Methods, equipment and media for extracting central events

Abstract

The application discloses a kind of extraction methods, equipment and medium of central event, comprising the following steps: by determining the similarity of each single sentence included in the text to be extracted with the title of the text to be extracted, the first weight of trigger word included in each single sentence and the second weight of network security entity included in each single sentence, the central sentence is determined according to the similarity, the first weight and the second weight of each single sentence, the trigger word contained in the central sentence is determined, the event type pointed by the central sentence is determined based on the trigger word, the central event is obtained by calculating the central sentence and event type through BiLSTM model and CRF model, the central sentence is determined by three dimensions, the extraction range is reduced, the interference of secondary event on the extraction of central sentence is reduced, the error existing in the mode of pipeline extraction of central event is reduced by BiLSTM model and CRF model, so as to improve the convenience and effectiveness of central event extraction task.

Description

Technical Field

[0001] This invention relates to the field of event extraction technology, and in particular to a method, device and medium for extracting central events. Background Technology

[0002] The purpose of extracting central events in existing technologies is to extract central events from input text for subsequent analysis. For example, in the field of security threat intelligence services, evidence-based knowledge of existing or potential threats to IT or information assets can be analyzed by detecting open-source threat intelligence, thereby providing a basis for threat response decisions based on this evidence-based knowledge.

[0003] However, current open-source threat intelligence data is abundant and complex, and is stored and published as unstructured text information, making it difficult to extract effective and critical central events, which is very detrimental to subsequent decision-making regarding open-source threat intelligence. Summary of the Invention

[0004] The main objective of this invention is to provide a method, apparatus, and medium for extracting central events, aiming to solve the technical problem that existing methods for extracting central events are unable to extract effective and critical central events.

[0005] To achieve the above objectives, the present invention provides a method for extracting a central event, the method comprising the following steps:

[0006] After determining the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the network security entity included in each sentence, the central sentence is determined based on the similarity, the first weight and the second weight of each sentence.

[0007] Identify the trigger words contained in the central sentence, and determine the event type pointed to by the central sentence based on the trigger words;

[0008] The central event is obtained by calculating the central sentence and the event type using the BiLSTM model and the CRF model.

[0009] Optionally, before the step of determining the similarity between each sentence included in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the cybersecurity entities included in each sentence, the method further includes:

[0010] An initial trigger word list is constructed. Based on the part of speech of each word in the initial trigger word list, a target word list consisting of target words with the part of speech of verbs and / or gerunds is obtained. The target words with the part of speech of verbs in the target word list are extracted and used as the main trigger word. Alternatively, the target words with the part of speech of gerunds in the target word list are extracted and the verb part of the target words is used as the main trigger word, and the noun part of the target words is used as the associated word. Each main trigger word corresponds to a word family.

[0011] The system receives input text to be processed, filters the text, segments the filtered text to obtain a list of words to be filtered, and then extracts words in the list of words to be filtered that are verbs and / or gerunds to form a candidate word list.

[0012] Select several candidate words from the candidate word list whose similarity to each of the main trigger words is equal to a preset similarity. Extract the candidate words whose part of speech is verb from the candidate words and add them as secondary trigger words to the word family of the main trigger word corresponding to the candidate words. And / or extract the candidate words whose part of speech is gerund from the candidate words and add the verb part of the candidate words as secondary trigger words to the word family of the main trigger word corresponding to the candidate words. Add the noun part of the candidate words as related words to the word family of the main trigger word corresponding to the candidate words.

[0013] The word families containing the secondary trigger words and the associated words are combined to obtain a trigger word dictionary.

[0014] Optionally, after the step of combining the word families containing the secondary trigger word and the associated word to obtain a trigger word dictionary, the method further includes:

[0015] The word families included in the trigger word dictionary are filtered. If any one or more word families contain a main trigger word and / or a secondary trigger word and / or a related word that does not meet the preset conditions, the target word and / or the candidate word corresponding to the main trigger word and / or the secondary trigger word and / or the related word that does not meet the preset conditions are removed.

[0016] Optionally, in the step of determining the similarity between each sentence included in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the cybersecurity entities included in each sentence, the step includes:

[0017] Each of the single sentences is encoded into a plurality of single sentence vectors, and the title is encoded into a title vector. Then, the similarity between each single sentence vector and the title vector is determined, a first ratio between the number of trigger words included in each single sentence and the number of words included in each single sentence is determined, and the first ratio is used as the first weight. Then, a second ratio between the number of cybersecurity entities included in each single sentence and the number of words included in each single sentence is determined, and the second ratio is used as the second weight.

