An entity relationship extraction method and device in the field of network security

Abstract

The application discloses an entity relation extraction method and device in the network security field, and relates to the network security field. According to the features of the target of attention in the network security field, the application generates a semantic matrix of each segment by enumerating segments of a certain length in sentences of multi-source heterogeneous network security data, thereby improving the accuracy of an entity recognition model. On this basis, the entity pair vector is re-encoded, and the entity subject-object boundary, entity type and attribute features are supplemented into the input of the relation extraction model to obtain a more accurate relation extraction model and reduce the error propagation method. Further, the application filters and judges the segments with a higher frequency and an unrecognized entity type, supplements them into the entity type set and the entity relation set, continuously optimizes and feeds back, and improves the recognition breadth and accuracy of the model.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to an entity relationship extraction method and device in the field of network security. BACKGROUND

[0002] With the rapid development of Internet technology, network security incidents occur frequently, and a large amount of data in various forms is generated every day, including event clues, threat intelligence, security advisories, etc. Rapid and effective extraction of key information from these data and mining of potential relationships among the data can provide important technical support for threat intelligence analysis and network security defense. At present, in the field of key information extraction and potential relationship mining, the technical means of combining entity recognition and entity relationship extraction are generally adopted, mainly in two ways: one is joint model, that is, the entity model and the relationship model are jointly trained; the other is pipeline type, which inputs the text into the entity model to obtain the entity, and then inputs the entity pair into the relationship model to obtain the direct relationship between the entity pair. This way is more flexible, but there is a problem of error propagation, that is, if the entity model makes a mistake in identifying the entity, it will directly affect the effect of the subsequent relationship model. SUMMARY

[0003] In order to accurately extract the entity relationship contained in the network security text data, the present application proposes an entity relationship extraction method and device based on entity recognition according to entity pair vectors, so as to improve the accuracy of entity recognition and reduce the error propagation in the entity recognition process.

[0004] The present application adopts the following technical solutions:

[0005] An entity relationship extraction method in the field of network security, comprising the following steps:

[0006] Obtain a plurality of source heterogeneous network security data, exhaust all substrings in each sentence in the network security data to obtain a fragment set of each sentence; obtain the word vector of all words contained in each fragment, and form a semantic matrix of each fragment;

[0007] Input the semantic matrix of each fragment of each sentence into a trained entity recognition model for recognition, the entity recognition model is composed of two layers of feedforward neural networks, and the recognition result is normalized by a normalization exponential function softmax to obtain all entities in each sentence and the corresponding entity type;

[0008] The entity pairs are obtained by pairing the entities in the same sentence two by two, the vector of the entity pair is re-encoded, the subject-object boundary identifier and the entity type identifier of the entity are added, and the attribute feature of each entity is extracted, the subject-object boundary identifier, the entity type identifier and the attribute feature of the entity are added to the vector of the entity pair, and the semantic vector of the subject-object boundary identifier, the entity type identifier and the attribute feature of the entity is obtained, and the encoded entity pair vector is output.

[0009] The encoded entity pair vector is input into the trained neural network-based relation extraction model, and the relation type with the maximum output probability after the softmax layer is recorded as the relation between the entity pair.

[0010] Further, the word vector of the word is obtained by pre-training the language model BERT.

[0011] Further, the semantic vector of the subject-object boundary identifier, the entity type identifier and the attribute feature of the entity is obtained by pre-training the language model BERT.

[0012] Further, the entity type includes a general class, a network security personnel class, a network security organization class, a network security asset class, a network security system class and a network security resource class.

[0013] Further, the entity type set is formed by each entity type, and the entity type set also contains a non-deterministic entity type item for expansion according to the actual recognized entity type that does not belong to the known entity type; the entity relationship set is formed by the relationship between each entity pair and the relationship between different entity types, and the entity relationship set also contains a non-deterministic entity relationship item for expansion according to the actual recognized entity relationship that does not belong to the known entity relationship.

[0014] Further, the entity recognition model filters and identifies the segments that cannot be judged, filters out the first several segments with the highest frequency in the actual scene and judges them, and according to the needs of network security entity recognition, the entity type set is expanded as the non-deterministic entity type item.

[0015] Further, in the two-layer feedforward neural network of the entity recognition model, the activation function of the first hidden layer adopts a linear rectifier function, and the number of neurons of the second hidden layer is the same as the number of types in the entity type set.

[0016] Further, the subject-object boundary identifier of the entity is added, which means that the start word and the end word in the subject and the object are marked, specifically, the corresponding identifier symbol is added to the word vector of the start word and the end word of the subject, and the corresponding identifier symbol is added to the word vector of the start word and the end word of the object.

[0017] An entity relationship extraction device in the field of network security, comprising a memory and a processor, a computer program is stored on the memory, and the processor implements the steps of the above method when executing the program.

