A vulnerability event extraction method and system based on a BERT question and answer model

Abstract

The application discloses a vulnerability event extraction method based on a BERT question and answer model, takes a vulnerability as an event containing a process, extracts dynamic event information from a vulnerability description text, applies a BIOFR labeling method, provides a labeling method basis for determining extraction content by using a sentence structure, simultaneously uses the characteristics that a vulnerability event trigger word and a vulnerability event element have correlation, establishes a question template based on a vulnerability event trigger word category, uses a target vulnerability event trigger word to guide extraction of a target vulnerability event element, improves the accuracy of target vulnerability event element extraction, finally provides an auxiliary role for vulnerability analysis, and the application correspondingly provides a vulnerability event extraction system based on the BERT question and answer model.

Description

Technical Field

[0001] This invention relates to the field of software security, and in particular to a method and system for extracting vulnerability events based on the BERT question-answering model. Background Technology

[0002] Today, software security is becoming an emerging global challenge, and vulnerability analysis is an important part of addressing software security threats.

[0003] Public security databases such as the CVE and NVD vulnerability databases store a vast amount of reports on known vulnerabilities. Security companies and administrators rely on information from these reports to prioritize tasks for developing and deploying patches for their clients. The textual vulnerability descriptions in these reports contain a wealth of valuable information, forming the basis of vulnerability analysis. With the ever-increasing number and threat levels of vulnerabilities, manual analysis of known vulnerabilities has become extremely challenging, requiring analysts with extensive knowledge and experience. Therefore, it is crucial to automatically extract information from vulnerability descriptions to facilitate vulnerability analysis and security-related research, such as supporting vulnerability classification, severity assessment, and vulnerability relationship identification.

[0004] Most existing vulnerability information extraction methods focus on static information, i.e., information in noun form. For example, "Information Extraction of Cybersecurity Concepts: An LSTM Approach" proposes a domain-independent LSTM-CRF model to extract information from the textual descriptions of cybersecurity vulnerabilities, thus simplifying the corpus training process and achieving higher accuracy. Another example is "CyberRel: Joint Entity and Relation Extraction for Cybersecurity Concepts," which proposes a joint entity and relation extraction model for cybersecurity concepts. This model models the joint extraction problem as a multi-sequence labeling problem and generates separate label sequences for different relations. While these models extract static entities of vulnerabilities, they neglect the dynamic information in the vulnerability description text, making it difficult to accurately assist in vulnerability analysis and diagnosis. Secondly, since pre-trained language models can learn general language representations using a large amount of unlabeled data, using them for feature learning is usually a significant improvement over traditional neural network feature learning methods. Therefore, some works have begun to use pre-trained methods to identify events. For example, "Event Extraction as Machine Reading Comprehension" uses a BERT pre-trained model for sentence representation learning and extracts event trigger words based on reading comprehension tasks, and uses a logistic regression model to classify events. However, this method is a general event extraction method and does not take into account the sentence features of the vulnerability domain, which leads to limitations when using this method for vulnerability event identification. Summary of the Invention

[0005] Purpose of the invention: The purpose of this invention is to provide a vulnerability event extraction method based on the BERT question-answering model, which clarifies the event information in vulnerability text and assists developers in vulnerability analysis and diagnosis.

[0006] Technical Solution: This invention provides a vulnerability event extraction method based on the BERT question-answering model, comprising the following steps:

[0007] 1) Based on the CVE-ID, crawl the description text of vulnerability reports from the vulnerability database and construct a vulnerability dataset. The description text of the vulnerability reports consists of vulnerability event elements.

[0008] 2) The cause of the vulnerability is used as the vulnerability event trigger word. The BIOFR annotation method is used to classify the vulnerability event trigger words and annotate the vulnerability event elements. The elements of each vulnerability event are obtained to form a vulnerability event element annotation dataset.

[0009] 3) Train the named entity recognition model BERT+BiLSTM+CRF on the vulnerability event element annotation dataset to extract the target vulnerability event trigger words;

[0010] 4) Connect the target vulnerability event trigger words with the description text of the vulnerability report, and use the SoftMax classifier to classify the target vulnerability event trigger words to obtain the vulnerability event trigger word category;

[0011] 5) The problem of constructing a BERT question-answering model by utilizing the trigger word categories of vulnerability events, and using the BERT question-answering model to extract target vulnerability event elements.

