A method for constructing a vulnerability discovery knowledge graph integrating the ATT&CK framework

Abstract

This invention discloses a method for constructing a vulnerability discovery knowledge graph integrating the ATT&CK framework. The method comprises the following steps: constructing a vulnerability discovery ontology integrating the ATT&CK framework based on a seven-step method; collecting and preprocessing unstructured vulnerability discovery text data from the network; using the constructed vulnerability discovery ontology to guide the annotation of unstructured vulnerability discovery text corpora, constructing a vulnerability discovery knowledge dataset; training network security domain word vectors using a GloVe model to map the annotated dataset into word vector representations; inputting the word vector sequences into a BiLSTM model for encoding to obtain the contextual semantic information of the input sequences; decoding the triples in the sequences using a handshake strategy; and constructing a vulnerability discovery knowledge graph using the extracted vulnerability discovery knowledge triples. This invention models the dynamic process of vulnerability discovery, establishing a bidirectional long-term dependency relationship between attacks and vulnerabilities, thus providing assistance for network security protection.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity knowledge graph construction technology, and in particular to a method for constructing a vulnerability discovery knowledge graph that integrates the ATT&CK framework. Background Technology

[0002] In recent years, the rapid development of emerging information technology industries such as artificial intelligence and cloud computing has made cyberattacks more intelligent, large-scale, covert, and frequent. In complex network environments, cybersecurity incidents are no longer isolated, whether in the temporal or spatial dimensions. Traditional vulnerability discovery techniques suffer from problems such as ambiguous attack surfaces, path explosion, difficulty in constraint solving, and over-reliance on domain experts, making them inadequate to address cybersecurity threats such as APTs and zero-day exploits.

[0003] To effectively organize and manage security vulnerabilities, various vulnerability knowledge bases have emerged, such as CVE (Common Vulnerabilities & Exposures), NVD (National Vulnerability Database), and CNNVD (China National Vulnerability Database of Information Security). Among them, CVE was established the earliest, unifying diverse vulnerability descriptions, assigning unique numbers to publicly disclosed vulnerabilities and exposures on the network, and standardizing vulnerability descriptions. Other vulnerability databases reference the CVE numbers they provide. However, the vulnerability information contained in the CVE vulnerability database is not comprehensive enough. NVD, in addition to recording vulnerability information from CVEs, provides enhanced information for each vulnerability record, such as remediation information, severity scores, and impact ratings. CNNVD, while referencing CVE numbers, assigns its own new number to each vulnerability and incorporates vulnerabilities held by small and medium-sized enterprises in China that are not included in the CVE list. These vulnerability databases vary in format but do not provide mitigation strategies to help defend against cyberattacks.

[0004] MITRE's cybersecurity risk management framework, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge), describes the attack tactics and techniques used at each stage of an attack from the attacker's perspective, creating a comprehensive list of known adversarial tactics and techniques used in cyberattacks. ATT&CK is effective because its categorized attack tactics and techniques are largely derived from real-world analysis and publicly available APT (Adversarial Threat) activities, and are continuously updated and expanded. ATT&CK provides clear action guidelines for security defenders to combat the unknown based on the known. In addition, MITRE has proposed framework models such as CWE (Common Weakness Enumeration) and CAPEC (Common Vulnerability Enumeration). CWE is another security vulnerability dictionary from MITRE, following CVE (Common Vulnerability). Compared to CVE, CWE has a broader definition. CWE is usually the source leading to CVE, or a specific software / hardware vulnerability; CVE is a vulnerability in software / hardware that has not been patched in time and can be used by attackers as a breakthrough point. CVE can be understood as an instantiation of CWE. CAPEC, the Common Attack Pattern Enumeration and Classification, provides a public classification of attack patterns. Currently, the website offers 588 common attack patterns and is continuously being improved, becoming a public standard for identifying, collecting, refining, and sharing attack patterns. While these frameworks can provide significant benefits to cybersecurity maintainers, these knowledge bases are relatively independent, information is scattered, and utilization is low.

