A text-based method for generating network security emergency response knowledge graph

Abstract

This paper discloses a method for generating a cybersecurity emergency response knowledge graph based on text. The method includes the following steps: first, using a pretrained encoder-decoder language model to generate text nodes and node features; then, using input text and a learnable node query to output query node features, and then generating node text using an LSTM; then, fusing the text node features with the query node features to obtain the final node features; then, using both generative and classification methods to generate and fuse edges; and finally, training the network using an aggregation loss function and a sparse adjacency matrix. The cybersecurity knowledge graph generated using this method has extremely high applicability and accuracy.

Description

Technical Field

[0001] The present invention belongs to the field of network security knowledge graphs. Background Art

[0002] Cybersecurity emergency response refers to the use of internally stored security knowledge to address potential threats and take appropriate measures after a threat occurs. With the emergence of increasingly complex threats, traditional passive cybersecurity defense methods are becoming inadequate. Consequently, innovation in the cybersecurity field is driving the need for higher standards for emergency command capabilities and efficiency in responding to diverse situations. To address this issue, the scientific community has proposed using knowledge graphs to address cybersecurity issues. Knowledge graphs are a new approach to analyzing and processing cybersecurity data, and the Cybersecurity Emergency Response Knowledge Graph has emerged as a result. By using the Cybersecurity Emergency Response Knowledge Graph, security emergency responders can quickly identify and analyze security incidents and understand the required emergency response processes, tools, and technologies, thereby improving the efficiency of security emergency response. The Cybersecurity Emergency Response Knowledge Graph is a data-driven, linear, and computationally powerful tool. People working in network security can use the network security emergency response knowledge graph to intuitively understand the relationship between network security entities, such as the exploitation relationship between malware and vulnerabilities, the adversarial relationship between attackers and security protection equipment, and the relationship between systems and vulnerabilities, so as to better handle network security issues. The quality of the network security knowledge graph plays a decisive role in subsequent knowledge graph-based applications. How to trace network security based on the knowledge graph and how to generate accurate network security knowledge graphs have become research hotspots. Summary of the Invention

[0003] This patent aims to build a high-performance knowledge graph from text. Traditional knowledge graph construction methods are time-consuming and labor-intensive. This is because even common knowledge graph nodes require high labor costs to generate and proofread. These nodes often number in the thousands, requiring extensive repetitive labor and making knowledge graph construction inefficient. Rapidly building a cybersecurity knowledge graph is crucial. This patent addresses the shortcomings of traditional methods by using a novel approach to constructing a cybersecurity knowledge graph. The resulting cybersecurity knowledge graph boasts high applicability and accuracy. This patent introduces a novel method for generating a cybersecurity emergency response knowledge graph based on text. First, a pretrained encoder-decoder language model is used to generate text nodes and node features. Then, the input text and a learnable node query are used to output query node features. Node text is then generated using an LSTM. Finally, the text node features and query node features are fused to obtain the final node features. Edges are generated and fused using both generative and classification methods. Finally, the network is trained using an aggregation loss function and a sparse adjacency matrix. The network security knowledge graph generated using this method has extremely high applicability and accuracy.

[0004] Technical means

[0005] The patent of this invention aims to realize the construction of high-performance knowledge graphs through text. The traditional method of constructing knowledge graphs is time-consuming and labor-intensive. This is because even ordinary knowledge graph nodes require high labor costs to generate and proofread, and such nodes usually reach millions in large knowledge graphs. In traditional methods, this requires a lot of manpower for repetitive operations, making the construction of knowledge graphs very inefficient. How to quickly construct a network security knowledge graph has become a top priority. The present invention constructs a network security knowledge graph through a novel method, which solves the various drawbacks of traditional methods, and the network security knowledge graph constructed by this method has extremely high applicability and accuracy. The details are as follows:

[0006] S1: Generate text nodes and node features through the pre-trained encoder-decoder language model.

[0007] S2: Input text and learnable node query, output query node features, and then generate node text through LSTM.

[0008] S3: Fuse text node features and query node features to obtain the final node features.

[0009] S4: Generate and fuse edges using both generation and classification methods.