[0018] Optionally, the step of determining the center sentence based on the similarity of each of the individual sentences, the first weight, and the second weight includes:

[0019] Based on the similarity of each sentence and the scores between the first weight and the second weight, the sentences are arranged from largest to smallest, and one or more sentences that appear at the top of the list are selected as the central sentence, wherein the total length of the central sentence does not exceed a preset length.

[0020] Optionally, before the step of determining the trigger word contained in the central sentence and determining the event type pointed to by the central sentence based on the trigger word, the method further includes:

[0021] An event type table is developed based on the ACE standard, wherein the event type table is used to determine the event type to which the head sentence points based on the trigger word.

[0022] Optionally, before the step of calculating the center sentence and the event type using the BiLSTM model and the CRF model, the method further includes:

[0023] After concatenating the central sentence and the event type to obtain the concatenated input text, the concatenated input text is segmented to obtain a word sequence;

[0024] The word sequence is encoded into several word vectors using the GloVe word vector model.

[0025] Optionally, the step of calculating the central event by using a BiLSTM model and a CRF model to calculate the central sentence and the event type includes:

[0026] The word vectors are input into the BiLSTM model to obtain several sets of prediction probability vectors;

[0027] Several sets of predicted probability vectors are input into the CRF model. The CRF model calculates the probability values ​​of the predicted label sequences corresponding to the several sets of preset probability vectors. After determining the predicted label sequence with the largest probability value as the target sequence, the central event is output based on the target sequence.

[0028] To achieve the above objectives, the present invention also provides an electronic device, which includes: a memory, a processor, and a computer processing program stored in the memory and executable on the processor. When the computer processing program is executed by the processor, it implements the steps of the above-described method for extracting central events.

[0029] Furthermore, to achieve the above objectives, the present invention also proposes a computer-readable storage medium storing a computer processing program, which, when executed by a processor, implements the steps of the above-described method for extracting central events.

[0030] In this invention, after determining the similarity between each sentence in the text to be extracted and the title of the text, the first weight of the trigger words included in each sentence, and the second weight of the network security entities included in each sentence, the central sentence is determined based on the similarity, first weight, and second weight of each sentence. By determining the central sentence through three dimensions, the extraction scope is narrowed, and the interference of secondary events on the extraction of the central sentence is reduced. The trigger words included in the central sentence are determined, and the event type pointed to by the central sentence is determined based on the trigger words, which is beneficial for the extraction of events in specific domains. The central sentence and event type are calculated by using BiLSTM and CRF models to obtain the central event, which reduces the error of the existing pipeline method for extracting central events, thereby improving the convenience and effectiveness of the central event extraction task. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of the present invention;

[0032] Figure 2 This is a flowchart illustrating an embodiment of the central event extraction method of the present invention.

[0033] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0034] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0035] like Figure 1 As shown, Figure 1 This is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of the present invention.

[0036] In this embodiment of the invention, the method for extracting mental events is applied to an electronic device, such as... Figure 1 As shown, the electronic device may include: a processor 1001, such as a CPU; a network interface 1004; a user interface 1003; a memory 1005; and a communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display area and an input unit such as a keyboard. Optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as a disk drive. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0037] Optionally, the electronic device may also include a camera, RF (Radio Frequency) circuitry, sensors, audio circuitry, a WiFi module, and so on. Sensors may include light sensors, motion sensors, and other sensors. Specifically, light sensors may include ambient light sensors and proximity sensors. The ambient light sensor can adjust the brightness of the display screen according to the ambient light level, while the proximity sensor can turn off the display screen and / or backlight when the mobile terminal is moved to the ear. As a type of motion sensor, a gravity accelerometer can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity, and can be used for applications that identify the mobile terminal's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition functions (such as pedometers, taps), etc. Of course, the mobile terminal may also be equipped with other sensors such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, which will not be elaborated here.

[0038] Those skilled in the art will understand that Figure 1 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0039] like Figure 1 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a computer processing program.

[0040] exist Figure 1In the terminal shown, network interface 1004 is mainly used to connect to the backend server and communicate data with it; user interface 1003 is mainly used to connect to the client (user terminal) and communicate data with it; while processor 1001 can be used to call the computer processing program stored in memory 1005 and perform the following operations:

[0041] After determining the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the network security entity included in each sentence, the central sentence is determined based on the similarity, the first weight and the second weight of each sentence.

