A threat intelligence information extraction method based on deep learning

Abstract

The present invention discloses a threat intelligence information extraction method based on deep learning, comprising the following steps: S1, intelligence collection: collecting APT reports, analyzing web page structures from different sources, designing web crawlers to call Request libraries to complete the collection of unstructured intelligence texts, and designing Bloom filters to achieve URL deduplication processing; S2, preprocessing: screening input data according to article length and keyword density, and using YEEDA to perform entity relationship annotation on the screened APT reports; S3, entity relationship extraction: extracting valuable entity relationship triples from preprocessed unstructured APT reports. The threat intelligence information extraction method of the present invention solves the problems of propagation errors in the current threat intelligence entity relationship extraction system and low accuracy of the model in extracting overlapping relationship entities by adjusting the deep neural network model and proposing a new sequence annotation method and entity relationship extraction rules, and at the same time provides details on the construction and preprocessing of large-scale threat intelligence data sets.

Description

Technical Field

[0001] The present invention relates to the field of filter technology, and in particular to a threat intelligence information extraction method based on deep learning. Background Art

[0002] According to the definition proposed by Gartner, an internationally authoritative IT consulting organization, threat intelligence is evidence-based knowledge about existing or emerging threats facing IT or information assets, including scenarios, mechanisms, indicators, inferences and feasible suggestions. This knowledge can provide decision-making basis for threat response. Threat intelligence can provide tactical, operational and strategic intelligence to the defender by providing standard knowledge definitions, labeled profiling technology, and scenario-based application methods, thereby effectively helping the defender to detect and manage vulnerabilities and solve the problem of information asymmetry between the attacker and the defender. From the above description, it can be seen that threat intelligence can be used as a security expert to provide feasible suggestions when users are threatened or attacked, and it has important value in intelligent defense.

[0003] In recent years, the number and complexity of cyber attacks have exploded. In order to defend against advanced persistent threats, security manufacturers monitor system and software vulnerabilities in real time and generate a large amount of warning information. However, these unstructured data lack relevance and are difficult to use directly. Therefore, obtaining effective security information from massive data has become an important issue in the field of network security. Information extraction technology, including named entity recognition, entity and relationship extraction, can effectively transform unstructured network threat intelligence into structured information to improve utilization.

[0004] Entity relationship extraction has always been a classic and challenging task. In the past two decades of research and development, many phased breakthroughs have been made. At present, the research results of entity relationship extraction are mainly applied in the fields of knowledge graph construction, automatic question-answering system, machine translation and massive text summarization. From the early relationship extraction based on pattern matching to the later relationship extraction based on machine learning, entity relationship extraction has received widespread attention. At present, as the trend of artificial intelligence based on deep learning sweeps the world, natural language processing has also made breakthrough progress. Entity relationship extraction under deep learning has effectively improved the inherent defects of traditional annotation tools, achieved good results, and has become a hot spot and key research in recent years. However, entity relationship extraction still faces many challenges, such as the complexity of entity semantic relations, the ambiguity of entity relations between sentences, the conflict between insufficient data scale and model learning ability, etc., which restrict the development of entity relationship extraction.

[0005] Compared with the successful application of information extraction in medicine, finance and general fields, the triple extraction technology in network threat intelligence is still in its infancy. Since the entities involved in the field of network security include specific categories such as attack organizations, attack methods, vulnerabilities, malware, etc., the purpose of relationship extraction is to match these specific entities related to network threat intelligence. The existing information extraction model cannot be directly applied to the extraction of entities and relationships in the field of network security.

[0006] At present, deep learning supervised entity relationship extraction for network threat intelligence can be divided into: 1) pipeline method; 2) joint learning method. Both methods are based on Convolutional Neural Network (CNN) and Long Short Term Memory Network (LSTM) for expansion and optimization, such as Figure 1 shown.

[0007] In the pipeline method, firstly, entities related to network security are obtained through named entity recognition, and then the relationship between candidate entity pairs is predicted based on the existing entity relationship. The extension based on the CNN model includes adding category ranking information, dependency analysis tree, and attention mechanism on the basis of CNN; the extension based on the LSTM model includes adding the shortest dependency path (SDP) on the basis of LSTM or combining LSTM with CNN. However, the pipeline method has problems such as error accumulation and propagation, ignoring the relationship dependency between subtasks, and generating redundant entities. The semantic relationship between entity recognition and relationship extraction is not fully utilized, which reduces the accuracy of extraction.

