Knowledge graph construction method, CWE community description method, and storage medium

Abstract

The present application relates to the technical field of network security, and particularly relates to a knowledge graph construction method, a CWE community description method and a storage medium, which aims to standardize the description of CWE community. The CWE community description method comprises the following steps: obtaining a vulnerability analysis article; constructing a knowledge graph based on the vulnerability analysis article; dividing the CWE entities in the knowledge graph into a plurality of CWE communities; determining the correspondence between the vulnerability analysis article and the CWE community according to the knowledge graph; classifying each vulnerability analysis article as a review article or a detailed description article based on a convolutional neural network; performing topic extraction on each vulnerability analysis article based on an LDA topic extraction model; and respectively standardizing the description of each CWE community according to the classification and topic of the corresponding vulnerability analysis article. The present application realizes the standardization of the description of CWE community and improves the work efficiency of network security researchers.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a knowledge graph construction method, a CWE community description method, and a storage medium. Background Technology

[0002] Currently, many open-source software programs are widely used, such as Android and Linux in the operating system field; Hadoop (a distributed system infrastructure developed by the Apache Software Foundation), Spark (Apache Spark, a fast and general-purpose computing engine designed for large-scale data processing), and Storm (a web service testing tool) in the big data field; and MySQL (a relational database management system) and Tomcat (a web server software) in the database field. Based on this, software security has received widespread attention, and an increasing number of vulnerability analysis articles are appearing on the internet. Forums such as Xianzhi Community, Freebuf (a Chinese internet security new media), Dongxi Vulnerability Community, and Dongjian Security Community gather a large number of articles analyzing vulnerability security. Some articles analyze the attack process of a specific vulnerability, some describe countermeasures for a specific vulnerability, and some provide comprehensive analysis of a component (such as the Apache Storm component) or a type of vulnerability (such as SQL injection). Effectively utilizing these articles is of great significance for vulnerability analysis and for related research and personnel.

[0003] The industry's focus in utilizing vulnerability analysis articles is on quickly locating the relevant analysis article for a specific vulnerability or type of vulnerability. This allows cybersecurity professionals or vulnerability researchers to quickly understand the vulnerability's attack process, involved components, technologies used, and appropriate mitigation measures. Currently, the industry's approach primarily utilizes predefined rules combined with keyword matching, regular expression matching, and fuzzy matching techniques to quickly locate and filter articles. Its advantages include high accuracy, intuitiveness, and ease of expanding the rule's application, such as for knowledge reasoning, information and relationship mining.

[0004] Regarding the aforementioned technologies, the inventors believe that the following drawbacks still exist: there is no standardized description of the CWE (Common Weakness Enumeration) community to which the article belongs, which affects the work efficiency of cybersecurity researchers. Summary of the Invention

[0005] To address the aforementioned problems in the prior art, this invention proposes a knowledge graph construction method, a CWE community description method, and a storage medium, providing a standardized method for describing CWE communities.

[0006] A first aspect of the present invention provides a knowledge graph construction method, the method comprising:

[0007] Entity identification is performed on the content of multiple vulnerability analysis articles to obtain article entities;

[0008] Based on the article entity, CWE entity, CAPEC (Common Attack Pattern Enumeration and Classification) entity, and CVE (Common Vulnerabilities and Exposures) entity, construct the entity list of the knowledge graph;

[0009] Based on the vulnerability names in the article, establish a mapping relationship between the article entity and the CVE entity;

[0010] Based on the CWE_ID in the CVE entity, establish a mapping relationship between the CVE entity and the CWE entity;

[0011] Based on the CWE_ID in the CAPEC entity, a mapping relationship is established between the CAPEC entity and the CWE entity, thereby completing the construction of the knowledge graph.

[0012] Preferably, the attributes of the article entity include: article title, article content, and article readability;

[0013] The CWE entity is a vulnerability in the CWE dataset, and the attributes of the CWE entity include: name and description information;

[0014] The CAPEC entity refers to a vulnerability in the CAPEC dataset. The attributes of the CAPEC entity include: name, description, attack benefits, and attack difficulty.

[0015] The CVE entity is a vulnerability in the CVE dataset. The attributes of the CVE entity include: name, attack gain vector, attack component vector, CVSS (Common Vulnerability Scoring System) score, and corresponding CWE_ID.