[0010] S5: Train the network by aggregating the loss function and the sparse adjacency matrix.

[0011] As a preferred embodiment of the present invention, S1 includes the following steps:

[0012] S101: Using a pre-trained encoder-decoder language model, node generation is formulated as a sequence-to-sequence problem, where the system is fine-tuned to convert text input into a sequence of nodes, marked with special <pad>NODE1<NODE_SEP> NODE2...separated, where NODEi represents one or more words;

[0013] S102: This module can not only generate nodes, but also provide node features for the generated edge tasks. Each node can be associated with multiple node features by using separation tags.<NODE_SEP> To describe the node boundary, greedy decoding generates a string, and the hidden state of the last layer of the decoder is average pooled; we pre-fix the number of generated nodes and use a special<NO_NODE> Tokens to fill in missing nodes.

[0014] As a preferred embodiment of the present invention, S2 includes the following steps:

[0015] S201: The decoder receives a set of learnable node queries as input and represents them as embedding feature matrices. To ensure that the network can process all queries simultaneously, no causal mask is used. The output of the decoder can now be directly read as N represents the number of nodes, d represents the node feature dimension, and is passed to the prediction head LSTM to be decoded into node logic Where S is the length of the generated node sequence and V is the vocabulary size;

[0016] S202: In order to prevent the network from remembering a specific order of target nodes, logits and features are arranged as

[0017] L′ n (s)=L n (s)P,F′ n =F n P,

[0018] Where s=1,…,S, and is the permutation matrix obtained by using the bipartite matching method between the target and greedy decoding nodes. Using cross entropy loss as the matching cost function, the node feature F′ processed by the permutation matrix n Now it is target aligned.

[0019] As a preferred embodiment of the present invention, S3 includes the following steps:

[0020] S301: In order to fully utilize the features of text nodes and query nodes, a node fusion module is designed to concatenate the features obtained in the first two steps. The features are first fused through a residual block, and then the important information is extracted through a self-attention module.

[0021] S302: Feature enhancement is then performed using a dilated spatial convolutional pooling pyramid and a convolutional attention module. A 5×3×3 3D convolution is then used to compress the features, and a channel attention module is used to focus on the important feature information after compression.

[0022] S303: In order to remove the redundant information in the generated node features, a simple encoder-decoder structure is used to predict the redundant information in the node, and then the redundant information is subtracted from the original information;

[0023] S304: Dot product is then used to measure the similarity between node features. The obtained similarity is mapped to a range of 0-1 using a softmax function. If the similarity is greater than Y, one node is randomly removed to control the number of redundant nodes. Experiments show that Y = 0.7 achieves the best results. After removing redundant nodes, the final node features are obtained.

[0024] As a preferred embodiment of the present invention, S4 includes the steps of:

[0025] S401: This module then uses the node features from the previous step to generate edges. Given a pair of node features, the prediction head determines whether there is an edge between their respective nodes, generates the edge using two methods, and then fuses the generated edges.

[0026] S402: First, use LSTM to generate edges into token sequences. The advantage of generation is that it can construct any edge sequence, including edge sequences not seen during training, but there is a risk that it will not completely match the target edge token sequence;

[0027] S403: The classification head is then used to predict edges. If the set of possible relationships is fixed and known, the classification head will be more efficient and accurate, but if the training coverage of all possible edges is limited, the system may misclassify during inference;

[0028] S404: Edges are concatenated in pairs, and then features are fused through a dense layer. A trained scoring network is used to evaluate the confidence of the fused edges. If the confidence is greater than 0.5, the fused edge is retained.