[0008] In the joint learning method, according to the different modeling objects, it can be divided into two sub-methods: parameter sharing and sequence labeling. The parameter sharing method uses the bidirectional long short-term memory network (Bi-directional Long Short-Term Memory, BiLSTM) and expands CNN and attention mechanism optimization; the sequence labeling method uses an end-to-end model with a new labeling strategy to solve the problem of redundant entities in the pipeline model. With the development of deep neural networks, end-to-end entity relationship joint extraction models have been widely used, but the extraction effect of overlapping relationship entities is not good. Summary of the invention

[0009] Based on this, the purpose of the present invention is to provide a threat intelligence information extraction method based on deep learning, one is to solve the problem of propagation error in the pipeline method; the other is to solve the problem of low extraction accuracy of overlapping relationship entities.

[0010] In order to achieve the above object, the present invention provides the following technical solutions:

[0011] The present invention provides a method for extracting threat intelligence information based on deep learning, comprising the following steps:

[0012] S1. Intelligence collection: Collect Advanced Persistent Threat (APT) reports, analyze web page structures from different sources, design web crawlers to call the Request library to complete the collection of unstructured intelligence text, encrypt the Uniform Resource Locator (URL) using the MD5 (Message-Digest Algorithm) information digest algorithm, generate multiple hash values ​​based on multiple hash functions and map them to the Bloom filter to complete the URL deduplication processing;

[0013] S2, preprocessing: filter the input data according to the length of the article and the density of keywords, and annotate the entity relationships of the filtered APT reports;

[0014] S3. Entity relationship extraction: Extract entity relationship triples that conform to the predetermined type from the pre-processed unstructured APT report.

[0015] Furthermore, in step S2, the input data is screened according to the article length and keyword density, and reports with a text length of less than 500 words and a keyword density of less than 0.05 are eliminated.

[0016] Furthermore, in step S2, YEDDA is used to annotate the entity relationships of the screened APT reports, where the annotation is divided into three parts, namely, entity boundaries, relationship categories, and entity roles; For entity boundaries, "BIEOS" is used to represent the position information of a word in an entity: "B" indicates that the word is at the beginning of the entity; "I" indicates that the word is in the middle of the entity; "E" indicates that the word is at the end of the entity; "S" indicates that the word is a single entity; "O" indicates that the word does not belong to any entity; Based on the CTI corpus, all entity roles are divided into seven categories, namely, attack organization (Organization, ORG), location (Location, LOC), software (Software, SW), malware (Malware, MAL), vulnerability (Vulnerability, VUL,), attack method (Attack Method, MEH), and malicious file (Malware File, MF); entity relationships are divided into six categories: comes-from, uses (uses), has-vulnerability, has-product, uses-file, and related-to.

[0017] Furthermore, the specific process of entity relationship extraction in step S3 is as follows:

[0018] S301, first preprocessing the unstructured event intelligence text;

[0019] S302, convert each word in the text into a one-dimensional vector by querying the word vector table, and input it into a deep bidirectional pre-trained language understanding model (Bidirectional Encoder Representations from Transformers, BERT) pre-trained language model, and the model output is the vector representation corresponding to each input word after integrating the semantic information of the full text;

[0020] S303: Input the word vector of the text into the Attention_BiLSTM_CRF training model, and output the globally optimal annotation sequence.

[0021] Furthermore, in the BERT pre-trained language model of step S302, the activation function is GeLU, the dimension is 768 dimensions, and the number of hidden layers is fine-tuned to 10 layers.

[0022] Furthermore, step S302 reduces the word vector from 768 dimensions to 200 dimensions by matrix mapping and inputs it into the encoding layer of the Attention_BiLSTM_CRF training model.

[0023] Furthermore, the Attention_BiLSTM_CRF training model is divided into layers (encoding layer), layers (attention layer), and layers (decoding layer).

[0024] Furthermore, the process of the BiLSTM layer is as follows: the word vector sequence obtained by the embedding layer is used as the input of the BiLSTM, the hidden state sequence output by the forward LSTM is concatenated with the hidden state sequence output by the reverse LSTM to obtain a complete hidden state sequence; then the hidden state sequence is mapped to k dimensions, where k is the number of labels in the annotation set, thereby obtaining automatically extracted features.

[0025] Furthermore, the process of the Attention layer is: calculate the similarity e between sequence elements ij , that is, the influence of word j on word i in the input sequence: the attention layer weight matrix α ij represents the attention weight of word j relative to word i in this article, and accurately captures the influence between words; then, the weighted coefficient is used to calculate the sequence h i , and obtain the sequence vector representation S t ; Finally, S t Concatenate the encoded output of the BiSLTM layer And add the activation function to perform nonlinear transformation to obtain the weight matrix W that affects the subsequent label classification t As the input of the CRF layer, the focus is achieved during model training.