[0005] Knowledge graphs (KG), as a highly efficient knowledge representation model, are centered on ontology and based on the RDF triple schema. KGs can rapidly process massive amounts of data and fuse multi-source heterogeneous data, enabling precise semantic retrieval and intelligent reasoning analysis. Combining knowledge graphs with vulnerability mining allows for in-depth mining and effective integration of fragmented, multi-source heterogeneous vulnerability and attack intelligence data. Through knowledge extraction, association, and representation, a cybersecurity knowledge network can be constructed, meeting the needs of cybersecurity maintainers while adhering to the evolving trends of cybersecurity knowledge.

[0006] Traditional knowledge graphs built on vulnerability databases typically divide core cybersecurity concepts into asset, vulnerability, and threat dimensions to construct a relatively general cybersecurity knowledge graph. This type of graph represents static security modeling, obtaining results through a single query of a triplet relationship. It cannot provide timely and effective mitigation strategies for specific vulnerabilities; similarly, it cannot promptly search for affected vulnerabilities and infrastructure for a particular type of attack. As cyberspace becomes increasingly complex, cyberattacks are no longer isolated cybersecurity events or simple static events; attack behaviors in cyberspace often involve multiple layers of jump pads and multi-step linked reasoning. ATT&CK, as a publicly available adversarial tactical and technical knowledge base based on observed attack vectors in the real world, can be used for assessing attack and defense capability coverage, APT intelligence analysis, threat hunting, and attack simulation. By jointly modeling with security frameworks like ATT&CK and vulnerability knowledge bases, and associating and fusing discrete vulnerability information with corresponding attack methods, multi-step joint query and reasoning scenarios between attacks and vulnerabilities can be achieved. This allows for an intuitive and concrete presentation of vulnerability-related penetration and exploitation techniques, which is of great significance for vulnerability discovery and the implementation of cybersecurity defenses. Summary of the Invention

[0007] The purpose of this invention is to provide a vulnerability discovery knowledge graph construction method that integrates the ATT&CK framework, enabling dynamic modeling of the vulnerability penetration and exploitation process from assets to vulnerabilities, from vulnerabilities to defects, and from defects to attack patterns, attack techniques, or attack tactics. This assists security personnel in discovering potential threats and taking effective measures in advance to reduce losses.

[0008] The technical solution to achieve the purpose of this invention is: a method for constructing a vulnerability discovery knowledge graph that integrates the ATT&CK framework, comprising the following steps:

[0009] Step 1: Based on the seven-step ontology construction method, ontology evaluation is introduced to construct a vulnerability discovery ontology that integrates the ATT&CK framework;

[0010] Step 2: Collect unstructured vulnerability discovery text data and preprocess it;

[0011] Step 3: Use the vulnerability discovery ontology from Step 1 to guide the annotation of unstructured vulnerability discovery text corpus and construct a vulnerability discovery knowledge dataset;

[0012] Step 4: Train word vectors for the cybersecurity domain using the GloVe model, mapping the input dataset into word vector representations;

[0013] Step 5: Input the word vector sequence into the BiLSTM model for encoding to obtain the contextual semantic information of the input sequence;

[0014] Step 6: Decode the triples in the sequence using the handshake strategy and output the results;

[0015] Step 7: Organize the extracted vulnerability discovery knowledge triples to construct a vulnerability discovery knowledge graph.

[0016] Furthermore, based on the seven-step ontology construction method described in step 1, ontology evaluation is introduced to construct a vulnerability discovery ontology that integrates the ATT&CK framework. The specific steps are as follows:

[0017] (1.1) Use ontology modeling primitives to construct a vulnerability discovery ontology model that integrates the ATT&CK framework;

[0018] (1.2) Based on the reuse of existing ontology, a conceptual system for vulnerability discovery ontology is constructed. Considering the characteristics of data in the vulnerability discovery domain, the construction of ontology attribute sets in the seven-step method is eliminated, and the construction of the vulnerability discovery ontology conceptual system only includes the set of defined classes and the set of relationships between defined classes;

[0019] (1.3) Based on the ontology evaluation system, the constructed vulnerability discovery ontology is evaluated from three levels: structure, function and usability. The ontology is examined to see if it can effectively integrate vulnerability and attack intelligence information. The ontology is adjusted and modified until it is fully applicable, thereby completing the construction of the vulnerability discovery ontology.

[0020] (1.4) Use the Protégé tool to store the constructed vulnerability discovery ontology.