[0012] Furthermore, in step 1), multiple different vulnerability databases are included. These databases contain different vulnerability descriptions that complement each other, ensuring the completeness of the vulnerability event elements. Based on the CVE-ID, the descriptive text of the vulnerability report is crawled from two of the multiple different vulnerability databases to construct a vulnerability dataset.

[0013] Furthermore, step 2) includes the following steps:

[0014] 2.1) Use the words in the description text of the vulnerability report that indicate the cause of the vulnerability as vulnerability event trigger words, and use the BIOFR annotation method to annotate the vulnerability event trigger words. The BIOFR annotation method represents Begin, Inside, Outside, Front, and Rear, respectively.

[0015] 2.2) Vulnerability event elements include Trigger Operation, Location, Attacker, Version, Consequence, and Situation. Vulnerability event elements are manually labeled to obtain each element of each vulnerability event, ultimately forming a vulnerability event element labeled dataset.

[0016] Furthermore, in step 3), the sequence of the BERT model is trained using the vulnerability event element annotation dataset for the annotation task. The trained BERT model is then connected to the BiLSTM layer and the CRF layer to extract the target vulnerability event trigger words. The BERT model is used to generate a pre-trained model for word embeddings, the BiLSTM layer is used to extract features of word context, and the CRF layer is used to add constraints to the final predicted label to make the predicted label legal.

[0017] Furthermore, in step 4), the SoftMax classifier is used to classify the target vulnerability event trigger words to obtain the vulnerability event trigger word categories. In multinomial logistic regression and linear discriminant analysis, the input of the SoftMax function is the result obtained from K different linear functions. The probability that the sample vector x belongs to the j-th category is as follows:

[0018]

[0019] Where y represents a category, and x is a sample vector. T Let W be the transpose of the sample vector, and W be the weight parameter. The numerator of this function maps the real output to zero to positive infinity using an exponential function. The denominator is the sum of all results and normalization. The sum of the probability values ​​of the sample vector x belonging to each category is 1. The category of the sample is selected based on the highest probability value, thereby obtaining the category of the vulnerability event trigger word.

[0020] Furthermore, step 5) includes the following steps:

[0021] 5.1) Generate questions for the BERT question-answering model using vulnerability event trigger word categories, guide the extraction of target vulnerability event elements using target vulnerability event trigger words, and design corresponding question templates based on each vulnerability event trigger word category;

[0022] 5.2) After determining the question template, the BERT question answering model is used for training to obtain the target vulnerability event elements. The designed question is set as Q, and the description of the vulnerability item is set as D. The designed question Q and the description of the vulnerability item D are converted into the input sequence of the BERT pre-trained model to calculate the vulnerability event elements. Finally, the target vulnerability event trigger words and target vulnerability event elements are the final results of vulnerability event extraction.

[0023] This invention provides a vulnerability event extraction system based on the BERT question answering model, including a vulnerability dataset module, an annotation module, a trigger word extraction module, a classification module, and an extraction module;

[0024] The vulnerability dataset module is used to crawl the description text of vulnerability reports from the vulnerability database based on CVE-ID and build a vulnerability dataset. The description text of the vulnerability report consists of vulnerability event elements.

[0025] The annotation module is used to use the cause of the vulnerability as the trigger word of the vulnerability event, use the BIOFR annotation method to classify the trigger words of the vulnerability event, and annotate the elements of the vulnerability event to obtain the elements of each vulnerability event and form a vulnerability event element annotation dataset.

[0026] The trigger word extraction module is used to train the named entity recognition model BERT+BiLSTM+CRF on the vulnerability event element labeled dataset to extract the trigger words of the target vulnerability event;

[0027] The classification module is used to connect the target vulnerability event trigger words with the description text of the vulnerability report, and uses the SoftMax classifier to classify the target vulnerability event trigger words to obtain the vulnerability event trigger word category;

[0028] The extraction module is used to construct a BERT question-answering model based on the word categories triggered by vulnerability events, and to extract target vulnerability event elements using the BERT question-answering model.