[0016] Preferably, the readability of the article includes: readability at the vulnerability reproduction level, readability at the vulnerability execution level, readability at the patch and mitigation level, readability at the vulnerability analysis level, and readability based on the article length.

[0017] A second aspect of the present invention provides a CWE community description method, the method comprising:

[0018] Obtain a preset number of vulnerability analysis articles;

[0019] Based on the vulnerability analysis article, a knowledge graph is constructed using the knowledge graph construction method described above;

[0020] Based on the knowledge graph, from the perspective of attack gains, the CWE entities in the knowledge graph are divided into several CWE communities;

[0021] The correspondence between the vulnerability analysis articles and the CWE community is determined based on the knowledge graph.

[0022] Based on the trained convolutional neural network, each vulnerability analysis article is classified into a review article or a detailed description article.

[0023] Based on the LDA (Latent Dirichlet Allocation) topic extraction model, topics are extracted for each vulnerability analysis article according to a preset number of topics;

[0024] Based on the classification and topic of the vulnerability analysis articles corresponding to each CWE community, a standardized description is provided for each CWE community.

[0025] Preferably, determining the correspondence between the vulnerability analysis article and the CWE community based on the knowledge graph includes:

[0026] Based on the mapping relationship between the article entity and the CVE entity in the knowledge graph, and the mapping relationship between the CVE entity and the CWE entity, the correspondence between the vulnerability analysis article and the CWE community is determined.

[0027] Preferably, the step of standardizing the description of each CWE community based on the classification and topic of the vulnerability analysis articles corresponding to each CWE community includes:

[0028] Based on the classification of the vulnerability analysis articles, the number of overview articles and detailed description articles corresponding to a certain CWE community are counted, and then the proportion of the more numerous type of articles is calculated.

[0029] Based on the extraction results, the topic of each vulnerability analysis article corresponding to this CWE community was determined;

[0030] The average keyword distribution of the CWE community is obtained by summing the keyword distributions of each vulnerability analysis article.

[0031] Sort all the keywords in the average distribution of the keywords according to their frequency of occurrence;

[0032] The top-ranking keywords, based on the stated proportions, are used to standardize the description of the CWE community.

[0033] Preferably, the convolutional neural network includes: a preprocessing module, a first sub-network, a second sub-network, a splicing layer, a first fully connected layer, a second fully connected layer, a normalization layer, and a probability output layer;

[0034] in,

[0035] The preprocessing module is used to preprocess the content and title of the article to be classified, and to obtain the word vectors of the content and the word vectors of the title of the article to be classified.

[0036] The first sub-network and the second sub-network are used to extract features from the word vectors of the content and the word vectors of the title of the article to be classified, respectively, to obtain a first feature vector and a second feature vector;

[0037] The first fully connected layer is used to perform dimensional transformation on the readability attributes of the article to be classified, so as to obtain a readability vector with the same dimensions as the first feature vector and the second feature vector;

[0038] The splicing layer is used to splice the first feature vector, the second feature vector, and the readability vector to obtain the spliced ​​feature vector;

[0039] The normalization layer is used to normalize the concatenated feature vector;

[0040] The second fully connected layer is used to fuse the normalized feature vectors;

[0041] The probability output layer is used to calculate the probability value of binary classification based on the fused result.

[0042] Preferably, the preprocessing includes: segmenting the content of the article to be classified into words, removing stop words, vectorizing and padding the length, and segmenting the title of the article to be classified into words, removing stop words and vectorizing the title, thereby obtaining the word vectors of the content and the title of the article to be classified.

[0043] The readability attributes of the articles to be classified are obtained from the knowledge graph.

[0044] Preferably, the first sub-network and the second sub-network have the same structure, both including: word embedding layer, convolutional layer and pooling layer.

[0045] In a third aspect, the present invention provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described above.

[0046] Compared with the closest prior art, the present invention has the following beneficial effects:

[0047] In constructing the knowledge graph, this invention maps the CVE and CWE entities using the CWE_ID field of the CVE entity, without describing the mapping relationship itself, thus separating CVE and CWE into two different subgraphs. Similarly, the mapping between the CAPEC and CWE entities is done using the CWE_ID in the CAPEC entity, placing CAPEC in a separate subgraph as well. Therefore, the constructed knowledge graph has lower complexity.

[0048] This invention, starting from the direction of natural language processing, utilizes convolutional neural network technology in deep learning to combine multi-dimensional features of articles (article readability attributes, article content, title, etc.), and splices and fuses these features to effectively classify vulnerability analysis articles.