[0026] Furthermore, the process of the CRF layer is: the input sequence X = (x1, x2, ..., x n ) corresponds to the label sequence y=(y1,y2,...,y n ) is used to calculate the score, and the total score of the label sequence is as follows:

[0027]

[0028] Among them, T is the transfer matrix, which represents the transfer score between labels, T i，j represents the probability of transferring from label i to label j, Represents the input sequence word x i The probability of being classified as label j.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] The threat intelligence information extraction method based on deep learning of the present invention solves the problems of propagation errors in the current threat intelligence entity relationship extraction system and low accuracy of the model in extracting overlapping relationship entities by adjusting the deep neural network model and proposing a new sequence labeling method and entity relationship extraction rule. At the same time, it provides details on the construction and preprocessing of large-scale threat intelligence data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0032] Figure 1 Extract flow charts for existing threat intelligence information;

[0033] Figure 2 A flowchart of information entity relationship extraction provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0035] The present invention provides a threat intelligence information extraction method based on deep learning, including the steps of intelligence collection, intelligence preprocessing, and entity relationship extraction.

[0036] Step 1: Intelligence gathering

[0037] The system collects relevant APT reports from Symantec, Fireeye, Threatpost and other sources. Considering that this information is embedded in the web page in the form of unstructured text information, the system analyzes the web page structure of different sources and designs a web crawler to call the Request library to complete the collection of unstructured intelligence text. Considering that there may be duplication in the text and updates from different intelligence sources, we design a Bloom filter to achieve deduplication of Uniform Resource Locator (URL). Specifically, the URL is encrypted with the MD5 (Message-Digest Algorithm) information digest algorithm, and multiple hash values ​​are generated based on a variety of hash functions and mapped to the Bloom filter to complete the deduplication of the URL.

[0038] Step 2: Intelligence preprocessing

[0039] This step performs preliminary processing on the input data. Since there are news, comments, and advertisements that are not related to cyber threat intelligence, we first filter them based on article length and keyword density:

[0040] Article length: Based on practical experience and observation, APT reports are usually longer, ranging from 600 to 3,000 words. They need to describe the specific attack events in detail, including the attack intentions and attack methods. For other texts, such as general advertisements and reviews, there are usually not so many words, ranging from 100 to 300 words, and do not involve CTI-related keywords. In order to improve the quality of threat intelligence datasets, we finally eliminated reports with text lengths less than 500 words.

[0041] Keyword density: For APT reports, it is generally believed that they contain more cybersecurity keywords, such as vulnerability numbers, hash values, or IPs. Therefore, we counted the number of keywords in each text and calculated its density, that is, the percentage of keywords in the text to the total number of words in the report. Finally, we eliminated reports with a keyword density less than 0.05.

[0042] In addition, YEDDA was used to annotate the entity relationships of the selected APT reports, where the annotation is divided into three parts, namely entity boundaries, relationship categories, and entity roles. For entity boundaries, this paper uses "BIEOS" to represent the position information of a word in an entity: "B" means that the word is at the beginning of the entity. "I" means that the word is in the middle of the entity. "E" means that the word is at the end of the entity. "S" means that the word is a single entity. "O" means that the word does not belong to any entity. Based on the CTI corpus, this paper divides all entities into seven categories, namely ORG, LOC, SW, MAL, VUL, MEH, and MF; relations are divided into six categories: comes-from, uses, has-vulnerability, has-product, uses-file, and related-to. Finally, we selected 846 APT reports and annotated 13,865 entities and 7,394 relations.

[0043] Step 3: Entity relationship extraction

[0044] This step is to extract entity relationship triples that meet the predetermined type from the pre-processed unstructured APT report, which requires the intelligence events in the unstructured intelligence text data to have complete entity relationship content and accurately identify the core expression of the attack event. The specific process is as follows Figure 2 shown.

[0045] BERT pre-trained language model: The BERT pre-trained language model is used and fine-tuned. Each word in the text is converted into a one-dimensional vector by querying the word vector table as the model input; the model output is the vector representation of each word after integrating the semantic information of the full text. Among them, the activation function is GeLU, the dimension is 768, and the number of traditional hidden layers is reduced from 12 to 10 after fine-tuning, which can reduce the training time without affecting the accuracy. In addition, due to the high dimensionality of word vectors, in order to shorten the training time and prevent overfitting, we perform dimensionality reduction processing on them. By means of matrix mapping, the 768 dimensions are reduced to 200 dimensions and input into the BiLSTM layer of the Attention_BiLSTM_CRF training model.