[0029] Beneficial effects: Compared with the prior art, the significant feature of this invention is that it treats vulnerabilities as events containing processes, extracts dynamic event information from vulnerability description text, applies the BIOFR annotation method to provide a basis for annotation methods to determine the extracted content using sentence structure, and utilizes the correlation between vulnerability event trigger words and vulnerability event elements to establish a problem template based on vulnerability event trigger word categories. The target vulnerability event trigger words are used to guide the extraction of target vulnerability event elements, improving the accuracy of target vulnerability event element extraction, and ultimately providing assistance for vulnerability analysis. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating the present invention;

[0031] Figure 2 This is a schematic diagram illustrating the vulnerability event CVE-2016-4078 in this invention;

[0032] Figure 3 This is a diagram illustrating the corresponding annotations for vulnerability event CVE-2016-4078 in this invention;

[0033] Figure 4 This is a schematic diagram of vulnerability event element extraction in this invention;

[0034] Figure 5 This is an example diagram of vulnerability descriptions from the NVD vulnerability database in this invention;

[0035] Figure 6 This is an example diagram of vulnerability descriptions from the IBM X-Force vulnerability database used in this invention.

[0036] Figure 7 This is an example diagram describing the vulnerability event CVE-2020-17405 in this invention;

[0037] Figure 8 This is a diagram illustrating the corresponding annotations for vulnerability event CVE-2020-17405 in this invention;

[0038] Figure 9 This is a schematic diagram of the named entity recognition model BERT+BiLSTM+CRF in this invention;

[0039] Figure 10 This is a schematic diagram of the pre-trained model BERT in this invention. Detailed Implementation

[0040] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0041] Please see Figure 1 As shown, the present invention provides a vulnerability event extraction method based on the BERT question-answering model, which includes the following steps:

[0042] 1) Based on the CVE-ID, crawl the description text of vulnerability reports from the vulnerability database and construct a vulnerability dataset. The description text of the vulnerability reports consists of vulnerability event elements.

[0043] Please see Figure 5 and Figure 6 As shown, different vulnerability databases have different vulnerability descriptions and complement each other, which makes the vulnerability event elements complete. Based on the CVE-ID, the description text of the vulnerability report is crawled from two of the multiple different vulnerability databases to construct the vulnerability dataset.

[0044] Both the NVD vulnerability database and the IBM X-Force vulnerability database contain vulnerability descriptions for each CVE, and the content of the two descriptions can complement each other. Figure 5 The CVE description for CVE-2017-3169 is missing the two vulnerability event elements: attacker and consequence. Figure 6 The corresponding descriptions in IBM X-Force Exchange were supplemented with these two missing pieces of information to make the vulnerability event elements more complete. Therefore, the description text of the reports was crawled from the two vulnerability databases based on the CVE-ID to construct the corresponding vulnerability dataset.

[0045] 2) The cause of the vulnerability is used as the vulnerability event trigger word. The BIOFR annotation method is used to classify the vulnerability event trigger words and annotate the vulnerability event elements. The elements of each vulnerability event are obtained to form a vulnerability event element annotation dataset.

[0046] 2.1) A vulnerability is a procedural event. The description text of a vulnerability report contains words indicating the cause of the vulnerability. These words are used as vulnerability event trigger words because the cause of the vulnerability is the key element that triggers the event and summarizes the entire vulnerability event. The BIOFR annotation method is used to annotate the trigger words. BIOFR annotation represents Begin, Inside, Outside, Front, and Rear, respectively. Figure 7 As shown, the vulnerability event trigger word for CVE-2020-17405 is "the lack of proper validation of user-supplied data". Figure 8 This is the corresponding annotation for the trigger word of the vulnerability event;

[0047] The tagging of the vulnerability event trigger words themselves still follows the common BIO tagging method rules, and is tagged as "B-Tri", "I-Tri", "I-Tri", "I-Tri", "I-Tri", "I-Tri", "I-Tri", "I-Tri". In addition, there are verbs, verb phrases and prepositions before and after the word to be tagged. For example, "results from" before the vulnerability event trigger word is tagged as "FB-Tri" and "FI-Tri", while "which" after the vulnerability event trigger word is tagged as "RB-Tri" and "RI-Tri". When there are commas before and after the word to be tagged, it is still necessary to observe whether the next word is a verb, verb phrase or preposition. At the same time, a special mark "[S]" is added at the beginning of the sentence. When the word to be tagged appears at the beginning of the sentence, the special mark will also be tagged accordingly.