[0049] This invention utilizes a modularity-based community discovery algorithm to classify CWE communities and combines the classification results of vulnerability analysis articles to provide a standardized description of CWE communities from the perspective of topic extraction. This avoids the need to manually formulate a large number of rules and effectively improves the work efficiency of cybersecurity researchers. Attached Figure Description

[0050] Figure 1 This is a schematic diagram illustrating the main steps of an embodiment of the knowledge graph construction method of the present invention;

[0051] Figure 2 This is a schematic diagram of the main steps of an embodiment of the CWE community description method of the present invention;

[0052] Figure 3 This is a schematic diagram of the structure of the convolutional neural network used for article classification in an embodiment of the present invention;

[0053] Figure 4 This is a schematic diagram of the structure of the first sub-network / second sub-network in an embodiment of the present invention. Specific Implementation

[0054] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0055] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0056] It should be noted that in the description of this invention, the terms "first" and "second" are used merely for ease of description and do not indicate or imply the relative importance of the described devices, elements, or parameters, and therefore should not be construed as limiting the invention. Furthermore, the term "and / or" in this invention merely describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0057] This invention utilizes basic language models from the field of natural language processing, combined with convolutional neural networks from deep learning, to capture contextual relationships within articles and effectively classify them. Simultaneously, it employs the topic extraction model LDA (Local Language Analysis) from natural language processing to extract topics from articles belonging to the CWE (Citizenship and Investment Organization) community, thereby providing a standardized description of the community. Here, "topic" is a combination of multiple words, while "topic term" mentioned below refers to a specific word within that topic.

[0058] Figure 1 This is a schematic diagram illustrating the main steps of an embodiment of the knowledge graph construction method of the present invention. For example... Figure 1 As shown, the knowledge graph construction method in this embodiment includes steps A10-A50:

[0059] Step A10: Perform entity recognition on the content of multiple vulnerability analysis articles to obtain article entities.

[0060] For example, at the vulnerability analysis level, entity recognition can be performed on information such as vulnerability analysis, attack conditions, vulnerability details, vulnerability testing, and attack methods; at the vulnerability execution level, entity recognition can be performed on information such as code exploitation, Proof of Concept (POC), related scripts, and exploitation tools; at the vulnerability reproduction level, entity recognition can be performed on information such as vulnerability demonstration, vulnerability environment, environment setup, environment description, and test environment; and at the mitigation level, entity recognition can be performed on information such as defense methods, patch details, defense measures, and remediation suggestions. The richer the information contained in an article at a certain level, the higher its readability at that level (minimum score 0, maximum score 10). However, the readability varies depending on the article's length. Articles of moderate length (between 3000 and 10000 words) generally have high readability (readability score 10), while readability decreases for articles longer than 10000 words or shorter than 3000 words.

[0061] In this embodiment, the main attributes of the article entity and their meanings are shown in Table 1 below: Table 1. Attributes and Meanings of the vuln_article Entity name Article Title article_content Article content word_rev The article's readability at the vulnerability reproduction level word_exp The readability of the article at the vulnerability execution level word_pat The readability of the article at the level of patches and mitigation measures word_anal The readability of the article at the vulnerability analysis level word_len Readability of article length

[0062] Here, vuln_article stands for vulnerability article, which is a vulnerability analysis article.

[0063] In this embodiment, the main attributes of the article entity include: article title, article content, and article readability. Article readability includes: readability at the vulnerability reproduction level, readability at the vulnerability execution level, readability at the patch and mitigation level, readability at the vulnerability analysis level, and readability based on article length.

[0064] Step A20: Construct the entity list of the knowledge graph based on the article entity, CWE entity, CAPEC entity, and CVE entity.

[0065] In this embodiment, the CWE entity is a vulnerability in the CWE dataset, and the attributes of the CWE entity include: name and description information, etc.; the CAPEC entity is a vulnerability in the CAPEC dataset, and the attributes of the CAPEC entity include: name, description information, attack benefit, attack difficulty, and corresponding CWE_ID, etc.; the CVE entity is a vulnerability in the CVE dataset, and the attributes of the CVE entity include: name, attack benefit vector, attack component vector, CVSS score, and corresponding CWE_ID, etc.

[0066] Step A30: Based on the vulnerability name in the article, establish a mapping relationship between the article entity and the CVE entity.