[0021] Further, step 2 involves the collection and preprocessing of unstructured vulnerability discovery text data. Specifically, web crawling technology is used to collect the unstructured vulnerability discovery text data. Custom regular expressions are used to perform word segmentation preprocessing on the original text. For Chinese text, word segmentation is performed character by character; for English text, word segmentation is performed on entire words. If version numbers are present, the version number and the corresponding software name are separated into a single unit.

[0022] Furthermore, step 3 involves annotating the unstructured vulnerability discovery text corpus to construct a vulnerability discovery knowledge dataset. Specifically:

[0023] For each relation *r*, once the head and tail tokens (i.e., entity boundaries) of the subject entity *s* and the object entity *o* are determined, a triple (s, r, o) can be identified. Here, a token represents a single Chinese character or a complete word in English. Therefore, triple extraction is transformed into a head and tail token pair linking problem. Formally, given unstructured vulnerability intelligence data, triple labeling is achieved using the following five types of token pair linking strategies:

[0024] (3.1) EH-ET: Represents the start token to end token of an entity, marked as "1";

[0025] (3.2) REL-SH2OH and REL-OH2SH: For a relation r, it represents the link relationship between the subject entity start token and the object entity start token in its triple. If the subject entity sequence is before the object entity sequence, a one-way arrow from the subject head to the object head is established and marked as "1"; if the subject entity sequence is after the object entity sequence, a one-way arrow from the object head to the subject head is established and marked as "2".

[0026] (3.3) REL-ST2OT and REL-OT2ST: For a relation r, it represents the link relationship between the subject entity end token and the object entity end token in its triple. If the subject entity sequence is before the object entity sequence, a one-way arrow is established from the subject tail to the object tail and marked as "1"; if the subject entity sequence is after the object entity sequence, a one-way arrow is established from the object tail to the subject tail and marked as "2".

[0027] Furthermore, in step 4, the method for training word vectors in the cybersecurity domain using the GloVe model to map the input dataset into word vector representations is as follows:

[0028] (4.1) Construct a co-occurrence matrix X based on the corpus, where each element X in the matrix... ij This represents the number of times word i and its context word j co-occur within a context window of a specific size.

[0029] (4.2) Construct an approximate relationship between word vectors and the co-occurrence matrix:

[0030]

[0031] in, and The final word vector to be solved is b. i and These are the bias terms of the two words;

[0032] (4.3) Construct the loss function:

[0033]

[0034] f(X ij The weight function can be a piecewise function as shown below:

[0035]

[0036] Furthermore, the specific algorithm for obtaining the contextual semantic information of the input word vector sequence based on BiLSTM in step 5 is as follows:

[0037] (5.1) For the input sequence x at time t t The feature vectors obtained from training in the forward and backward LSTM models Perform row concatenation processing, and finally output the merged complete feature vector sequence.

[0038] (5.2) Assume the set of word vector labels output by the BiLSTM layer is O = (o1, o2, ..., o...). n If p is a given sentence, then the expression p can be obtained using the following formula:

[0039] W = tanh(O)

[0040] α = softmax(μ) T W)

[0041] ρ=α T

[0042] Where O∈R d*n d is the dimension of the word vector, n is the length of the input sequence, and μ is the parameter vector obtained through training.

[0043] Furthermore, the decoding algorithm for the triples in the sequence using the handshake strategy described in step 6 is as follows:

[0044] (6.1) Create a dictionary D, where D uses the entity start token as the key and a list as the value. First, decode the entity label sequence (EH-ET) to obtain all entity spans, and place entities with the same start token into the list corresponding to that token key;

[0045] (6.2) Create a set. For each relation r, decode all REL-ST2OT and REL-OT2ST tags and store them in the set S.

[0046] (6.3) For each relation r, decode all REL-SH2OH and REL-OH2SH tags, and find all entities in D that start with SH and OH. Finally, perform pairwise matching on the found entities to form entity pairs and iterate, checking whether their tails under the corresponding relation r are in set S. If they exist, a triple is successfully extracted and added to the vulnerability discovery knowledge triple result set C.

[0047] Furthermore, the vulnerability discovery knowledge triples extracted by the organization in step 7 are used to construct a vulnerability discovery knowledge graph.