[0029] As a preferred embodiment of the present invention, S5 includes the following steps:

[0030] S501: Since it is necessary to check the existence of edges between all pairs of nodes, up to N2 edges are generated and predicted, where N is the number of nodes.<NO_NODE> When there is no edge between two nodes, a special token is used<NO_EDGE> To express;

[0031] S502: A novel focal loss is proposed, represented by the symbol F, whose main idea is to reduce the number of well-classified samples.<NO_EDGE> The cross entropy loss for misclassification is increased as follows:

[0032] F=-(1-p t ) γ log(p t ),

[0033] Where γ is a weighting factor, when γ = 0, the two losses are equal. p is the probability of a single edge, and t is the target category. t represents the probability of the target category;

[0034] S503: A method for modifying the training setting is proposed, which is to remove most of the<NO_EDGE> edges, retaining all actual edges but leaving only some randomly selected<NO_EDGE> Edges; This modification can improve accuracy by 10-20%, while also reducing training time by 10% using sparse edges;

[0035] S504: After the adjacency matrix is ​​sparsely populated in the previous step, some actual edges are removed and some edges are randomly replaced to enhance the robustness of the model. This modification can improve the accuracy by 5%-10%. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is an overall flow chart of an embodiment of the present invention.

[0037] Figure 2 This is a text node graph generated according to an embodiment of the present invention.

[0038] Figure 3 Generate a query node graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to explain the technical content, structural features, achieved objectives and effects of the technical solution in detail, the following is a detailed description in conjunction with specific embodiments and accompanying drawings.

[0040] Please also refer to Figure 1 As shown in the figure, this embodiment provides a method for generating a network security emergency response knowledge graph based on text, including the following steps:

[0041] S1: Generate text nodes and node features through the pre-trained encoder-decoder language model. Figure 2 .

[0042] S2: Input text and learnable node query, output query node features, and then generate node text through LSTM. Figure 3 .

[0043] S3: Fuse text node features and query node features to obtain the final node features.

[0044] S4: Generate and fuse edges using both generation and classification methods.

[0045] S5: Train the network by aggregating the loss function and the sparse adjacency matrix.

[0046] In the above embodiment, S1 further includes the following steps:

[0047] S101: Using a pre-trained encoder-decoder language model, node generation is formulated as a sequence-to-sequence problem, where the system is fine-tuned to convert text input into a sequence of nodes, marked with special <pad>NODE1<NODE_SEP> NODE2...separated, where NODEi represents one or more words;

[0048] S102: This module can not only generate nodes, but also provide node features for the generated edge tasks. Each node can be associated with multiple node features by using separation tags.<NODE_SEP> To describe the node boundary, greedy decoding generates a string, and the hidden state of the last layer of the decoder is average pooled; we pre-fix the number of generated nodes and use a special<NO_NODE> Tokens to fill in missing nodes.

[0049] In the above embodiment, S2 further includes the following steps:

[0050] S201: The decoder receives a set of learnable node queries as input and represents them as embedding feature matrices. To ensure that the network can process all queries simultaneously, no causal mask is used. The output of the decoder can now be directly read as N represents the number of nodes, d represents the node feature dimension, and is passed to the prediction head LSTM to be decoded into node logic Where S is the length of the generated node sequence and V is the vocabulary size;

[0051] S202: In order to prevent the network from remembering a specific order of target nodes, logits and features are arranged as

[0052] L ′ n (s)=L n (s)P,F n ′ =F n P,

[0053] Where s=1,…,S, and is the permutation matrix obtained by using the binary matching method between the target and greedy decoding nodes. Using cross entropy loss as the matching cost function, the node feature F processed by the permutation matrix n ′ Now it is target aligned.

[0054] In the above embodiment, S3 further includes the following steps:

[0055] S301: To fully utilize the features of text nodes and query nodes, a node fusion module is designed to combine the features obtained in the first two steps. First, the features are fused through a residual block, and then the important information is extracted through a self-attention module.

[0056] S302: Feature enhancement is then performed using a dilated spatial convolutional pooling pyramid and a convolutional attention module. A 5×3×3 3D convolution is then used to compress the features, and a channel attention module is used to focus on the important feature information after compression.

[0057] S303: In order to remove the redundant information in the generated node features, a simple encoder-decoder structure is used to predict the redundant information in the node, and then the redundant information is subtracted from the original information;

[0058] S304: Dot product is then used to measure the similarity between node features. The obtained similarity is mapped to a range between 0 and 1 using a softmax function. If the similarity is greater than Y, one of the nodes is randomly removed to control the number of redundant nodes. Experiments have shown that Y = 0.7 achieves the best results. After removing redundant nodes, the final node features are obtained.