[0067] In this embodiment, the corresponding CVE vulnerability number is extracted by performing regular expression matching between the vulnerability name in the article and the vulnerability name in the CVE dataset, thereby establishing a mapping relationship between the article entity and the CVE entity.

[0068] Step A40: Based on the CWE_ID in the CVE entity, establish a mapping relationship between the CVE entity and the CWE entity.

[0069] Step A50: Based on the CWE_ID in the CAPEC entity, establish a mapping relationship between the CAPEC entity and the CWE entity, thereby completing the construction of the knowledge graph.

[0070] In this embodiment, the entities, relations, and their corresponding main attributes in the knowledge graph are shown in Table 2 below: Table 2. Entities, Relationships, and Their Corresponding Main Attributes in the Knowledge Graph

[0071] Among them, vuln_article-IntelligenceOf-CVE indicates that there is an intelligence relationship between the article entity and the CVE entity; CWE-ChildOf-CWE indicates that there is a child relationship between the two CWE entities. Other similar relationships between the two CWE entities include Requires, PeerOf, CanPrecede, CanAlsoBe, and StartsWith; CWE-UsedBy-CAPEC indicates that there is a used relationship between the CWE entity and the CAPEC entity.

[0072] The Related_Weaknesses field in the description file of a CWE entity describes the relationship between that CWE and other CWEs, for example: <weakness id="1007" name="Insufficient Visual Distinction ofHomoglyphs Presented to User" abstraction="Base" structure="Simple" status="Incomplete"> ... ... <Related_Weaknesses> <Related_Weakness Nature="ChildOf" CWE_ID="451" View_ID="1000"Ordinal="Primary" / > < / Related_Weaknesses>

[0073] As can be seen from the above field descriptions, CWE-1007 is a subclass of CWE-451, meaning there is a hierarchy (ChildOf) between the two.

[0074] In this embodiment, over 10,000 vulnerability analysis articles were selected, and the vulnerability types mentioned in each article were statistically analyzed. Then, using the attack gains described in the CAPEC standard as the base sample, entity recognition was performed on the attack gain data contained in the articles. Simultaneously, a knowledge graph was constructed using standard datasets such as CWE, CAPEC, and CVE. From the perspective of attack gains, article entities were incorporated into the knowledge graph, clarifying the information representation of the article entity (i.e., the vuln_article entity) at various levels of vulnerability (vulnerability analysis, mitigation measures, vulnerability execution, etc.).

[0075] To reduce the complexity of the knowledge graph, it was divided into two parts: the mapping relationship between CVE entities and CWE entities is mapped through the CWE_ID field of the CVE entity, instead of describing the mapping relationship between the two entities. This divides CVE and CWE into two different subgraphs.

[0076] Figure 2 This is a schematic diagram illustrating the main steps of an embodiment of the CWE community description method of the present invention. Figure 2 As shown, the CWE community description method in this embodiment includes steps B10-B70:

[0077] Step B10: Obtain a preset number of vulnerability analysis articles.

[0078] In this embodiment, the vulnerability analysis article was obtained from the Internet.

[0079] Step B20, based on vulnerability analysis articles, utilize... Figure 1 The method shown is used to construct a knowledge graph.

[0080] Step B30: Based on the knowledge graph, divide the CWE entities in the knowledge graph into several CWE communities from the perspective of attack gains. This step can specifically include steps B31-B34:

[0081] Step B31: Calculate the attack revenue generated by each CWE and the average attack revenue of each CWE.

[0082] Specifically, for each CWE, the following operations are performed: count the number of attack gains described by the "Consequence" field of all CAPECs using the CWE to obtain the total attack gains brought by the CWE, and divide the total attack gains by the number of all CAPECs using the CWE to obtain the average attack gains of the CWE.

[0083] For example, if a CWE is used by 3 CAPECs, and the attack gains described in the description files of these 3 CAPECs are 4, 5 and 3 respectively, then the total attack gains brought by this CWE are 4+5+3=12, and the average attack gain of this CWE is 12 / 3=4.

[0084] Step B32 sets the relationship weight between the two interconnected CWEs to the absolute value of the difference in the average attack gain between the two CWEs.

[0085] Step B33: Each CWE in the knowledge graph is assigned to a separate community.