[0046] Attention_BiLSTM_CRF training model: The word vector of the text is used as the model input; the output is the globally optimal annotation sequence. The model is specifically divided into BiLSTM encoding layer, Attention layer and CRF decoding layer.

[0047] BiLSTM layer: This paper embeds the word vector sequence X = (x1, x2, ..., x n ) as the input of BiLSTM, and the hidden state sequence of the forward LSTM output Hidden state sequence with reverse LSTM output Splice to get the complete hidden state sequence Where m is the number of units in the hidden layer. Then the hidden state sequence is mapped to k dimensions, where k is the number of labels in the annotation set, to obtain the automatically extracted features, denoted as matrix p. ij Indicates that the word x i The score of classifying to the jth label. The calculation formula is as follows:

[0048] o t =tanh(W xo x t +W ho h t-1 +W co c t +b0)

[0049] h t =o t tanh(c t )

[0050] Among them, t Indicates the output state, c t represents the cell state, b0 represents the bias vector, W xo , W ho and W co Represent the input vector, hidden layer vector and cell weight matrix respectively. Attention layer: We first calculate the similarity between sequence elements e ij , that is, the influence of word j on word i in the input sequence:

[0051]

[0052] in, W a and U a Represents the matrix parameters s during training i-1 Represents the hidden layer state.

[0053] Attention layer weight matrix α ijrepresents the attention weight of word j relative to word i in this article and accurately captures the influence between words. It is calculated as follows:

[0054]

[0055] Then, the weighted coefficients are used to calculate the sequence h i , and obtain the sequence vector representation S t Finally, S t Concatenate the encoded output of the BiSLTM layer And add the activation function to perform nonlinear transformation to obtain the weight matrix W that affects the subsequent label classification t As the input of the CRF layer, the focus of attention is achieved during model training. The specific calculation process is as follows:

[0056]

[0057] W t =[S t ,h t ]

[0058] Among them, α ki is the probability weight of state node k to position node i.

[0059] CRF layer: This paper takes the input sequence X = (x1, x2, ..., x n ) corresponds to the label sequence y=(y1,y2,...,y n ) is used to calculate the score. The larger the score, the higher the possibility that the corresponding label is true. From the overall perspective of the label sequence y, the previous and next labels have a transfer score. The higher the score, the more likely the label transfer will occur. The total score of the label sequence is as follows:

[0060]

[0061] Among them, T is the transfer matrix, which represents the transfer score between labels, T i，j represents the probability of transferring from label i to label j. Represents the input sequence word x i The probability of being classified as label j.

[0062] Triple extraction rule matching: In order to accurately extract entity relationship triples, the output global optimal annotation sequence is matched with the following rules. The specific implementation is shown in Algorithm 1.

[0063]

[0064] Example 1

[0065] Follow these steps to build a threat intelligence entity relationship extraction model:

[0066] 1. Build a threat intelligence dataset: Build a web crawler to capture APT reports, filter irrelevant network threat intelligence based on article length and keyword density, build a high-quality threat intelligence dataset, and specify annotation strategies to implement entity relationship annotation.

[0067] 2. Data preprocessing: Use the fine-tuned BERT pre-trained language model, with GeLU as the activation function, 768 dimensions, and 10 hidden layers.

[0068] 3. Train the threat intelligence entity relationship extraction model for the processed data set.

[0069] Use the threat intelligence entity relationship extraction model to extract intelligence information:

[0070] Step 1: The data preprocessed by the BERT pre-trained language model is passed through the embedding layer to obtain the word vector after integrating the semantic information of the full text;

[0071] Step 2: The output of the embedding layer is input into the deep neural network after dimensionality reduction. The details of the deep neural network are as follows:

[0072] a. Structure: The BiLSTM layer dimension is 200 dimensions, and the attention layer dimension is 200 dimensions.

[0073] b. Learning rate: 0.001.

[0074] c. Optimizer: Adam.

[0075] d. Training algorithm: back propagation algorithm.

[0076] e. Dropout: Dropout=0.5.

[0077] Step 3: For the obtained global optimal label sequence, the matching rules mentioned in the proposed algorithm 1 are extracted to obtain entity relationship triples.

