following steps are included:

[0034] In step S101, sample data including multiple sentence samples is obtained, and training labels are added to each sentence sample. Specifically, security-related articles can be crawled from various sources on the Internet, such as security technology blogs; security incident articles published by major network security companies; APT incident reports; WeChat public account tweets related to security incidents, etc.

[0035] The collected data includes text data and PDF data, and the PDF data needs to be converted into text data. First, extract the images contained in the PDF file, and then use OCR technology to identify the text content in the image. Then use the pdf2text tool to convert the PDF file into text data, and finally summarize the results of OCR recognition and the results of pdf2text conversion. Since entity recognition and relationship extraction are based on sentences, the text data is segmented into sentences, thereby obtaining sample data including multiple sentence samples, and then adding labels to each sentence sample.

[0036] In step S102, each entity of the sentence sample in the sample data with training labels added is sampled to obtain a target sequence set. Since it is necessary to identify entities containing spans in the sentence sample, the solution disclosed in the present invention determines the target sequence set by sampling, so that the target sequence set includes multiple sequences that can be used as inputs to the first classifier, and the entity sequences have corresponding labels.

[0037] In step S103, the first classifier is trained using each element in the target sequence set to determine the entity category features of each element through the first classifier. In a specific training process, each element in the target sequence set may be encoded first, and the features of each span obtained after encoding are used to train the first classifier. For example, the first classifier may include a maximum pooling layer and a fully connected layer, and the vector of each span may be extracted through the maximum pooling layer, and then entity classification is performed through the fully connected layer to determine the entity category features of each element.

[0038] In step S104, a candidate entity pair set is constructed based on each entity of the sentence sample. That is, after obtaining the entity category features, the relationship between entity pairs with spans is further determined, and the candidate entity pair set can be constructed based on each entity of the sentence sample.

[0039] In step S105, the entity category features of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context feature of the entity pair are fused to determine the fusion feature of the candidate entity pair. After the feature fusion, the feature vector corresponding to the entity pair can be obtained, so that it can be input into the second classifier to determine the relationship category between the entity pairs.

[0040] In step S106, a second classifier is trained using the fusion features of the candidate entity pair, so as to output a relationship classification of the entity pair using the second classifier.

[0041] In step S107, the parameters of the first classifier and the second classifier are jointly adjusted to complete the training.

[0042] The method disclosed herein determines entity category features by training a first classifier, fuses entity category features and context features, and then trains a second classifier to complete the classification of relationships between entity pairs. The method disclosed herein can recognize entities while automatically extracting relationships between entities, and has low complexity.

[0043] In some embodiments, each entity of the sentence sample is sampled to obtain a target sample set, such as Figure 2 As shown, including:

[0044] In step S201, entities of the sentence sample are enumerated as a first sample set; and

[0045] Set a sliding window and sample based on the entity boundaries of the sentence sample as the second sample set. For example, the input sentence is represented as P = {p1, p2, p3, ..., pn}, and the labeled entity set is represented as Y = {y1, y2, y3, ..., yk}, where n is the length of the input text and k is the number of entities. Entities can be sampled in the following way: the longest segment sequence length is represented as z according to the longest entity length, and then all segment sequence sets are enumerated and represented as

[0046] In some embodiments, the size of the sliding window is set to the number of entities in the sentence sample. Specifically, all the annotated entities in a sentence sample are used for model training, and a sliding window with a size equal to the number of words in the entity is set around the entity, and a position is slid to the left and right around the entity to perform entity boundary sampling, which is represented as the first negative sample set (second sample set) as W1 = {w1, w2, w3, ..., w2k}.

[0047] In step S202, elements that do not belong to the sentence sample and the second sample set are selected from the first sample set as the third sample set. That is, all elements that do not belong to the Y set or the W1 set are selected from the S set as the second negative sample candidate set (third sample set) and are denoted as W2.

[0048] In step S203, a subset is extracted from the third sample set, and the union of the subset and the second sample set is used as the target sequence set. Then a subset W3 is randomly extracted from the second negative sample candidate set, and the size of the W3 sample set is 0<β<1, The final target sequence set is X=W1∪W3.

[0049] In some embodiments, the training of the first classifier based on each element in the target sequence set is implemented by encoding based on a pre-trained language model.