[0048] 2.2) Vulnerability event elements include Trigger Operation, Location, Attacker, Version, Consequence, and Situation. Vulnerability event elements are manually labeled to obtain each element of each vulnerability event, and finally form a vulnerability event element labeled dataset.

[0049] After the vulnerability event trigger word annotation is completed, the vulnerability description text is manually further categorized, as shown in Table 2:

[0050] Table 2. Category of Vulnerability Event Trigger Terms

[0051]

[0052]

[0053] The vulnerability event elements are clearly defined as six roles: Trigger Operation, Location, Attacker, Version, Consequence, and Situation. The vulnerability description text is manually annotated to obtain each element of the vulnerability event, and finally a vulnerability event element annotation dataset is formed.

[0054] Please see Figure 1 and Figure 2 As shown, the description of CVE-2016-4078 identifies the triggering operation as "acrafted packet," located in "epan / dissectors / packet-capwap.c and epan / dissectors / packet-ieee80211.c," the attacker as "remote attackers," the affected versions as "Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3," and the consequence as "a denial of service." Figure 3 This is the corresponding annotation for the trigger word of the vulnerability event.

[0055] 3) Please refer to Figure 9 and Figure 10 As shown, the named entity recognition model BERT+BiLSTM+CRF is used to train the vulnerability event element annotation dataset to extract the target vulnerability event trigger words;

[0056] Using a vulnerability event element annotation dataset, the sequence of the BERT model trained is used for annotation tasks. The trained BERT model is then connected to a BiLSTM layer and a CRF layer to extract the target vulnerability event trigger words. The BERT model is used to generate a pre-trained model for word embeddings, the BiLSTM layer is used to extract features of word context, and the CRF layer is used to add constraints to the final predicted label to make the predicted label valid.

[0057] The BERT model is as follows Figure 9As shown, this is a pre-trained model used to generate word embeddings. The word embeddings have three embedding layers: token embedding, segment embeddings, and position embeddings. These embeddings are summed to obtain a representation vector. After segmenting the input sentence, two special tokens are inserted at the beginning ([CLS]) and end ([SEP]) of the segmentation result. The BiLSTM layer is used to extract word features. Compared to LSTM, it can model the contextual information of the text. Its bidirectional encoding can solve the semantic dependency problem in the text. Finally, the CRF layer adds constraints to the predicted labels to ensure they are valid. It might learn that "B-ConI-Con" is a valid sequence, but "B-Con I-Atk" is an invalid label sequence. It's important to note that the resulting annotations will include FB, FI, RB, and RI to assist in the annotation of B and I. Step 3) then takes the annotation results of B and I from the annotation results as the target vulnerability event trigger word.

[0058] 4) Connect the target vulnerability event trigger words with the description text of the vulnerability report, and use the SoftMax classifier to classify the target vulnerability event trigger words to obtain the vulnerability event trigger word category;

[0059] The SoftMax classifier is used to classify the target vulnerability event trigger words according to the categories in Table 1 to obtain the vulnerability event trigger word categories. In multinomial logistic regression and linear discriminant analysis, the input of the SoftMax function is the result obtained from K different linear functions, and the probability that the sample vector x belongs to the j-th category is given by the following function:

[0060]

[0061] Where y represents a category, and x is a sample vector. T Let W be the transpose of the sample vector, and W be the weight parameter. The numerator of this function maps the real output to zero to positive infinity using an exponential function, while the denominator is the sum of all results and normalization. The sum of the probability values ​​of the sample vector x belonging to each category is 1. The category of the sample is selected based on the highest probability value, thereby obtaining the category of the vulnerability event trigger word.

[0062] 5) Please refer to Figure 4 As shown, the question uses the trigger word categories of vulnerability events to build a BERT question answering model, and uses the BERT question answering model to extract target vulnerability event elements;

[0063] 5.1) Generate questions for the BERT question answering model using vulnerability event trigger word categories. Since vulnerability event trigger words and vulnerability event elements are related, the target vulnerability event trigger words are used to guide the extraction of target event elements. The corresponding question templates are designed according to the category of each vulnerability event. When the vulnerability event trigger word category is represented as t;

[0064] The design template for this issue is "The vulnerability is caused by something. What is its attacker / version / location / consequence / operation?". Additionally, if the vulnerability description contains missing event trigger words, the template would be "What is its attacker / version / location / consequence / operation?".