[0048] Compared with existing technologies, the significant advantages of this invention are: (1) It constructs a vulnerability discovery ontology by associating the ATT&CK framework and vulnerability database, which belongs to threat modeling in dynamic scenarios and provides specific mitigation strategies for vulnerabilities to prevent network attacks; (2) It realizes the extraction of vulnerability discovery knowledge triples in Chinese scenarios. A joint extraction model of vulnerability discovery knowledge entities and relations is given. Based on the token pair link annotation strategy, the joint encoding and decoding of triples are realized, which solves the problems of error propagation and low extraction efficiency in pipeline information extraction models; on the other hand, the problem of nested entity recognition and overlapping triple extraction is solved by improving the matrix annotation framework. Attached Figure Description

[0049] Figure 1 This is a flowchart of the vulnerability discovery knowledge graph construction method that integrates the ATT&CK framework of this invention.

[0050] Figure 2 It is a pre-constructed vulnerability discovery ontology model.

[0051] Figure 3 This is a regular expression tokenization example.

[0052] Figure 4 This is an example of text sequence annotation for unstructured vulnerability discovery.

[0053] Figure 5 It is a hybrid coding model of GloVe and BiLSTM. Detailed Implementation

[0054] The present invention will now be further described with reference to the accompanying drawings.

[0055] Combination Figure 1 This invention integrates the vulnerability discovery knowledge graph construction method of the ATT&CK framework, specifically including the following steps:

[0056] The first step, based on the seven-step ontology construction method, introduces ontology evaluation to construct a vulnerability discovery ontology that integrates the ATT&CK framework. Specifically:

[0057] (1.1) Ontology modeling primitives are used to construct a vulnerability discovery ontology model that integrates the ATT&CK framework. The vulnerability discovery ontology is represented by ALVO (ATT&CK Link Vulnerability Ontology), with the four-tuple representation: ALVO = <C,R,I,A x > Where C represents a set of classes or concepts summarized and abstracted from the cybersecurity knowledge base; R represents the relationship between different classes or concepts, such as the "exploitation" relationship between ATT&CK and vulnerabilities; I represents specific instances within a class, such as man-in-the-middle attacks being an example of attack techniques; A xThis implies that, for example, if an operating system is classified as a network asset, an attacker can exploit vulnerabilities in the operating system, thereby compromising the system's security, availability, and confidentiality.

[0058] (1.2) Based on reusing existing ontology, a conceptual framework for vulnerability discovery ontology is constructed. Considering the characteristics of data in the vulnerability discovery domain, the construction of the ontology attribute set in the seven-step method is eliminated; the construction of the vulnerability discovery ontology conceptual framework only includes a set of defined classes and a set of defined relationships between classes. The constructed set of classes and relationships is shown below.

[0059] C = {Attack tactics, attack techniques, attack patterns, vulnerabilities, ...}

[0060] CWE type, CVSS, attacker, assets, attack results}

[0061] R = {adopt, utilize, include, act upon, belong to, cause, possess, exist}

[0062] (1.3) Based on the ontology evaluation system, the constructed vulnerability discovery ontology is evaluated from three levels: structure, function and usability. The ontology is examined to see if it can effectively integrate vulnerability and attack intelligence information. The ontology is adjusted and modified until it is fully applicable, thereby completing the construction of the vulnerability discovery ontology.

[0063] Structure: Ontology topology and logical attribute evaluation. The vulnerability discovery ontology, in addition to associating the ATT&CK attack model with the vulnerability database, also introduces concepts such as CWE, CAPEC, assets, attack results, and attackers. This tightly links attack behavior with vulnerabilities and attack targets, constructing a bidirectional dependency exploitation path between attacks and vulnerabilities, giving the ontology good dynamism and cohesion. The relationship set of the vulnerability discovery ontology includes dependency relationships such as part-whole relationships, inclusion relationships, attribute relationships, and exploitation relationships, giving the ontology a broad coverage of relationships.