[0050] In some embodiments, encoding based on a pre-trained language model includes:

[0051] Using the target sequence set of the sentence sample as the input sequence of the language model, and using the language model to insert a first identifier at a specified position of the input sequence to associate context information of the sentence sample; and

[0052] The language model is used to output a feature vector of each element in the target sequence set to complete encoding.

[0053] Specifically, the pre-trained language model BERT can be used as its core. First, the first identifier is inserted at the first position of the input sequence. For example, the first identifier can be a special character [CLS] used to represent the context information of the entire sentence. Then, the special characters representing each entity category are inserted in sequence, and initialized to the same position vector at the same time. After BERT outputs the embedded sequence (c, t1, t2, t3, ... tm, e1, e2, e3, ..., en) with a length of n+m+1, where n is the length of the input text (number of words) and m is the number of inserted entity categories. c is the feature vector of [CLS] used to represent the context information of the entire sentence, t1, t2, ... tm represent the feature vectors of the entity category respectively, and e1, e2, e3, ..., en represent the feature vectors of the word respectively. Thus, the entities of the span in the input sequence can be identified by the first classifier. For example, the input sequence [sea, lotus, flower] is mapped to the span "sea", "sea lotus", and "sea lotus".

[0054] The following further introduces the training process of relation extraction. In some embodiments, constructing a candidate entity pair set based on each entity of the sentence sample is achieved by extracting multiple entity pairs based on the first sample set. That is, in the aforementioned enumerated fragment sequence set For example, each candidate entity pair (s1, s2) can be extracted from S*S.

[0055] In some embodiments, the fusion feature of the candidate entity pair is determined based on the entity category feature of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context feature of the entity pair, including:

[0056] For the candidate entity pair, the feature vector of the candidate entity pair is extracted by using the maximum pooling. For the candidate entity pair (s1, s2) in the candidate entity pair set, the feature vectors of the s1 and s2 entities are extracted by using the maximum pooling.

[0057] The feature vector of the candidate entity pair is added to the entity category feature of the candidate entity pair and the average is calculated to obtain the fused sub-feature of the entity pair. For example, the feature vector and the corresponding entity category feature vector can be added and averaged to obtain the fused sub-features F(s1) and F(s2) of the fused entity category.

[0058] Concatenate the fused sub-features of the entity pair with the contextual features of the entity pair to obtain the fused features of the candidate entity pair. In the aforementioned fused sub-features F(s1) and F(s2), C(s1, s2) is used to represent the contextual features of the entity pair. The contextual features are the textual features between the two entities. The contextual meaning helps the model understand the relationship between the entity pair. The span from the end of the first entity to the beginning of the second entity can be used as the context, and the contextual features can be extracted by maximum pooling. Based on the obtained contextual features of the entity pair, the entity pair relationship classification vector X=F(s1)⊕C(s1,s2)⊕F(s2) is concatenated. X is input into the second classifier for training, so that the second classifier can be used to output the relationship classification of the entity pair.

[0059] In some embodiments, jointly adjusting parameters of the first classifier and the second classifier to complete the training includes:

[0060] The sum of the loss of the first classifier and the loss of the second classifier is used as the target loss, and the parameters are adjusted to the optimal value during the training process; and

[0061] The parameters of the language model are adjusted during the training process.

[0062] The training process includes fine-tuning the BERT model and defining a joint loss function for the first classifier and the second classifier: L = Ls + Lr. Ls is the loss of the first classifier, and Lr is the loss of the second classifier. For the first classifier, it is stipulated that the added [CLS] does not participate in the loss calculation, and the added entity category special characters participate in the loss calculation, and their categories are the corresponding category IDs.

[0063] For the second classifier, you can use the labeled relations as positive samples and randomly extract several negative samples from entity pairs without relation labels. Set the number of training rounds (epoch), batch size (batch size), learning rate (lr), maximum input length (max_len), and β parameter. Both the entity classifier and the relation classifier can use the cross entropy loss function as the loss function, perform training and adjust the hyperparameters to the optimal state.

[0064] The training method disclosed in the present invention uses a pre-trained language model in combination with a defined set of relationships, inserts special characters corresponding to entity categories into the beginning of sentences to participate in the training of the NER model to obtain entity category features that are adaptive to the context, and integrates context features. This solves the problem of integrating entity category features and context features into the joint entity relationship extraction model, and improves the performance of the classifier.