[0059] In the above embodiment, S4 further includes the following steps:

[0060] S401: In this module, the node features of the previous step are used to generate edges. Given a pair of node features, the prediction head determines whether there is an edge between their respective nodes. It uses two methods to generate edges and then fuses the generated edges.

[0061] S402: First, use LSTM to generate edges into token sequences. The advantage of generation is that it can construct any edge sequence, including edge sequences that are not seen during training, but there is a risk that it will not completely match the target edge token sequence;

[0062] S403: Then use the classification head to predict edges. If the set of possible relations is fixed and known, the classification head will be more efficient and accurate. However, if the training coverage of all possible edges is limited, the system may misclassify during reasoning.

[0063] S404: The edges are spliced ​​in pairs, and then the features are fused through a dense layer. A trained scoring network is used to evaluate the confidence of the fused edges. If the confidence is greater than 0.5, the fused edges are retained.

[0064] In the above embodiment, S5 further includes the following steps:

[0065] S501: Since it is necessary to check the existence of edges between all pairs of nodes, up to N2 edges are generated and predicted, where N is the number of nodes.<NO_NODE> When there is no edge between two nodes, a special token is used<NO_EDGE> To express;

[0066] S502: A novel focal loss is proposed, represented by the symbol F, whose main idea is to reduce the number of well-classified samples.<NO_EDGE> The cross entropy loss for misclassification is increased as follows:

[0067] F=-(1-p t ) γ log(p t ),

[0068] Where γ is a weighting factor, when γ = 0, the two losses are equal. p is the probability of a single edge, and t is the target category. t represents the probability of the target category;

[0069] S503: A method for modifying the training setting is proposed, which is to remove most of the<NO_EDGE> edges, retaining all actual edges but leaving only some randomly selected<NO_EDGE> Edges; This modification can improve accuracy by 10-20%, while also reducing training time by 10% using sparse edges;

[0070] S504: After the adjacency matrix is ​​sparsely populated in the previous step, some actual edges are removed and some edges are randomly replaced to enhance the robustness of the model. This modification can improve the accuracy by 5%-10%.

[0071] In order to prove the effectiveness of the present invention, different data sets were used for verification. The specific data sets used are the Comprehensive, Multi-Source Cyber-Security Events (comprehensive multi-source cybersecurity activities) data set and the ADFA (intrusion detection data set) data set. The Comprehensive, Multi-Source Cyber-Security Events (comprehensive multi-source cybersecurity activities) data set is obtained from various websites and various vulnerability databases on the Internet, including network security and vulnerability information as well as network text data. The ADFA (intrusion detection data set) data set contains data on various intrusions; WebSEC2020 (cybersecurity knowledge data set) is a data set for network security emergency response, which consists of multiple groups of abnormal events and corresponding labels; MAWILab (network traffic anomaly data set) is a network traffic anomaly detection data set, which consists of multiple groups of traffic anomaly labels. A large number of experiments have shown that the present invention is superior to the most advanced methods. This paper performs 20% higher than the BT5 method on the ADFA data set. The performance is 25% higher than the ReGen method on the Comprehensive, Multi-Source Cyber-Security Events data set. The experimental results are as follows:

[0072] Table 1 Feature semantic similarity matching results of different datasets

[0073]

[0074] Experimental results show that the network security knowledge graph generated by this method has extremely high applicability and accuracy.< / pad> < / pad>