[0042] Identify the trigger words contained in the central sentence, and determine the event type pointed to by the central sentence based on the trigger words;

[0043] The central event is obtained by calculating the central sentence and the event type using the BiLSTM model and the CRF model.

[0044] Furthermore, the processor 1001 can call a computer program stored in the memory 1005 and also perform the following operations:

[0045] Before the steps of determining the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the network security entities included in each sentence, an initial trigger word list is constructed. After filtering the target word list composed of target words with the part of speech of each word in the initial trigger word list, the target words with the part of speech of verbs and / or gerunds are extracted from the target word list. The target words with the part of speech of verbs are used as the main trigger word and / or the target words with the part of speech of gerunds are extracted from the target word list. The verb part of the target word is used as the main trigger word, and the noun part of the target word is used as the associated word. Here, one main trigger word corresponds to one word family.

[0046] The system receives input text to be processed, filters the text, segments the filtered text to obtain a list of words to be filtered, and then extracts words in the list of words to be filtered that are verbs and / or gerunds to form a candidate word list.

[0047] Select several candidate words from the candidate word list whose similarity to each of the main trigger words is equal to a preset similarity. Extract the candidate words whose part of speech is verb from the candidate words and add them as secondary trigger words to the word family of the main trigger word corresponding to the candidate words. And / or extract the candidate words whose part of speech is gerund from the candidate words and add the verb part of the candidate words as secondary trigger words to the word family of the main trigger word corresponding to the candidate words. Add the noun part of the candidate words as related words to the word family of the main trigger word corresponding to the candidate words.

[0048] The word families containing the secondary trigger words and the associated words are combined to obtain a trigger word dictionary.

[0049] Furthermore, the processor 1001 can call a computer program stored in the memory 1005 and also perform the following operations:

[0050] After combining the word families containing the secondary trigger words and the associated words to obtain the trigger word dictionary, the word families included in the trigger word dictionary are filtered. If any one or more word families contain a primary trigger word and / or a secondary trigger word and / or an associated word that does not meet the preset conditions, the target word and / or the candidate word corresponding to the primary trigger word and / or the secondary trigger word and / or the associated word that does not meet the preset conditions are removed.

[0051] Furthermore, the processor 1001 can call a computer program stored in the memory 1005 and also perform the following operations:

[0052] In the steps following the determination of the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the cybersecurity entities included in each sentence, each sentence is encoded into a plurality of sentence vectors, and the title is encoded into a title vector. Then, the similarity between each sentence vector and the title vector is determined, the first ratio between the number of trigger words included in each sentence and the number of words included in each sentence is determined, and the first ratio is used as the first weight. Finally, the second ratio between the number of cybersecurity entities included in each sentence and the number of words included in each sentence is determined, and the second ratio is used as the second weight.

[0053] Furthermore, the processor 1001 can call a computer program stored in the memory 1005 and also perform the following operations:

[0054] The step of determining the center sentence based on the similarity of each sentence, the first weight, and the second weight includes: arranging each sentence from largest to smallest according to the similarity of each sentence, the first weight, and the second weight, and selecting one or more sentences that appear first in the arrangement as the center sentence, wherein the total length of the center sentence does not exceed a preset length.

[0055] Furthermore, the processor 1001 can call a computer program stored in the memory 1005 and also perform the following operations:

[0056] Before determining the trigger words contained in the central sentence and determining the event type pointed to by the central sentence based on the trigger words, an event type table is developed according to the ACE standard, wherein the event type table is used to determine the event type pointed to by the central sentence based on the trigger words.

[0057] Furthermore, the processor 1001 can call a computer program stored in the memory 1005 and also perform the following operations:

[0058] Before calculating the central sentence and the event type using the BiLSTM model and the CRF model, the central sentence and the event type are concatenated to obtain concatenated input text, and then the concatenated input text is segmented to obtain a word sequence.

[0059] The word sequence is encoded into several word vectors using the GloVe word vector model.

[0060] Furthermore, the processor 1001 can call a computer program stored in the memory 1005 and also perform the following operations:

[0061] The steps for calculating the central sentence and the event type using a BiLSTM model and a CRF model to obtain the central event include: inputting the several word vectors into the BiLSTM model to obtain several sets of predicted probability vectors;

[0062] Several sets of predicted probability vectors are input into the CRF model. The CRF model calculates the probability values ​​of the predicted label sequences corresponding to the several sets of preset probability vectors. After determining the predicted label sequence with the largest probability value as the target sequence, the central event is output based on the target sequence.