[0086] Step B34 involves using a modularity-based community detection algorithm to progressively merge communities until the modularity no longer increases, resulting in the final divided CWE communities. This step can be further specified by steps B341-B342:

[0087] Step B341: For each community in the knowledge graph, try to merge the community into each of the adjacent communities in turn, and calculate the change in modularity before and after the merger. Take the largest change. If the largest change is greater than zero, merge the community into the adjacent community corresponding to the largest change. Otherwise, the community and the adjacent communities remain unchanged.

[0088] Specifically, this step may include steps (1)-(3):

[0089] (1) Take m=0, where m is the community number in the knowledge graph;

[0090] (2) Try to merge community m into each of the adjacent communities connected to it in turn, and calculate the change in modularity before and after the merger. Take the largest change. If the largest change is greater than zero, merge the community into the adjacent community corresponding to the largest change. Otherwise, the community and the adjacent communities remain unchanged.

[0091] For example, the community m has 3 adjacent communities, which are community b1, community b2 and community b3. Try to merge community m into community b1 first, and calculate the change in modularity before and after merging ∇Q1 (obtained by subtracting the modularity before merging from the modularity after merging); then try to merge community m into community b2, and calculate the change in modularity before and after merging ∇Q2; then try to merge community m into community b3, and calculate the change in modularity before and after merging ∇Q3; if ∇Q2>∇Q3>∇Q1, the maximum change ∇Q2 is selected; determine whether ∇Q2 is greater than zero, if yes, merge community m into the adjacent community b2; otherwise, community m, community b1, community b2 and community b3 all remain unchanged.

[0092] (3) m=m+1; if m<M, return to step (2), otherwise proceed to the next step.

[0093] In step B342, update the number of communities M and the community serial numbers, and then go back to step B341 to continue performing the community merging operation, until the modularity no longer increases, and the finally divided CWE communities are obtained.

[0094] In this embodiment, each CWE in the knowledge graph is regarded as a node, and the connecting line between two interconnected CWEs is regarded as an edge. The modularity Q is calculated according to the following formula (1): (1)

[0095] Wherein, M represents the number of communities in the knowledge graph, c represents the serial number of the community, represents the ratio of the sum of the weights of all edges between internal nodes of community c to the sum of the weights of all edges in the knowledge graph, represents the ratio of the sum of the weights of all edges connecting community c and external nodes to the sum of the weights of all edges in the knowledge graph.

[0096] In this embodiment, based on CWE and CAPEC entities in the knowledge graph, the relationship between CWEs is assigned a value based on the attack benefit of CAPEC, and different weight coefficients are assigned to relationships between different CWEs. Based on this, the modularity-based community detection algorithm is used to effectively perform community division on CWEs, and 19 CWE communities are divided.

[0097] In step B40, the corresponding relationship between vulnerability analysis articles and CWE communities is determined according to the knowledge graph.

[0098] Specifically, the corresponding relationship between vulnerability analysis articles and CWE communities can be determined according to the mapping relationship between article entities and CVE entities in the knowledge graph, and the mapping relationship between CVE entities and CWE entities.

[0099] Different vulnerability analysis articles correspond to different vulnerabilities (some articles may map to multiple CVEs), and each CVE can map to at most one CWE. Based on this standard, the community of CWEs can be mapped to the corresponding vuln_article entity.

[0100] Step B50: Based on the trained convolutional neural network, classify each vulnerability analysis article into a review article or a detailed description article.

[0101] Step B60: Based on the LDA topic extraction model, extract topics for each vulnerability analysis article according to the preset number of topics.

[0102] In this embodiment, the LDA topic extraction model is used to extract topics from more than 10,000 vulnerability analysis articles from the perspective of perplexity. Perplexity is an indicator used to evaluate the quality of the topic extraction model, and its calculation method is shown in formula (2): (2)

[0103] Where D represents the test set in the corpus, consisting of a total of M documents. This represents the number of words in document d. This refers to the words in document d. This refers to the words in document d. The probability of occurrence.

[0104] In this embodiment, over 10,000 vulnerability analysis articles were used. Extracting all relevant articles revealed that setting the number of topics to 5 resulted in good differentiation for each topic. Therefore, the preset number of topics in this embodiment is 5. The number of topics may need to be adjusted accordingly when the number and content of articles change.

[0105] Step B70: Based on the classification and topic of the vulnerability analysis articles corresponding to each CWE community, provide a standardized description for each CWE community.