Claims

1. A method for generating a network security emergency response knowledge graph based on text, characterized by: It includes the following steps: S1: Generate text nodes and node features through the pre-trained encoder-decoder language model; S2: Input text and learnable node query, output query node features, and then generate text nodes through LSTM; S3: Fusing text node features and query node features to obtain final node features, including the following steps: S301: In order to fully utilize the features of text nodes and query nodes, a node fusion module is designed to concatenate the features obtained in the first two steps. The features are first fused through a residual block, and then the important information is extracted through a self-attention module. S302: Feature enhancement is then performed using a dilated spatial convolutional pooling pyramid and a convolutional attention module. A 5×3×3 3D convolution is then used to compress the features, and a channel attention module is used to focus on the important feature information after compression. S303: In order to remove the redundant information in the generated node features, a simple encoder-decoder structure is used to predict the redundant information in the node, and then the redundant information is subtracted from the original information; S304: Then, dot product is used to measure the similarity between node features. The obtained similarity is mapped to a range between 0 and 1 through a softmax function. If the similarity is greater than Y, one of the nodes is randomly removed to control the number of redundant nodes. After the redundant nodes are removed, the final node features are obtained; S4: Generate and fuse edges using both generation and classification methods, including the following steps: S401: Use the final node features of the previous step to generate edges. Given a pair of node features, the prediction head determines whether there is an edge between their respective nodes, generates edges using two methods, and then fuses the generated edges. S402: First, use LSTM to generate edges into token sequences. The advantage of generation is that it can construct any edge sequence, including edge sequences that are not seen during training, but there is a risk that it will not completely match the target edge token sequence; S403: Then use the classification head to predict edges. If the set of possible relations is fixed and known, the classification head will be more efficient and accurate. However, if the training coverage of all possible edges is limited, the system will misclassify during the inference process. S404: The edges are concatenated in pairs, and then features are fused through a dense layer. A trained scoring network is used to evaluate the confidence of the fused edges. If the confidence is greater than 0.5, the fused edges are retained. S5: Train the network by aggregating the loss function and the sparse adjacency matrix.

2. The method for generating a network security emergency response knowledge graph based on text according to claim 1 is characterized in that: Said S1 further comprises the following steps: S101: Using a pre-trained encoder-decoder language model, node generation is formulated as a sequence-to-sequence problem, where the system is fine-tuned to convert text input into a sequence of nodes, marked with special <pad> NODE1<NODE_SEP> NODE2...separated, where NODEi represents one or more words;< / pad> S102: This module can not only generate nodes, but also provide node features for the generated edge tasks. Each node can be associated with multiple node features by using separation tags.<NODE_SEP> To describe the node boundary, greedy decoding generates a string, and the hidden state of the last layer of the decoder is average pooled; we pre-fix the number of generated nodes and use a special<NO_NODE> Tokens to fill in missing nodes.

3. The method for generating a network security emergency response knowledge graph based on text according to claim 1 is characterized in that: The S2 further comprises the following steps: S201: The decoder receives a set of learnable node queries as input and represents them as an embedding feature matrix; to ensure that the network can process all queries simultaneously, we do not use causal masks, and the output of the decoder can now be directly read as Indicates the number of nodes, d indicates the node feature dimension, and is passed to the prediction head LSTM to be decoded into node logic Where S is the length of the generated node sequence and V is the vocabulary size; S202: In order to prevent the network from remembering a specific order of target nodes, logits and features are arranged as L ′ n (s)=L n (s)P,F n ′ =F n P, Where s=1,…,S, and is the permutation matrix obtained by the binary matching method between the target and greedy decoding nodes, using cross entropy loss as the matching cost function, and the node feature F processed by the permutation matrix n ′ Now it is target aligned.

4. The method for generating a network security emergency response knowledge graph based on text according to claim 1 is characterized in that: The S5 further comprises the following steps: S501: Since it is necessary to check the existence of edges between all pairs of nodes, generate and predict up to N square edges, where N is the number of nodes. By ignoring self-loops and ignoring nodes connected to a specific token, some computational costs are reduced. When there is no edge between two nodes, a special token is used.<NO_EDGE> To express; S502: A novel focal loss is proposed, denoted by the symbol F. Its main idea is to reduce the cross entropy loss of well-classified samples and increase the cross entropy loss for misclassified samples, as shown below: F=-(1-p t ) γ log(p t ), Where γ is a weighting factor, when γ = 0, the two losses are equal; p is the probability of a single edge, and t is the target category, p t represents the probability of the target category; S503: Remove most of the adjacency matrix by sparse<NO_EDGE> edges, retaining all actual edges but leaving only some randomly selected<NO_EDGE> side; S504: After the adjacency matrix is ​​sparsely populated in the previous step, some actual edges are removed and some edges are randomly replaced.

Images