[0063] like Figure 2 As shown, Figure 2 This is a flowchart illustrating an embodiment of the central event extraction method of the present invention. In this embodiment, the central event extraction method includes the following steps:

[0064] Step S10: After determining the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the network security entities included in each sentence, the central sentence is determined based on the similarity, the first weight, and the second weight of each sentence.

[0065] In this implementation, taking security threat intelligence service as an example, after receiving the text to be extracted related to open source threat intelligence, since extracting the central event from the text to be extracted is a single event extraction task, and single events often appear in a single sentence or a few sentences in the text to be extracted, the present invention first narrows the extraction scope by determining the central sentence in the text to be extracted, so as to reduce the impact of secondary events on the central event.

[0066] This invention determines the central sentence of the text to be extracted (the number of central sentences is several) from three dimensions: the cosine similarity between each sentence in the text and the title of the text to be extracted; the first weight of the number of trigger words included in each sentence and the total number of words in the text to be extracted; and the second weight of the network security entities included in each sentence and the total number of words in the text to be extracted. By determining the central sentence of the text to be extracted from these three dimensions, the scope of subsequent extraction of the central event based on the central sentence is narrowed. At the same time, because the calculation is based on the similarity with the title and the weights of trigger words and network security entities, the interference of secondary events recorded in the text to be extracted on the extraction of the central event is eliminated, which helps to reduce the difficulty of extracting the central event.

[0067] Optionally, before determining the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the cybersecurity entities included in each sentence in step S10, the method further includes:

[0068] Step S101: Construct an initial trigger word list. Based on the part of speech of each word in the initial trigger word list, filter to obtain a target word list consisting of target words with the part of speech of verbs and / or gerunds. Extract the target words with the part of speech of verbs from the target word list and use them as the main trigger word. Or extract the target words with the part of speech of gerunds from the target word list, use the verb part of the target words as the main trigger word, and use the noun part of the target words as the associated words. Here, one main trigger word corresponds to one word family.

[0069] In this embodiment, the trigger words in the initial trigger word list are derived from data annotation. After obtaining trigger words from data such as speech, images, text, and video through data annotation, the obtained trigger words are combined into an initial trigger word list. The words in the initial trigger word list are filtered according to their parts of speech, and a target word list consisting of target words with the parts of speech of verbs and / or gerunds is selected. After extracting the target words with the parts of speech of verbs from the target word list, the target words are directly used as the main trigger word. The main trigger word corresponds to a word family. Alternatively, after extracting the target words with the parts of speech of gerunds from the target word list, the verb part of the target word is used as the main trigger word, and the noun part of the target word is used as the associated word. The main trigger word and its related associated words form a word family.

[0070] Step S102: Receive the input text to be processed, filter the text to be processed, segment the filtered text to obtain a list of words to be filtered, and extract words in the list of words to be filtered that are verbs and / or gerunds to form a candidate word list.

[0071] At this point, the input text to be processed is received and filtered to remove useless symbols, stop words, webpage content, advertisements, and other invalid information. The filtered text is then segmented into several words to be filtered, resulting in a list of words to be filtered. Words in the list of words to be filtered that are verbs and / or gerunds are extracted and used to form a candidate word list.

[0072] Step S103: Select several candidate words from the candidate word list whose similarity to each of the main trigger words is equal to a preset similarity; extract the candidate words whose part of speech is verb from the several candidate words; add the candidate words as secondary trigger words to the word family of the main trigger word corresponding to the candidate words; and / or extract the candidate words whose part of speech is gerund from the several candidate words; add the verb part of the candidate words as secondary trigger words to the word family of the main trigger word corresponding to the candidate words; and add the noun part of the candidate words as related words to the word family of the main trigger word corresponding to the candidate words.

[0073] Based on the main trigger word obtained in step S101, select candidate words from the candidate word list whose similarity to the corresponding main trigger word is equal to the preset similarity, specifically obtained through formula 1.

[0074]

[0075] Where w represents the main trigger word, c represents the candidate word, and e represents the candidate word. wThe word vectors of the main trigger words are obtained through the Word2 Vec word vector model of the Gensim library. c These are the word vectors of candidate words obtained through the Word2 Vec word vector model of the Gensim library. sim(w,c) represents the similarity between the main trigger word and the candidate word, ||e w ||and||e c || represents the word vector modulus of the main trigger word and candidate words. The preset similarity is based on the final calculated similarity, with the highest similarity with each main trigger word being the preset similarity. The candidate words with the highest similarity to the main trigger word are added to the word family corresponding to the main trigger word.