[0106] This step may specifically include steps B71-B75:

[0107] Step B71: Based on the classification of vulnerability analysis articles, count the number of overview articles and detailed description articles corresponding to a certain CWE community, and then calculate the proportion of the category with the larger number of articles.

[0108] For example, the CWE information for one community is: Community 1: {"CWE-119", "CWE-376", "CWE-587"...}. Based on the knowledge graph, we can obtain the article information corresponding to this community, resulting in something like: Community 1: {"Article 1", "Article 2", "Article 3", "Article 4"...}. An article might appear multiple times because multiple CVE entities are extracted from it, indicating a significant contribution to the community. By examining the article classification, we can statistically analyze the article category distribution for Community 1. For example: Community 1: {"Detailed Description", "Review", "Review", "Review", "Review"...}. Suppose we find that Community 1 has a large number of review articles (700 in total) and 300 detailed description articles, then the proportion of review articles in Community 1 would be 70%.

[0109] It should be noted that because different vulnerability analysis articles correspond to different vulnerabilities (some articles may map to multiple CVE entities), and each CVE entity maps to a CWE entity, the same article may appear multiple times in a certain community (e.g., article 3 in community 1). When calculating the number of articles, the statistics should be based on the actual number of times the article appears.

[0110] Step B72: Based on the extraction results, determine the topic of each vulnerability analysis article corresponding to the CWE community.

[0111] For example, the probability of the topic of article A is [0.1, 0.1, 0.3, 0.15, 0.35]. The probability that article A is topic 1 is 0.1, the probability that it is topic 2 is 0.1, ..., the probability that it is topic 5 is 0.35. The topic 5 with the highest probability is taken as the topic of the article.

[0112] Step B73: Add up the keyword distributions of each vulnerability analysis article corresponding to the CWE community and calculate the average value to obtain the average keyword distribution of the CWE community.

[0113] Assuming topic 5 is defined as the topic of article A, then the keyword distribution of topic 5, which is also the keyword distribution of article A, would look something like this: 0.017 * "vulnerability" + 0.008 * "file" + 0.008 * "attack" + 0.006 * "user" + 0.005 * "exploitation" + 0.005 * "information" + 0.005 * "code" + 0.005 * "HTTPS" + 0.005 * "discovery" + 0.005 * "data" + ... Adding up the keyword distributions of all articles in the CWE community and then averaging them gives us the average keyword distribution for the community. Since the same article might appear multiple times in the community, the same topic might also appear multiple times; therefore, repeated topics should also be included when adding them up.

[0114] Because each community has multiple articles, and each article has a specific topic and category (overview or detailed description), for example, if each topic has 100 words, then there can be a maximum of 500 words in total. This could lead to each community using roughly the same descriptive words, with differentiation only achieved through the probability of each topic word, resulting in poor readability. Therefore, this invention also incorporates article category information into the evaluation criteria, that is, by using the method in steps B74-B75 below to extract the most frequently occurring topic words to describe the community.

[0115] Step B74: Sort all the keywords in the average distribution of the keywords according to their frequency of occurrence.

[0116] Step B75: Extract the top-ranked keywords according to the stated proportions for a standardized description of the CWE community.

[0117] For example, a standardized description in a certain CWE community is: 0.011*"function" + 0.010*"file" + 0.008*"vulnerability" + 0.007*"address" + 0.006*"code" + 0.006*"call" + 0.006*"execution" + 0.004*"exploitation" + 0.004*"object" + 0.004*"memory" + ...

[0118] Here, 0.011 represents the weight of the "function" content in this community. The extracted topics indicate that this community is related to vulnerability exploitation and primarily involves memory and file operations. Analysis of the CWEs included in this community confirms this description. For example, the community includes CWE-119 (inappropriate restrictions on operations within memory buffer boundaries), CWE-376 (temporary file issues), and CWE-587 (copying a fixed address to a pointer), etc. These CWEs are closely related to the information expressed in this topic, such as memory, file operations, and vulnerability exploitation. Therefore, the above topics effectively describe this community.

[0119] Although the steps in the above embodiments are described in the above order, those skilled in the art will understand that in order to achieve the effect of this embodiment, different steps do not need to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple variations are all within the protection scope of this invention.

[0120] Figure 3 This is a schematic diagram of the structure of a convolutional neural network used for article classification in an embodiment of the present invention. Figure 3 As shown, the convolutional neural network in this embodiment includes: a preprocessing module 10, a first sub-network 20, a second sub-network 30, a splicing layer 40, a first fully connected layer 50, a second fully connected layer 60, a normalization layer 70, and a probability output layer 80.