[0078] The method of the present invention solves the problems that the current threat intelligence entity relationship extraction system has propagation errors and the model has low accuracy in extracting overlapping relationship entities.

[0079] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0080] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, electronic device embodiment, computer-readable storage medium embodiment, and computer program product embodiment, since they are basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0081] The above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical specialties therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A threat intelligence information extraction method based on deep learning, characterized in that: The following steps are involved: S1. Intelligence collection: Collect APT reports, analyze web page structures from different sources, design web crawlers to call the Request library to complete the collection of unstructured intelligence text, encrypt URLs using the MD5 information digest algorithm, generate multiple hash values ​​based on multiple hash functions and map them to Bloom filters to complete URL deduplication processing; S2, preprocessing: the input data is screened according to the length of the article and the density of keywords, and the entity relationship annotation is performed on the screened APT reports; in step S2, YEDDA is used to annotate the entity relationship of the screened APT reports, where the annotation is divided into three parts, namely entity boundary, relationship category and entity role; for entity boundary, "BIEOS" is used to indicate the position information of the word in the entity: "B" indicates that the word is at the beginning of the entity; "I" indicates that the word is in the middle of the entity; "E" indicates that the word is at the end of the entity; "S" indicates that the word is a single entity; "O" indicates that the word does not belong to any entity; based on the CTI corpus, all entity roles are divided into seven categories, namely ORG, LOC, SW, MAL, VUL, MEH and MF; entity relationships are divided into six categories: comes-from, uses, has-vulnerability, has-product, uses-file and related-to; S3, entity relationship extraction: extract entity relationship triples that meet the predetermined type from the pre-processed unstructured APT report; the specific process of entity relationship extraction in step S3 is: S301, first preprocessing the unstructured event intelligence text; S302, convert each word in the text into a one-dimensional vector by querying the word vector table, and input it into the BERT pre-trained language model, and the model output is the vector representation corresponding to each input word after integrating the semantic information of the full text; S303: Input the word vector of the text into the Attention_BiLSTM_CRF training model, and output the globally optimal annotation sequence.

2. The method for extracting threat intelligence information based on deep learning according to claim 1, characterized in that: In step S2, the input data is screened according to the article length and keyword density, and reports with a text length of less than 500 words and a keyword density of less than 0.05 are eliminated.

3. The method for extracting threat intelligence information based on deep learning according to claim 1, characterized in that: In the BERT pre-trained language model of step S302, the activation function is GeLU, the dimension is 768 dimensions, and the number of hidden layers is 10.

4. The method for extracting threat intelligence information based on deep learning according to claim 1, characterized in that: In step S302, the word vector is reduced from 768 dimensions to 200 dimensions through matrix mapping and input into the BiLSTM layer of the Attention_BiLSTM_CRF training model.

5. The method for extracting threat intelligence information based on deep learning according to claim 1, characterized in that: The Attention_BiLSTM_CRF training model is divided into BiLSTM layer, Attention layer and CRF layer.

6. The method for extracting threat intelligence information based on deep learning according to claim 5, characterized in that: The process of the BiLSTM layer is as follows: the word vector sequence obtained by the embedding layer is used as the input of the BiLSTM, the hidden state sequence output by the forward LSTM is concatenated with the hidden state sequence output by the reverse LSTM to obtain a complete hidden state sequence; then the hidden state sequence is mapped to k dimensions, where k is the number of labels in the annotation set, to obtain automatically extracted features.

7. The method for extracting threat intelligence information based on deep learning according to claim 6, characterized in that: The process of the Attention layer is: calculate the similarity between sequence elements e ij , that is, the influence of word j on word i in the input sequence: the attention layer weight matrix α ij represents the attention weight of word j relative to word i in this article and accurately captures the influence between words; Then, the weighted coefficients are used to calculate the sequence h i , and obtain the sequence vector representation S t ; Finally, S t Concatenate the encoded output of the BiLSTM layer And add the activation function to perform nonlinear transformation to obtain the weight matrix W that affects the subsequent label classification t As the input of the CRF layer, the focus is achieved during model training.

8. The method for extracting threat intelligence information based on deep learning according to claim 7, characterized in that: The process of the CRF layer is: the input sequence X = (x1, x2, ..., x n ) corresponds to the label sequence y=(y1,y2,…,y n ) is used to calculate the score, and the total score of the label sequence is as follows: Among them, T is the transfer matrix, which represents the transfer score between labels, T i,j represents the probability of transferring from label i to label j, Represents the input sequence word x i The probability of being classified as label j.

Images