[0076] Specifically, after obtaining several candidate words with the highest similarity to the main trigger word, the part of speech of the candidate words is determined. If the part of speech of the candidate word is a verb, the candidate word is directly added as a secondary trigger word to the word family corresponding to the main trigger word. If the part of speech of the candidate word is a gerund, the verb part of the candidate word is added as a secondary trigger word to the word family corresponding to the main trigger word, and the noun part of the candidate word is added as a related word to the word family corresponding to the main trigger word.

[0077] Step S104: Combine the word families containing the secondary trigger words and the associated words to obtain a trigger word dictionary.

[0078] Because this embodiment sets a word family that must include a main trigger word, a related word, and a secondary trigger word, after determining that all main trigger words have been selected as corresponding candidate words, the word families corresponding to the main trigger words that contain secondary trigger words and related words are combined to form a trigger word dictionary, so as to improve the accuracy of central event extraction through this trigger word dictionary.

[0079] Optionally, after the step of combining the word families containing the secondary trigger word and the associated word in step S104 to obtain the trigger word dictionary, the method further includes:

[0080] Step S105: Filter each word family included in the trigger word dictionary. If any one or more word families contain a main trigger word and / or a secondary trigger word and / or a related word that does not meet the preset conditions, then remove the target word and / or the candidate word corresponding to the main trigger word and / or the secondary trigger word and / or the related word that does not meet the preset conditions.

[0081] To further ensure the reliability and accuracy of the trigger word dictionary, after obtaining the trigger word dictionary, it is necessary to screen the word families included in the trigger word dictionary. If, during the screening of each word family, a primary trigger word, a secondary trigger word, or a related word that does not meet the preset conditions is found, then the target word or candidate word corresponding to the primary trigger word, secondary trigger word, or related word that does not meet the preset conditions shall be removed.

[0082] Among them, the preset conditions are the conditions for standardizing word families based on security threat intelligence services.

[0083] Optionally, in step S10, after determining the similarity between each sentence included in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the cybersecurity entities included in each sentence, the step includes:

[0084] Step S106: Encode each sentence into several sentence vectors, and encode the title into a title vector. Then, determine the similarity between each sentence vector and the title vector, determine the first ratio between the number of trigger words in each sentence and the number of words in each sentence, and use the first ratio as the first weight. Also, determine the second ratio between the number of cybersecurity entities in each sentence and the number of words in each sentence, and use the second ratio as the second weight.

[0085] In this embodiment, the BERT-chinese-based model is used to convert each sentence in the text to be extracted into several sentence vectors, and the title of the text to be extracted is converted into a title vector. Then, the similarity between each sentence and the title is calculated using Formula 2.

[0086]

[0087] Where s represents a single sentence, t represents a title, and C s Represented as the sentence vector and C of a single sentence output by the BERT-chinese-based model. t Let S(s,t) be the title vector of the title output by the BERT-chinese-based model, and let S(s,t) represent the similarity between a single sentence and the title.

[0088] The first weight and the second weight are respectively obtained by calculating the number of trigger words and the number of words in each sentence, and by calculating the number of cybersecurity entities and the number of words in each sentence. Specifically, the first weight is obtained by calculating the number of trigger words and the total number of words in each sentence, and adding the calculated number of trigger words and the total number of words to Formula 3; the second weight is obtained by calculating the number of cybersecurity entities and the total number of words in each sentence, and adding the calculated number of cybersecurity entities and the total number of words to Formula 4.

[0089]

[0090] Where TCount(s) represents the number of trigger words, Count(s) represents the number of words, and T(s) represents the first weight.

[0091]

[0092] Here, ECount(s) represents the number of cybersecurity entities, Count(s) represents the number of words, and E(s) represents the second weight.

[0093] Optionally, the step of determining the center sentence in step S10 based on the similarity of each of the individual sentences, the first weight, and the second weight includes:

[0094] Step S107: Based on the similarity of each sentence and the score between the first weight and the second weight, arrange each sentence from largest to smallest, and select one or more sentences that are ranked first as the center sentence, wherein the total length of the center sentence does not exceed a preset length.

[0095] After calculating the similarity, first weight, and second weight in step S106, each sentence is arranged from largest to smallest according to the score between the similarity, first weight, and second weight. One or more sentences with the highest scores are selected as the center sentences. It should be noted that the standard for selecting the number of center sentences is based on the total length of the text to be extracted. The total length of the selected center sentences does not exceed the preset length, that is, it does not exceed the preset length of the total length of the text to be extracted. In this embodiment, it is set to not exceed 10% of the total length of the text to be extracted.