[0121] The preprocessing module 10 preprocesses the content and title of the article to be classified, obtaining word vectors for the content and title. The first sub-network 20 and the second sub-network 30 extract features from the word vectors of the content and title, respectively, to obtain a first feature vector and a second feature vector. The first fully connected layer 50 performs dimensional transformation on the readability attribute of the article to be classified, obtaining a readability vector with the same dimensions as the first and second feature vectors. The concatenation layer 40 concatenates the first feature vector, the second feature vector, and the readability vector to obtain a concatenated feature vector. The normalization layer 70 normalizes the concatenated feature vector. The second fully connected layer 60 fuses the normalized feature vector. The probability output layer 80 calculates the probability value for binary classification based on the fused result.

[0122] In this embodiment, the five readability attributes of article A (represented by 0 to 10 respectively) are input into the first fully connected layer 50, and the dimension is converted from 1x5 to 1x128. Then, together with the first feature vector and the second feature vector (each with 3 1x128 elements), they are fed into the concatenation layer 40 and concatenated into a vector with a dimension of 1x896.

[0123] In this embodiment, the preprocessing operations include: segmenting the content of the article to be classified into words, removing stop words, vectorizing, and padding; segmenting the title of the article to be classified into words, removing stop words, and vectorizing, thereby obtaining word vectors for the content and title of the article to be classified; the readability attributes of the article to be classified are obtained from the constructed knowledge graph.

[0124] During the training phase of the convolutional neural network, approximately 10,000 vulnerability analysis articles (including those from communities such as Prophet Community, Freebuf Community, Insight Vulnerability Community, and Insight Security Community) were collected from the internet. These articles were categorized and labeled to construct a dataset. The dataset was split into a 2:8 ratio, with 20% as the test set and 80% as the training set. Cross-validation was used, and the trained convolutional neural network achieved an accuracy of over 95%, demonstrating excellent classification performance.

[0125] Figure 4 This is a schematic diagram of the structure of the first sub-network / second sub-network in an embodiment of the present invention. The first and second sub-networks in this embodiment have the same structure, as shown below. Figure 4 As shown, it includes word embedding layers, convolutional layers, and pooling layers.

[0126] The first sub-network takes word vectors of the article content as input and outputs a first feature vector. The second sub-network takes word vectors of the article title as input and outputs a second feature vector. Because the word vectors are convolved with three kernels of different sizes in the convolutional layer, three different features are extracted. Then, pooling operations are performed on these three features respectively. Therefore, the output first or second feature vector actually contains three feature vectors.

[0127] Word embedding layer: This layer embeds word vectors generated by the language model, mapping the indexes of all word vectors to dense low-dimensional vectors. The mapping logic or rules are based on the task of the entire network (corresponding to the article classification task in this invention), so that the word vectors can better express the features.

[0128] Convolutional layer: The essence of a convolutional layer is a feature extractor. In vulnerability analysis articles, different words are related. In this embodiment, the convolutional layer captures the relationship between 3, 4, and 5 adjacent words (e.g., Figure 4 The layer is shown as Conv-3, Conv-4, and Conv-5. Its purpose is to extract different features from the input. This layer uses three filters and three kernel sizes: kernel_size represents the length and height of the convolution kernel. In this embodiment, which processes text data, a one-dimensional convolution kernel is used, with a height of 1 and three widths: 3, 4, and 5.

[0129] Pooling layer: Pooling layers can speed up computation and prevent overfitting, and effectively reduce the size of the parameter matrix, thereby reducing the number of parameters in the final connection layer. In this embodiment, MaxPooling is used, which selects the maximum value in the matrix as the output of this layer. For example, if the matrix of a channel is [1,2,3,2,1,4] and the maximum value is 4, then its output after passing through this layer is [4], which means that the richest feature captured by the pooling layer of this channel is [4].

[0130] The present invention also provides an embodiment of a computer-readable storage medium. The storage medium of this embodiment stores a computer program that can be loaded by a processor and execute the methods described above.

[0131] The computer-readable storage medium includes, for example, various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] Those skilled in the art will recognize that the method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of electronic hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the invention.