[0065] 5.2) After determining the question template, the BERT question-answering model is used for training to obtain target vulnerability event elements. The designed question is set as Q, and the description of the vulnerability item is set as D. The designed question Q and the description of the vulnerability item D are converted into the input sequence of the BERT pre-trained model.

[0066] Introduce a start vector S and an end vector E for the BERT question answering task, and calculate the probability P that the i-th word in the vulnerability description text is the starting point of the answer span. i Then, the word with the highest probability is selected as the starting point for the answer span. Next, the probability P of the answer span ending is calculated. j The word with the highest probability is selected as the end of the span. Finally, the score of the candidate answer from position i to position j is defined as S. i，j =S·T i +E·T j The maximum score answer when j≥i is used as the predicted answer, i.e. the target vulnerability event element. Finally, the target vulnerability event trigger words and target vulnerability event elements are the final results of vulnerability event extraction.

[0067] This invention also provides a vulnerability event extraction system based on the BERT question answering model, including a vulnerability dataset module, a labeling module, a trigger word extraction module, a classification module, and an extraction module;

[0068] The vulnerability dataset module is used to crawl the description text of vulnerability reports from the vulnerability database based on CVE-ID and build a vulnerability dataset. The description text of the vulnerability report consists of vulnerability event elements.

[0069] The annotation module is used to use the cause of the vulnerability as the trigger word of the vulnerability event, use the BIOFR annotation method to classify the trigger words of the vulnerability event, and annotate the elements of the vulnerability event to obtain the elements of each vulnerability event and form a vulnerability event element annotation dataset.

[0070] The trigger word extraction module is used to train the named entity recognition model BERT+BiLSTM+CRF on the vulnerability event element labeled dataset to extract the trigger words of the target vulnerability event;

[0071] The classification module is used to connect the target vulnerability event trigger words with the description text of the vulnerability report, and uses the SoftMax classifier to classify the target vulnerability event trigger words to obtain the vulnerability event trigger word category;

[0072] The extraction module is used to construct a BERT question-answering model based on the word categories triggered by vulnerability events, and to extract target vulnerability event elements using the BERT question-answering model.

Claims

1. A vulnerability event extraction method based on a BERT question and answer model, characterized in that, Comprising the following steps: 1) According to the CVE-ID, the description text of the vulnerability report composed of vulnerability event elements is crawled from the vulnerability database to build a vulnerability dataset; 2) The cause of the vulnerability is taken as the vulnerability event trigger word, and the BIOFR labeling method is used to label the vulnerability event trigger word and the vulnerability event elements to obtain each element of the vulnerability event and form a vulnerability event element labeling dataset; In the BIOFR labeling method, the labeling of the vulnerability event trigger word still follows the rules of the BIO labeling method, and in addition, the verbs before and after the word to be labeled, the verb phrases and the prepositions are additionally labeled with F and R, and the special mark "[S]" is added at the beginning of the cause of the vulnerability, and when the word to be labeled appears at the beginning of the sentence, the special mark will also be labeled accordingly; 3) The vulnerability event element labeling dataset is trained using the named entity recognition model BERT+BiLSTM+CRF to extract the target vulnerability event trigger word; 4) The target vulnerability event trigger word and the description text of the vulnerability report are connected, and the SoftMax classifier is used to classify the target vulnerability event trigger word to obtain the vulnerability event trigger word category; 5) The BERT question and answer model question is constructed using the vulnerability event trigger word category, and the BERT question and answer model is used to extract the target vulnerability event element; Specifically including: The BERT question and answer model question is generated using the vulnerability event trigger word category, and the target vulnerability event trigger word is used to guide the extraction of the target vulnerability event element, and the corresponding question template is designed according to each vulnerability event trigger word category; After determining the question template, the target vulnerability event element is obtained by training the BERT question and answer model, and the designed question is Q, the description of the vulnerability item is D, the designed question Q and the description of the vulnerability item D are converted into the input sequence of the BERT pre-training model, and the vulnerability event element is calculated, and finally, the target vulnerability event trigger word and the target vulnerability event element are obtained. The final result of the vulnerability event extraction.

2. The vulnerability event extraction method based on the BERT question and answer model according to claim 1, characterized in that, In step 1), multiple different vulnerability databases are included, and different vulnerability databases have different vulnerability descriptions and complement each other, so that the vulnerability event elements have integrity, and the description text of the vulnerability report is crawled from two of the multiple different vulnerability databases according to the CVE-ID to build a vulnerability dataset.