[0096] Step S20: Determine the trigger word contained in the central sentence, and determine the event type pointed to by the central sentence based on the trigger word.

[0097] After extracting the central sentence from the text to be extracted according to step S10, the trigger words included in the central sentence are determined. The trigger words are determined according to a trigger word dictionary. After the trigger words included in the central sentence are determined, the event type to which the central sentence points is determined according to the event type to which the trigger words belong.

[0098] The event type is determined according to the event type table, which defines the event types according to the ACE standard. The event type table defined according to the ACE standard consists of the subcategories of events and the event types that determine the events. The event type table shown in Table 1 is an example:

[0099]

[0100] Table 1

[0101] According to Table 1, ① when the trigger word identified in the central sentence is associated with any one or more subcategories of computer viruses, worms, Trojan horses, botnets, hybrid attack programs, and malicious code embedded in web pages, then the central sentence is classified into the event type of malicious program events; ② when the trigger word identified in the central sentence is associated with any one or more subcategories of distributed denial-of-access attacks, backdoor attacks, vulnerability attacks, phishing, and interference events, then the central sentence is classified into the event type of network attack events; ③ when the trigger word identified in the central sentence is associated with information tampering, information impersonation, information leakage, information theft, and... If the central sentence is associated with any one or more subcategories of information loss, then the event type is classified as information destruction event; ④ If the trigger word in the central sentence is associated with any one or more subcategories of sensitive public opinion hotspot hype information event, illegal information event, and information event of colluding to incite assemblies and demonstrations, then the central sentence is classified as information content security event; ⑤ If the trigger word in the central sentence is associated with any one or more subcategories of software and hardware failure, external security facility failure, and man-made sabotage accident, then the central sentence is classified as equipment and facility failure event.

[0102] Furthermore, when there are multiple trigger words in the central sentence, and the subcategories associated with these trigger words are different event types, the event type corresponding to the subcategories associated with each trigger word is determined. The final event type pointed to by the central sentence is determined based on the total number of event types triggered. For example, in the central sentence "Security issues in computer networks mainly affect two aspects: first, threats to various information data, including illegal modification, theft, deletion, and illegal use of information data; second, attacks on various devices in the computer network, causing system network disorder, paralysis, and even equipment damage," the trigger word "illegal modification" is associated with the subcategory "information tampering," corresponding to the event type of information destruction; the trigger word "theft" is associated with the subcategory "information theft," corresponding to the event type of information destruction; the trigger word "deletion" is associated with the subcategory "information loss," corresponding to the event type of information destruction; and the trigger word "illegal use" is associated with the subcategory "information loss." The event type "information damage" is associated with "impersonation," and the trigger word "attack" is associated with the subcategory "human-caused sabotage," corresponding to the event type "equipment and facility failure." The trigger word "network disorder" is associated with the subcategory "hardware and software malfunction," corresponding to the event type "equipment and facility failure." The trigger word "paralysis" is associated with both the subcategories "hardware and software malfunction" and "human-caused sabotage," corresponding to the event types "equipment and facility failure." In other words, this central sentence triggers two event types: "information damage" and "equipment and facility failure." "Information damage" is triggered by four trigger words: "illegal modification," "theft," "deletion," and "illegal use." "Equipment and facility failure" is triggered by three trigger words: "attack," "network disorder," and "paralysis." Because "information damage" is triggered more often than "equipment and facility failure," the event type indicated by this central sentence is determined to be "information damage."

[0103] Optionally, before determining the trigger word contained in the central sentence in step S20, and determining the event type pointed to by the central sentence based on the trigger word, the method further includes:

[0104] Step S108: Develop an event type table according to the ACE standard, wherein the event type table is used to determine the event type pointed to by the central sentence based on the trigger word.

[0105] The specific implementation of step S108 can be referred to the specific implementation of step S20 above, and will not be repeated here.

[0106] Optionally, before the step of calculating the center sentence and the event type using the BiLSTM model and the CRF model in step S30, the method further includes:

[0107] Step S201: After concatenating the central sentence and the event type to obtain the concatenated input text, the concatenated input text is segmented to obtain a word sequence;

[0108] Step S202: Encode the word sequence into several word vectors using the GloVe word vector model.

[0109] After concatenating the obtained central sentences and the event types corresponding to each central sentence, the concatenated input text is obtained. The concatenated input text is then segmented to obtain a word sequence containing several words. The word sequence is then input into the GloVe word vector model so that the GloVe word vector model can encode several words in the word sequence into word vectors.