[0133] The technical solution of the present invention has now been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions resulting from these changes or substitutions will all fall within the scope of protection of the present invention.< / weakness>

Claims

1. A CWE community description method, characterized in that, The method includes: Obtain a preset number of vulnerability analysis articles; Entity identification is performed on the content of multiple vulnerability analysis articles to obtain article entities; Based on the article entity, CWE entity, CAPEC entity, and CVE entity, construct an entity list for the knowledge graph; Based on the vulnerability names in the article, establish a mapping relationship between the article entity and the CVE entity; Based on the CWE_ID in the CVE entity, establish a mapping relationship between the CVE entity and the CWE entity; Based on the CWE_ID in the CAPEC entity, a mapping relationship is established between the CAPEC entity and the CWE entity, thereby completing the construction of the knowledge graph; The attributes of the article entity include: article title, article content, and article readability. The article readability includes: readability at the vulnerability reproduction level, readability at the vulnerability execution level, readability at the patch and mitigation level, readability at the vulnerability analysis level, and readability at the article length level. Based on the knowledge graph, from the perspective of attack gains, the CWE entities in the knowledge graph are divided into several CWE communities; The correspondence between the vulnerability analysis articles and the CWE community is determined based on the knowledge graph. Based on the trained convolutional neural network, each vulnerability analysis article is classified into a review article or a detailed description article. Based on the LDA topic extraction model, topic extraction is performed on each vulnerability analysis article according to a preset number of topics; Based on the classification and topic of the vulnerability analysis articles corresponding to each CWE community, a standardized description is provided for each CWE community.

2. The method according to claim 1, characterized in that, The CWE entity is a vulnerability in the CWE dataset, and the attributes of the CWE entity include: name and description information; the CAPEC entity is a vulnerability in the CAPEC dataset, and the attributes of the CAPEC entity include: name, description information, attack benefit, attack difficulty, and corresponding CWE_ID; the CVE entity is a vulnerability in the CVE dataset, and the attributes of the CVE entity include: name, attack benefit vector, attack component vector, CVSS score, and corresponding CWE_ID.

3. The method according to claim 1, characterized in that, The step of determining the correspondence between the vulnerability analysis article and the CWE community based on the knowledge graph includes: determining the correspondence between the vulnerability analysis article and the CWE community based on the mapping relationship between the article entity and the CVE entity in the knowledge graph, and the mapping relationship between the CVE entity and the CWE entity.

4. The method according to claim 1, characterized in that, The standardization description of each CWE community based on the classification and topic of the vulnerability analysis articles includes: counting the number of review articles and detailed description articles corresponding to a certain CWE community according to the classification of vulnerability analysis articles, and then calculating the proportion of the category with more articles; determining the topic of each vulnerability analysis article corresponding to the CWE community based on the extraction results; summing the topic word distributions of each vulnerability analysis article corresponding to the CWE community and calculating the average value to obtain the average topic word distribution of the CWE community; sorting all topic words in the average topic word distribution according to their frequency of occurrence; and extracting the top-ranked topic words according to the proportion for the standardization description of the CWE community.

5. The method according to claim 1, characterized in that, The convolutional neural network includes: a preprocessing module, a first sub-network, a second sub-network, a concatenation layer, a first fully connected layer, a second fully connected layer, a normalization layer, and a probability output layer. The preprocessing module preprocesses the content and title of the article to be classified, obtaining word vectors for the content and title. The first and second sub-networks extract features from the word vectors of the content and title, respectively, to obtain a first feature vector and a second feature vector. The first fully connected layer performs dimensionality transformation on the readability attributes of the article to be classified, obtaining a readability vector with the same dimensions as the first and second feature vectors. The concatenation layer concatenates the first feature vector, the second feature vector, and the readability vector to obtain a concatenated feature vector. The normalization layer normalizes the concatenated feature vector. The second fully connected layer fuses the normalized feature vector. The probability output layer calculates the probability value for binary classification based on the fused result.

6. The method according to claim 5, characterized in that, The preprocessing includes: segmenting the content of the article to be classified into words, removing stop words, vectorizing, and padding; segmenting the title of the article to be classified into words, removing stop words, and vectorizing, thereby obtaining word vectors for the content and title of the article to be classified; the readability attributes of the article to be classified are obtained from the knowledge graph.

7. The method according to claim 5, characterized in that, The first sub-network has the same structure as the second sub-network, both including: word embedding layer, convolutional layer and pooling layer.

8. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and execute the method as described in any one of claims 1-7.

Images