[0064] Function: Ontology requirement matching evaluation. The vulnerability discovery ontology is based on reusing general ontology in the cybersecurity field, and incorporates the dynamic nature of vulnerability discovery by reorganizing the set of categorized concepts, thus enhancing its adaptability in the vulnerability discovery domain. All concepts in the ontology are derived from publicly available cybersecurity knowledge bases and existing ontologies, resulting in a high degree of credibility and accuracy. The ontology is entirely modeled around attack and vulnerability databases, covering attack patterns, vulnerabilities, assets, and other types that may be involved in a network attack process, demonstrating a high degree of alignment with vulnerability discovery tasks.

[0065] Usability: Evaluation of the ontology's user interactivity. The vulnerability discovery ontology's construction process is documented in detail. Users can efficiently and easily obtain relevant metadata about the vulnerability discovery ontology through descriptions, and can use this metadata to maintain and share the ontology.

[0066] In summary, a well-constructed vulnerability discovery ontology can effectively integrate vulnerability and attack intelligence information.

[0067] (1.4) Use the Protégé tool to store the constructed vulnerability discovery ontology.

[0068] The second step involves collecting unstructured vulnerability discovery text data and preprocessing it. Specifically, web crawling technology is used to collect the unstructured vulnerability discovery text data. Custom regular expressions are used to perform word segmentation preprocessing on the raw text. For Chinese text, word segmentation is performed character by character, while for English text, word segmentation is performed on whole words. If version numbers are involved, the version number and the corresponding software name are separated into a single unit.

[0069] The third step involves using the vulnerability discovery ontology constructed in the first step to guide the annotation of unstructured vulnerability discovery text corpora, thereby building a vulnerability discovery knowledge dataset. Specifically:

[0070] For each relation *r*, once the head and tail tokens (i.e., entity boundaries) of the subject entity *s* and the object entity *o* are determined, a triple (s, r, o) can be identified. Here, a token represents a single Chinese character or a complete word in English. Therefore, triple extraction is transformed into a head and tail token pair linking problem. Formally, given unstructured vulnerability intelligence data, triple labeling is achieved using the following five types of token pair linking strategies:

[0071] (3.1) EH-ET: Represents the start token to end token of an entity, marked as "1";

[0072] (3.2) REL-SH2OH and REL-OH2SH: For a relation r, it represents the link relationship between the subject entity start token and the object entity start token in its triple. If the subject entity sequence is before the object entity sequence, a one-way arrow from the subject head to the object head is established and marked as "1"; if the subject entity sequence is after the object entity sequence, a one-way arrow from the object head to the subject head is established and marked as "2".

[0073] (3.3) REL-ST2OT and REL-OT2ST: For a relation r, it represents the link relationship between the subject entity end token and the object entity end token in its triple. If the subject entity sequence is before the object entity sequence, a one-way arrow is established from the subject tail to the object tail and marked as "1"; if the subject entity sequence is after the object entity sequence, a one-way arrow is established from the object tail to the subject tail and marked as "2".

[0074] The fourth step involves training word vectors for the cybersecurity domain using the GloVe model, mapping the input dataset to word vector representations. The specific method is as follows:

[0075] (4.1) Construct a co-occurrence matrix X based on the corpus, where each element X in the matrix... ij This represents the number of times word i and its context word j co-occur within a context window of a specific size.

[0076] (4.2) Construct an approximate relationship between word vectors and the co-occurrence matrix.

[0077]

[0078] in, and The final word vector to be solved is b. i and These are the bias terms of the two words.

[0079] (4.3) Constructing the loss function

[0080]

[0081] f(X ij The weight function can be a piecewise function as shown below:

[0082]

[0083] The fifth step is to input the word vector sequence into the BiLSTM model for encoding to obtain the contextual semantic information of the input sequence; the specific algorithm is as follows:

[0084] (5.1) For the input sequence x at time t t The feature vectors obtained from training in the forward and backward LSTM models Perform row concatenation processing, and finally output the merged complete feature vector sequence.

[0085] (5.2) Assume the set of word vector labels output by the BiLSTM layer is O = (o1, o2, ..., o...). n If p is a given sentence, then the sentence representation p can be obtained using the following formula.

[0086] W = tanh(O)

[0087] α = softmax(μ) T W)

[0088] ρ=α T

[0089] Where O∈R d*nd is the dimension of the word vector, n is the length of the input sequence, and μ is the parameter vector obtained through training.