[0110] Step S30: Calculate the central sentence and the event type using the BiLSTM model and the CRF model to obtain the central event.

[0111] By using BiLSTM and CRF models, we can ensure that the predicted sequence obtained based on the central sentence and event type is more comprehensive, while avoiding the interference of invalid predicted sequences on the extraction of the central event, thus reducing the error.

[0112] Optionally, the step of calculating the central sentence and the event type using a BiLSTM model and a CRF model in step S30 to obtain the central event includes:

[0113] Step S301: Input the several word vectors into the BiLSTM model to obtain several sets of prediction probability vectors.

[0114] The word vectors from the word sequence output by the GloVe word vector model are all input into the BiLSTM model. The BiLSTM model performs bidirectional feature learning on the input word sequence in both forward and backward directions to obtain the forward information of the corresponding hidden layer. and reverse information Positive information and reverse information The connections form the overall hidden layer information:

[0115]

[0116] And based on the hidden layer information, the predicted sequence group that can be formed by the word vectors in the word sequence is obtained: P = (P1, P2, P3, ..., P...). n )∈R n*k .

[0117] Where P1, P2, P3, ..., P nThis represents n sets of prediction probability vectors, where the size of each vector is equal to the total number of word label types, which is equal to the total number of argument roles plus 1. The BiLSTM model can guarantee the comprehensiveness of the prediction sequence obtained based on the word sequence.

[0118] Step S302 involves inputting several sets of predicted probability vectors into the CRF model, calculating the probability values ​​of the predicted label sequences corresponding to the several sets of preset probability vectors through the CRF model, determining the predicted label sequence with the largest probability value as the target sequence, and then outputting the central event based on the target sequence.

[0119] After obtaining several sets of predicted probability vectors through the BiLSTM model, these vectors are input into the CRF model to constrain the predicted probability vectors output by the BiLSTM model. Specifically, the CRF model calculates the probability values ​​of the predicted label sequences corresponding to the input predicted probability vectors, determining the probability that each predicted label sequence is equivalent to the predicted sequence. Here, the predicted sequence is defined in the event type table based on the central event output by the predicted label sequence. Specifically, Formula 5 is used to constrain any set of predicted label sequences Y = {y1, y2, ..., y...}. n Perform the calculation.

[0120]

[0121] Where A is a transition score matrix of size k+2, and the extra part is the y0 and y1 added to the two segments of the predicted label sequence. n+1 Used to mark the beginning and end of a sentence.

[0122] This represents the sum of the transition scores from the i-th label to the j-th label. C(X,Y) represents the sum of probabilities of classifying words in the input predicted label sequence into the j-th label. C(X,Y) is the probability value of the input predicted label sequence. The CRF model can avoid the interference of invalid predicted sequences on the extraction of the central event, thereby reducing the error.

[0123] After calculating the probability values ​​corresponding to each predicted label sequence, the predicted label sequence with the highest probability value is obtained. After determining the predicted label sequence with the highest probability value, the predicted label sequence is output as the target sequence and the output of the central event is shown in Formula 6.

[0124]

[0125] Among them, Y * Indicates the central event, Y represents the probability values ​​of all possible predicted label sequences. x The predicted label sequence Y with the highest probability value.

[0126] In this embodiment, by determining the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the network security entities included in each sentence, the central sentence is determined based on the similarity, first weight, and second weight of each sentence. Determining the central sentence through three dimensions narrows the extraction scope and reduces the interference of secondary events on the extraction of the central sentence. The trigger words included in the central sentence are determined, and the event type pointed to by the central sentence is determined based on the trigger words, which is beneficial for the extraction of events in specific domains. The central event is obtained by calculating the central sentence and event type using BiLSTM and CRF models, which reduces the error of the existing pipeline method for extracting central events, thereby improving the convenience and effectiveness of the central event extraction task.

[0127] Furthermore, this invention also proposes an electronic device, which includes a memory, a processor, and a computer processing program stored in the memory and executable on the processor. When the processor executes the computer processing program, it implements the steps of the above-mentioned central event extraction method.

[0128] Furthermore, the present invention also proposes a computer-readable storage medium storing a computer processing program, wherein the modeling and simulation program, when executed by a processor, implements the steps of the above-mentioned central event extraction method.