3. The vulnerability event extraction method based on the BERT question and answer model according to claim 1, characterized in that, Step 2) comprises the following steps: 2.1) The words representing the cause of the vulnerability in the description text of the vulnerability report are taken as the vulnerability event trigger word, and the BIOFR labeling method is used to label the vulnerability event trigger word, and the BIOFR labeling method represents Begin, Inside, Outside, Front, and Rear respectively; 2.2) The vulnerability event element has Trigger Operation, Location, Attacker, Version, Consequence and Situation, the vulnerability event element is manually labeled, each element of the vulnerability event is obtained, and finally the vulnerability event element labeling dataset is formed.

4. The vulnerability event extraction method based on the BERT question and answer model according to claim 1, characterized in that, In step 3), the sequence of the BERT model is trained for the labeling task using the vulnerability event element labeling dataset, and the trained BERT model is connected with the BiLSTM layer and the CRF layer to extract the target vulnerability event trigger word, wherein the BERT model is a pre-training model for generating word embedding, the BiLSTM layer is used to extract the features of the word context, and the CRF layer is used to add constraints to the finally predicted label to make the predicted label legal.

5. The vulnerability event extraction method based on the BERT question and answer model according to claim 1, characterized in that, In step 4), the target vulnerability event trigger words are classified by using a SoftMax classifier to obtain vulnerability event trigger word categories. In the multinomial logistic regression and linear discriminant analysis, the input of the SoftMax function is the result obtained from different linear functions, and the probability of a sample vector belonging to the th category is as follows: wherein, represents a certain category, is a sample vector, is a transpose vector of the sample vector, is a weight parameter, the numerator of the function is to map the real number output to zero to positive infinity through the exponential function, the denominator is to add all the results for normalization, and the sum of the probability values of the sample vector x belonging to each category is 1. The highest probability value is selected as the classification category of the sample, so as to obtain the category of the vulnerability event trigger word.

6. A vulnerability event extraction system based on a BERT question and answer model, characterized in that, The vulnerability dataset module, the labeling module, the trigger word extraction module, the classification module, and the extraction module are included. The vulnerability dataset module is used to crawl the description text of the vulnerability report from the vulnerability database according to the CVE-ID, and construct the vulnerability dataset, wherein the description text of the vulnerability report is composed of vulnerability event elements. The labeling module is used to take the cause of the vulnerability as the vulnerability event trigger word, label the vulnerability event trigger word by using the BIOFR labeling method, label the vulnerability event elements, obtain each element of the vulnerability event, and form the vulnerability event element labeling dataset; in the BIOFR labeling method, the labeling of the vulnerability event trigger word still follows the rules of the BIO labeling method, in addition, the verbs before and after the to-be-labeled word, the verb phrases and the prepositions are additionally labeled with F and R, and a special mark "[S]" is added at the beginning of the cause of the vulnerability, when the to-be-labeled word appears at the beginning of the sentence, the special mark will also be labeled accordingly. The trigger word extraction module is used to train the vulnerability event element labeling dataset by using the named entity recognition model BERT+BiLSTM+CRF, and extract the target vulnerability event trigger word. The classification module is used to connect the target vulnerability event trigger word and the description text of the vulnerability report, and classify the target vulnerability event trigger word by using the SoftMax classifier to obtain the vulnerability event trigger word category. The extraction module is used to construct the BERT question and answer model by using the vulnerability event trigger word category, and extract the target vulnerability event element by using the BERT question and answer model; specifically including: The BERT question and answer model is generated by using the vulnerability event trigger word category, the target vulnerability event trigger word is used to guide the extraction of the target vulnerability event element, and a corresponding question template is designed according to each vulnerability event trigger word category; After determining the question template, the target vulnerability event element is obtained by training the BERT question and answer model, the designed question is Q, the description of the vulnerability item is D, the designed question Q and the description of the vulnerability item D are converted into the input sequence of the BERT pre-training model, the vulnerability event element is calculated, and finally the target vulnerability event trigger word and the target vulnerability event element are obtained as the final result of the vulnerability event extraction.

7. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by the processor to implement the steps of the method of claims 1-5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of claims 1-5.

Images