[0090] Step 6: Decode the triples in the sequence using the handshake strategy and output the results. The specific decoding algorithm is as follows:

[0091] (6.1) Create a dictionary D, where D uses the entity start token as the key and a list as the value. First, decode the entity label sequence (EH-ET) to obtain all entity spans, and place entities with the same start token into the list corresponding to that token key;

[0092] (6.2) Create a set. For each relation r, decode all REL-ST2OT and REL-OT2ST tags and store them in the set S.

[0093] (6.3) For each relation r, decode all REL-SH2OH and REL-OH2SH tags, and find all entities in D that start with SH and OH. Finally, perform pairwise matching on the found entities to form entity pairs and iterate, checking whether their tails under the corresponding relation r are in set S. If they exist, a triple is successfully extracted and added to the vulnerability discovery knowledge triple result set C.

[0094] The seventh step is to organize the extracted vulnerability discovery knowledge triples and construct a vulnerability discovery knowledge graph.

[0095] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0096] Example 1

[0097] Combination Figure 1 This invention relates to a vulnerability discovery knowledge graph construction method based on the ATT&CK framework, the steps of which are as follows:

[0098] Step 1: Building upon the seven-step ontology construction method, an evaluation mechanism is introduced to construct a vulnerability discovery ontology integrating the ATT&CK framework. The Protégé tool is then used to store the constructed vulnerability discovery ontology. The completed vulnerability discovery ontology model is attached. Figure 2 .

[0099] Step 2: Collect unstructured vulnerability discovery text data and preprocess it. Specifically, web crawling technology is used to collect unstructured vulnerability discovery text data. A custom regular expression is used to perform word segmentation preprocessing on the original text. Example of regular expression word segmentation is attached. Figure 3 .

[0100] Step 3: Using the attached Figure 2The vulnerability discovery ontology is constructed to guide the annotation of unstructured vulnerability discovery text corpora, thereby building a vulnerability discovery knowledge dataset.

[0101] Based on the five types of annotations designed above, any token is only related to the token following it in the sequence. Therefore, for text of length n, the annotation sequence length should be n*(n+1) / 2. For entities existing in the sequence, all relations can be shared, so there is only one entity annotation sequence EH-ET. Each token pair in the sequence corresponds to a matrix box that can only represent one relation. Considering that a pair of entities may have multiple relations, a separate annotation sequence needs to be created for each relation. For a joint extraction task with N relations, the number of relation annotation sequences is N. In summary, the total number of sequences that need to be annotated by this model is N+1. An annotation example is attached. Figure 4 In the diagram, purple represents the entity label sequence, red represents the link relationship between entities and the start token, and blue represents the link relationship between entities and the end token.

[0102] EH-ET: In Figure 4 The text shown contains four entities: “CVE-2022-2300”, “Microweber-1.2.19”, “Cross-site scripting vulnerability”, and “Cross-site scripting”. Therefore, the corresponding position of the entity sequence token pair is marked with “1”, as shown in the purple mark in the figure.

[0103] REL: The triple ("CVE-2022-2300", "belongs to", "cross-site scripting vulnerability") indicates that the vulnerability belongs to a certain CWE defect. In this case, the subject entity sequence precedes the object entity sequence. Therefore, for the relation "belongs to", the entity marks the starting token "CVE-2022-2300" and the position corresponding to "cross" with a red "1"; the entity marks the ending token "CVE-2022-2300" and the position corresponding to "hole" with a blue "1".

[0104] The triple ("Cross-Site Scripting", "Applies to", "CVE-2022-2300") represents an attack pattern applied to the vulnerability. In this case, the object "CVE-2022-2300" precedes the subject "Cross-Site Scripting". Therefore, for the relationship "Applies to", the entity marks the starting token "CVE-2022-2300" with a red "2" at the position corresponding to "Cross"; the entity marks the ending token "CVE-2022-2300" with a blue "2" at the position corresponding to "Subject".

[0105] The triple (“Microweber-1.2.19”, “Existence”, “CVE-2022-2300”) indicates that an asset has a vulnerability. In this case, the object entity sequence “CVE-2022-2300” precedes the subject entity sequence “Microweber-1.2.19”. Therefore, for the relation “Existence”, the positions corresponding to “CVE-2022-2300” and “Microweber-1.2.19” are marked with a red “2”.