[0018] A computer readable storage medium stores a computer program, which is executed by a processor to implement the steps of the above method.

[0019] The present application is based on the characteristics of the target of interest in the field of network security, and by enumerating the fragments of a certain length in the sentences of multi-source heterogeneous network security data, the semantic matrix of each fragment is generated, thereby improving the accuracy of the entity recognition model; and on this basis, the entity pair vector is re-encoded, and the entity subject-object boundary (position feature), entity type and attribute feature are supplemented to the input of the relationship extraction model, so as to obtain a more accurate relationship extraction model and reduce the error propagation. Further, the present application filters and judges the fragments that cannot be identified as entity types and have a high frequency of occurrence, and supplements them to the entity type set and the entity relationship set for continuous optimization and feedback, thereby improving the recognition breadth and accuracy of the model. BRIEF DESCRIPTION OF DRAWINGS

[0020] The present application will be further described below in conjunction with the accompanying drawings and embodiments.

[0021] Figure 1 is a flowchart of an entity relationship extraction method in the field of network security of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical scheme and advantages of the present application clearer, the embodiments of the present application will be further described in detail below.

[0023] Step 1: Define the entity type set and the relationship type set of the expected output of the task.

[0024] After obtaining multi-source heterogeneous network security data, the data is integrated, and the entity set and the relationship set that may exist in the data are screened out, so as to prepare for the entity recognition model and the relationship extraction model. The entity types to be recognized are initially defined as the following 6 entity type sets:

[0025] 1) General class: {“personnel”, “place”, “time”, “facility”, “location”, “unit”}

[0026] 2) Network security personnel class: {“hacker”, “expert”}

[0027] 3) Network security organization class: {“attack organization”, “protection organization”}

[0028] 4) Network security system class: {“system”}

[0029] 5) Network security asset class: {“asset”}

[0030] 6) Network security resource class: {“IP address”, “URL”, “domain name”, “network identity account type”, “harmful program”, “vulnerability”}.

[0031] In addition, if the recognition result of a certain segment in a sentence does not belong to any of the above entity sets, it is denoted by ∈ e . Therefore, the entity type set is defined as: {“person”, “place”, “time”, “facility”, “location”, “unit”, “hacker”, “expert”, “attack organization”, “protection organization”, “system”, “asset”, “IP address”, “URL”, “domain name”, “network identity account type”, “harmful program”, “vulnerability”, ∈ e}.

[0032] By comprehensively considering the internal relationship of each type of entity and the relationship between different entity types, the relationship set involved is defined as: {“same unit”, “superior-subordinate”, “responsible”, “same organization”, “attack”, “protection”, “remote connection”, “reside in”, “work in”, “use”, “protection”, “belong to”, “implant”, “DNS resolution”, “reverse DNS”, “associated URL”, ∈ r}. Where ∈ r represents that there is no relationship between the two entities.

[0033] Step two: Obtain the semantic matrix of each segment in the sentence.

[0034] Let the input sentence be Z, and the sentence Z be composed of n words z1, z2, z3,…, z n . Exhaust all possible substrings in the sentence Z, and obtain the segment set of the sentence Z, which is defined as S={s1, s2, s3,…, s m}, where s is a segment composed of words; in order to avoid too many elements in the set S, the number of words contained in each substring (i.e., segment) is at most a set value L. By pre-training the language model BERT (without training, you can choose the open source model such as Google’s BERT-Base Chinese model, Chinese-BERT-wwm model of Harbin Institute of Technology, etc.), the word vector of each word in the sentence Z can be obtained, where the word vector of the word z i is In order to perform the following entity recognition task, the semantic matrix of the segment s i is defined as The segment s i is composed of a number of consecutive words, which represents the segment si the t-th word in the sentence.

[0035] Step three: perform an entity recognition task on each segment in the sentence.

[0036] The entity recognition model is composed of two layers of feedforward neural networks, with the input being the semantic matrix of a certain segment. The number of neurons in the first hidden layer is set to 100, and the activation function is Rectified Linear Unit (ReLU). The number of neurons in the second hidden layer is the same as the number of entity types in the set defined in step one, denoted as e e ε, where ε is the set of entity types. The segment s i is input into the neural network to obtain the output result vector defined as y1(h(s i ). i Therefore, the probability that the segment s e belongs to the entity type e is: i P i (e|s i ) = softmax(y1(h(s j )). After training the entity recognition model, the entity type with the highest output probability is recorded as the entity type corresponding to the input segment.