[0065] The embodiments of the present disclosure also propose a method for extracting network security entities and relationships, which includes a first classifier and a second classifier trained by the training method described in each embodiment of the present disclosure, and includes the following steps: obtaining text data to be detected; encoding the text data to be detected, and determining entity category features of the text data to be detected using the first classifier; constructing a set of candidate entity pairs based on entities of sentences in the text data to be detected; fusing entity category features of each candidate entity pair in the candidate entity pair set, feature vectors corresponding to the candidate entity, and context features of the entity pair to determine the fusion features of the candidate entity pair; and using the fusion features of the candidate entity pair, using the second classifier to output the relationship classification of the entity pair.

[0066] The disclosed embodiment further provides a device for extracting network security entities and relationships, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is called and executed by the processor, the steps of the aforementioned method for extracting network security entities and relationships are implemented.

[0067] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0068] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0069] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for a terminal (which can be a mobile phone, computer, server or network equipment, etc.) to execute the methods described in each embodiment of the present invention.

[0070] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which all fall within the protection of the present invention.

Claims

1. A training method for extracting network security entities and relationships of a network model, characterized in that: include: Obtain sample data including multiple sentence samples, and add training labels to each sentence sample; Sampling each entity of the sentence sample in the sample data to which the training label is added to obtain a target sequence set; Using each element in the target sequence set, training a first classifier to determine entity category features of each element through the first classifier; Construct a set of candidate entity pairs based on each entity of the sentence sample; Based on the entity category features of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context features of the entity pair, a fusion feature of the candidate entity pair is determined; Using the fusion features of the candidate entity pair, training a second classifier, so as to output a relationship classification of the entity pair using the second classifier; jointly adjusting parameters of the first classifier and the second classifier to complete training; Each entity of the sentence sample is sampled to obtain a target sample set including: Enumerate each entity of the sentence sample as a first sample set; and Setting a sliding window, sampling based on each entity boundary of the sentence sample as a second sample set; Selecting elements that do not belong to the sentence sample and do not belong to the second sample set from the first sample set as a third sample set; A subset is extracted from the third sample set, and a union of the subset and the second sample set is used as the target sequence set.

2. The network model training method according to claim 1, characterized in that: The size of the sliding window is set to the number of entities in the sentence sample.

3. The network model training method according to claim 1, characterized in that: Based on each element in the target sequence set, training the first classifier is implemented by encoding based on a pre-trained language model.

4. The network model training method according to claim 3, characterized in that: The encoding based on the pre-trained language model includes: Using the target sequence set of the sentence sample as the input sequence of the language model, and using the language model to insert a first identifier at a specified position of the input sequence to associate context information of the sentence sample; and The language model is used to output a feature vector of each element in the target sequence set to complete encoding.

5. The network model training method according to claim 1, characterized in that: Constructing a candidate entity pair set based on each entity of the sentence sample is achieved by extracting a plurality of entity pairs based on the first sample set.

6. The network model training method according to claim 1, characterized in that: Based on the entity category features of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context features of the entity pair, the fusion features of the candidate entity pair are determined to include: For the candidate entity pair, extract the feature vector of the candidate entity pair using maximum pooling; Adding the feature vector of the candidate entity pair to the entity category feature of the candidate entity pair and calculating the average value to obtain a fused sub-feature of the entity pair; The fused sub-features of the entity pair are concatenated with the context features of the entity pair to obtain the fused features of the candidate entity pair.

7. The network model training method according to claim 4, characterized in that: Jointly adjusting parameters of the first classifier and the second classifier to complete the training includes: The sum of the loss of the first classifier and the loss of the second classifier is used as the target loss, and the parameters are adjusted to the optimal value during the training process; and The parameters of the language model are adjusted during the training process.

8. A method for extracting network security entities and relationships, characterized in that: The method comprises implementing the first classifier and the second classifier trained by the training method according to any one of claims 1 to 7, comprising the following steps: Obtain the text data to be detected; Encoding the text data to be detected, and determining entity category features of the text data to be detected using a first classifier; Construct a set of candidate entity pairs based on each entity of the sentence of the text data to be detected; Based on the entity category features of each candidate entity pair in the candidate entity pair set, the feature vector corresponding to the candidate entity, and the context features of the entity pair, a fusion feature of the candidate entity pair is determined; The fused features of the candidate entity pair are used, and the second classifier is used to output a relationship classification of the entity pair.

9. A device for extracting network security entities and relationships, characterized in that: The system comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is called and executed by the processor, the steps of the method for extracting network security entities and relationships as claimed in claim 8 are implemented.

Images