[0106] Steps 4 and 5 involve training the original dataset using a model combining GloVe and BiLSTM to obtain contextual information about the sequences. The model structure is shown in the attached figure. Figure 5 .

[0107] Step 6: Decode the triples in the sequence using the handshake strategy and output the results.

[0108] As attached Figure 4 The decoding process for the labeled sequence is as follows.

[0109] First, the entity label sequence EH-ET in the figure is decoded to obtain four entities: “CVE-2022-2300”, “Microweber-1.2.19”, “Cross-site scripting”, and “Cross-site scripting vulnerability”. The header tokens of “Cross-site scripting” and “Cross-site scripting vulnerability” are the same and are placed in the list of dictionary D with “cross” as the key value.

[0110] Decode the sequence of all relations. First, obtain the tail link labels of the entity pairs in the relation, i.e., the blue marked parts in the figure. Label "1" represents "subject entity tail - object entity tail", and label "2" represents "object entity tail - subject entity tail". By decoding, we obtain the tail links of two entity pairs: "CVE-2022-2300, belongs to, hole" and "this, acts on, CVE-2022-2300". Place them in set S.

[0111] Iterate through all relation annotation sequences again to obtain the entity pair header link tags, i.e., the red-marked parts in the diagram. The decoding method is similar to that of the entity pair tail tags. Through decoding, we obtain three entity pair header links: "CVE-2022-2300, belongs to, across", "across, acts on, CVE-2022-2300", and "Microweber-1.2.19, exists, CVE-2022-2300". Map the obtained entity pair header tokens to the entities in dictionary D to obtain all possible sets of subject entities and object entities. Iterate through pairwise combinations and perform entity tail matching with elements in set S to obtain triples.

[0112] The result set C obtained by combining the results contains three triples: "CVE-2022-2300, belongs to, cross-site scripting vulnerability", "cross-site scripting, applies to, CVE-2022-2300", and "Microweber-1.2.19, exists, CVE-2022-2300".

[0113] Step 7: Organize the extracted vulnerability discovery knowledge triples to construct a vulnerability discovery knowledge graph.

Claims

1. A method for constructing a vulnerability discovery knowledge graph integrating the ATT&CK framework, characterized in that, Includes the following steps: Step 1: Based on the seven-step ontology construction method, ontology evaluation is introduced to construct a vulnerability discovery ontology that integrates the ATT&CK framework; Step 2: Collect unstructured vulnerability discovery text data and preprocess it; Step 3: Use the vulnerability discovery ontology from Step 1 to guide the annotation of unstructured vulnerability discovery text corpus and construct a vulnerability discovery knowledge dataset; The specific implementation of step 3 is as follows: For each relation r, once the head and tail tokens (i.e., entity boundaries) of the subject entity s and the object entity o are determined, a triple (s, r, o) can be determined; the token mentioned here represents a single Chinese character in Chinese and a complete word in English. Therefore, triple extraction is transformed into a head-and-tail token pair linking problem; In terms of format, given unstructured vulnerability intelligence data, triplet tagging is implemented using the following five types of tokens to implement the linking strategy: (3.1) EH-ET: Represents the start token to end token of an entity, marked as "1"; (3.2) REL-SH2OH and REL-OH2SH: For a relation r, it represents the link relationship between the subject entity start token and the object entity start token in its triple; if the subject entity sequence is before the object entity sequence, a one-way arrow is established from the subject head to the object head and marked as "1"; if the subject entity sequence is after the object entity sequence, a one-way arrow is established from the object head to the subject head and marked as "2". (3.3) REL-ST2OT and REL-OT2ST: For a relation r, it represents the link relationship between the subject entity end token and the object entity end token in its triple; if the subject entity sequence is before the object entity sequence, a one-way arrow is established from the subject tail to the object tail and marked as "1"; if the subject entity sequence is after the object entity sequence, a one-way arrow is established from the object tail to the subject tail and marked as "2". Step 4: Train word vectors for the cybersecurity domain using the GloVe model, mapping the input dataset into word vector representations; Step 4 describes training word vectors for the cybersecurity domain using the GloVe model, mapping the input dataset to word vector representations. The specific method is as follows: (4.1) Construct a co-occurrence matrix X based on the corpus, where each element X in the matrix... ij The number of times word i and its context word j co-occur within a context window of a predetermined size; (4.2) Construct an approximate relationship between word vectors and the co-occurrence matrix: in, and The final word vector to be solved is b. i and These are the bias terms of the two words; (4.3) Construct the loss function: f(X ij The weighting function is a piecewise function as shown below: Step 5: Input the word vector sequence into the BiLSTM model for encoding to obtain the contextual semantic information of the input sequence; Step 6: Decode the triples in the sequence using the handshake strategy and output the results; Step 7: Organize the extracted vulnerability discovery knowledge triples to construct a vulnerability discovery knowledge graph.