[0129] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0130] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0131] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a computer-readable storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0132] The above are merely preferred embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent structural or procedural changes made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for extracting a central event, characterized in that, The method for extracting the central event includes the following steps: An initial trigger word list is constructed. Based on the part of speech of each word in the initial trigger word list, a target word list consisting of target words with the part of speech of verbs and / or gerunds is obtained. The target words with the part of speech of verbs in the target word list are extracted and used as the main trigger word. And / or the target words with the part of speech of gerunds in the target word list are extracted and the verb part of the target words is used as the main trigger word, and the noun part of the target words is used as the related word. Here, one main trigger word corresponds to one word family. The system receives input text to be processed, filters the text, segments the filtered text to obtain a list of words to be filtered, and then extracts words in the list of words to be filtered that are verbs and / or gerunds to form a candidate word list. Select several candidate words from the candidate word list whose similarity to each of the main trigger words is equal to a preset similarity. Extract the candidate words whose part of speech is verb from the candidate words and add them as secondary trigger words to the word family of the main trigger word corresponding to the candidate words. And / or extract the candidate words whose part of speech is gerund from the candidate words and add the verb part of the candidate words as secondary trigger words to the word family of the main trigger word corresponding to the candidate words. Add the noun part of the candidate words as related words to the word family of the main trigger word corresponding to the candidate words. The word families containing the secondary trigger words and the associated words are combined to obtain a trigger word dictionary; After determining the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the network security entity included in each sentence, the central sentence is determined based on the similarity, the first weight and the second weight of each sentence. Identify the trigger words contained in the central sentence, and determine the event type pointed to by the central sentence based on the trigger words; The central event is obtained by calculating the central sentence and the event type using the BiLSTM model and the CRF model; The determination of the similarity between each sentence in the text to be extracted and the title of the text to be extracted, the first weight of the trigger words included in each sentence, and the second weight of the cybersecurity entities included in each sentence includes: Each of the single sentences is encoded into a plurality of single sentence vectors, and the title is encoded into a title vector. Then, the similarity between each single sentence vector and the title vector is determined, a first ratio between the number of trigger words included in each single sentence and the number of words included in each single sentence is determined, and the first ratio is used as the first weight. Then, a second ratio between the number of cybersecurity entities included in each single sentence and the number of words included in each single sentence is determined, and the second ratio is used as the second weight.

2. The method for extracting the central event as described in claim 1, characterized in that, After the step of combining the word families containing the secondary trigger words and the associated words to obtain a trigger word dictionary, the method further includes: The word families included in the trigger word dictionary are filtered. If any one or more word families contain a main trigger word and / or a secondary trigger word and / or a related word that does not meet the preset conditions, the target word and / or the candidate word corresponding to the main trigger word and / or the secondary trigger word and / or the related word that does not meet the preset conditions are removed.

3. The method for extracting the central event as described in claim 1, characterized in that, The step of determining the center sentence based on the similarity of each of the individual sentences, the first weight, and the second weight includes: Based on the similarity of each sentence and the scores between the first weight and the second weight, the sentences are arranged from largest to smallest, and one or more sentences that appear at the top of the list are selected as the central sentence, wherein the total length of the central sentence does not exceed a preset length.

4. The method for extracting the central event as described in claim 1, characterized in that, Before the step of determining the trigger word contained in the central sentence and determining the event type pointed to by the central sentence based on the trigger word, the method further includes: An event type table is developed based on the ACE standard, wherein the event type table is used to determine the event type to which the head sentence points based on the trigger word.

5. The method for extracting the central event as described in claim 1, characterized in that, Before the step of calculating the center sentence and the event type using the BiLSTM model and the CRF model, the method further includes: After concatenating the central sentence and the event type to obtain the concatenated input text, the concatenated input text is segmented to obtain a word sequence; The word sequence is encoded into several word vectors using the GloVe word vector model.

6. The method for extracting the central event as described in claim 5, characterized in that, The step of calculating the central event by using the BiLSTM model and the CRF model to calculate the central sentence and the event type includes: The word vectors are input into the BiLSTM model to obtain several sets of prediction probability vectors; Several sets of predicted probability vectors are input into the CRF model. The CRF model calculates the probability values ​​of the predicted label sequences corresponding to the several sets of predicted probability vectors. After determining the predicted label sequence with the largest probability value as the target sequence, the central event is output based on the target sequence.

7. An electronic device, characterized in that, The electronic device includes: a memory, a processor, and a computer processing program stored in the memory and executable on the processor, the computer processing program being configured to implement the steps of the method for extracting central events as claimed in any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer processing program, which, when executed by a processor, implements the steps of the central event extraction method as described in any one of claims 1 to 6.

Images