2. The vulnerability discovery knowledge graph construction method integrating the ATT&CK framework according to claim 1, characterized in that, The specific implementation steps of step 1 are as follows: (1.1) Use ontology modeling primitives to construct a vulnerability discovery ontology model that integrates the ATT&CK framework; ALVO is used to represent the vulnerability discovery ontology, and its four-tuple representation is: ALVO = <C,R,I,A x >; where C represents a set of classes or concepts summarized and abstracted from the cybersecurity knowledge base; R represents the relationships between different classes or concepts; I represents a specific instance in a class; A x Representing axioms; (1.2) Based on the reuse of existing ontology, construct the concept system of vulnerability discovery ontology; combined with the characteristics of vulnerability discovery domain data, cancel the construction of ontology attribute set in the seven-step method, and the construction of vulnerability discovery ontology concept system only includes the set of determined classes and the set of relationships between determined classes; the constructed set of classes and the set of relationships are shown below; C = {Attack tactics, attack techniques, attack patterns, vulnerabilities, ...} CWE type, CVSS, attacker, assets, attack results} R = {adopt, utilize, include, act upon, belong to, cause, possess, exist} (1.3) Based on the ontology evaluation system, the constructed vulnerability discovery ontology is evaluated from three levels: structure, function and usability. The ontology is examined to see if it can effectively integrate vulnerability and attack intelligence information. The ontology is adjusted and modified until it is fully applicable, thereby completing the construction of the vulnerability discovery ontology. (1.4) Use the Protégé tool to store the constructed vulnerability discovery ontology.

3. The vulnerability discovery knowledge graph construction method integrating the ATT&CK framework according to claim 1, characterized in that: In step 2, web crawling technology is used to collect unstructured vulnerability discovery text data; custom regular expressions are used to perform word segmentation preprocessing on the original text. For Chinese text, words are segmented individually, while for English text, words are segmented as whole words. If version numbers are involved, the version number and the corresponding software name are separated into a whole.

4. The vulnerability discovery knowledge graph construction method integrating the ATT&CK framework according to claim 1, characterized in that, In step 5, the contextual semantic information of the input word vector sequence is obtained based on BiLSTM. The specific method is as follows: (5.1) For the input sequence x at time t t The feature vectors obtained from training in the forward and backward LSTM models Perform row concatenation processing, and finally output the merged complete feature vector sequence. (5.2) Assume the set of word vector labels output by the BiLSTM layer is O = (o1, o2, ..., o...). n If p is a given sentence, then the expression p is obtained by the following formula: W = tanh(O) α=softmax(μ T W) p=a T Where O∈R d*n d is the dimension of the word vector, n is the length of the input sequence, and μ is the parameter vector obtained through training.

5. The vulnerability discovery knowledge graph construction method integrating the ATT&CK framework according to claim 1, characterized in that, Step 6 involves decoding the triples in the sequence using a handshake strategy. The specific decoding method is as follows: (6.1) Create a dictionary D with entity start token as key and list as value; first decode the entity label sequence EH-ET to obtain all entity spans, and place entities with the same start token into the list corresponding to the token key; (6.2) Create a set. For each relation r, decode all REL-ST2OT and REL-OT2ST tags and store them in the set S. (6.3) For each relation r, decode all REL-SH2OH and REL-OH2SH tags, and find all entities in D that start with SH and OH. Finally, perform pairwise matching on the found entities to form entity pairs and iterate. Check whether their tails under the corresponding relation r are in the set S. If they exist, a triple is successfully extracted and added to the vulnerability discovery knowledge triple result set C.

Images