[0037] During the training of the entity recognition model, the number of layers and neurons in each layer of the neural network are adjusted to minimize the cross-entropy loss function and continuously optimize the entity recognition model. After training the model, the F1-score (harmonic mean of accuracy and recall) is used to evaluate the model on the test set. Before training, the input training data needs to be labeled, including the entities and corresponding entity types in the text. For example, B represents the start of an entity, I represents the middle position of an entity, and O represents not in the entity type set. Example: old B_LOC; gold I_LOC; mountain I_LOC; called O; suffered O; to O; Le B_ATT; search I_ATT; soft I_ATT; team I_ATT; partner I_ATT; network O; attack O. The letters "LOC" and "ATT" after the underscore are entity types.

[0038] Step four: re-encode the entity pair vector.

[0039] Through step three, all entities and corresponding entity types in the sentence Z can be obtained. By pairing entities two by two, a number of entity pairs can be obtained. The relationship extraction model aims to obtain the relationship r ij between the input entity pair s i , s j .∈ R, the set R is the relation set defined in step one, the number of neurons in the output layer of the neural network of the relation extraction model is the number of relations in the defined relation set. In order to more accurately output the relation between the entity pair, the following three operations are performed:

[0040] 1、The two entities in the entity pair are distinguished as subject and object.

[0041] The entity located at the relatively front position of the sentence is regarded as the subject, and the entity located at the relatively rear position of the sentence is regarded as the object. Since the entity s i is composed of several words, the start word and the end word of the subject s i and the object s j are marked. The word vector of the start word of the subject s i increases the identifier <s>, the word vector of the last word is augmented with an identifier symbol< / s> . The word vector of the start word of the object s j increases the identifier <o>, the word vector of the last word is augmented with an identifier symbol< / o> .

[0042] 2、The entity type identifier is added to the input vector of the relation extraction model.

[0043] A unique symbol identifier is defined for each entity type, and then the entity type symbol is added to the start word and the end word of the entity. For example, the symbol of the "attack organization" type is "ORG", and the identifier <org>, at the end of the entity s i the identifier sign is added to the last word< / org> is added to the start word of the entity s i .

[0044] 3、Attribute extraction is performed on the entity recognized by the entity recognition model, and the attribute feature is added to the entity pair vector.

[0045] Since the relation extraction depends not only on the entity and the entity type, but more importantly, which attributes characterize the entity of this type, by performing syntactic analysis on the two entities to be input to the relation extraction model, the attribute features associated with each entity are obtained, and the attribute features are added to the entity pair vector as one of the input features of the relation extraction model. The attribute feature is a property of the corresponding entity, and the attributes associated with the entity are marked when the data set is labeled. For example, the above example "ransomware gang" entity may include the following attributes: country of residence - a certain country, organization leader - a certain organization, establishment time - January 2002; The attribute feature is added to the entity pair vector, that is, the attribute values "a certain country", "a certain organization" and "January 2002" are input into the BERT model to obtain the word vector, and then the word vector of the attribute value is spliced to the rear of the entity pair vector.

[0046] The identifier and attribute used above will obtain the corresponding semantic vector through the pre-training language model BERT.

[0047] Step five: take the entity pair vector as the input of the relation extraction model to obtain the relation of the entity pair.

[0048] The vector representation of the entity s i re-encoded in step four is H(s i ), and the output vector of the relation extraction model neural network for the input entity pair s i , s j is y2(H(s i ), H(s j )), and the probability of the relation r between the entity pair s i , s j is P r (r|s i , s j ) = softmax(y2(H(s i ), H(s j )), and after training the relation extraction model, the relation type with the maximum output probability is recorded as the relation between the input entity pair s i , s j .

[0049] The relation extraction model is similar to the entity recognition model, the model is a feedforward neural network, the loss function is cross-entropy, and the training process is to adjust the parameters to minimize the cross-entropy loss function. The training data needs to be labeled, and the labeling content is <entity A, entity B, the relation between AB>, for example, <ransomware group, a city, attack>.

[0050] Step six: filter and identify the types that cannot be judged by the entity recognition model, and expand the entity type set.

[0051] The entity recognition model will judge the types that cannot be identified as e e , in order to better support network security threat intelligence analysis and network security defense, it is necessary to filter and identify these fragments, filter out the fragments that appear frequently in the actual scene to make judgments, and expand the pre-defined entity type set according to the needs of network security entity recognition.

[0052] The above describes the technical route of the present application, which is intended to enable those skilled in the art to understand the content of the present application and to implement it, and cannot limit the protection scope of the present application. Any equivalent transformation or modification made according to the spirit and essence of the present application shall be covered within the protection scope of the present application.

Claims

1. An entity relationship extraction method in the field of network security, characterized in that, The method comprises the following steps: Obtaining a plurality of source heterogeneous network security data, and performing an exhaustive search on all substrings in each sentence of the network security data to obtain a fragment set of each sentence; obtaining a word vector of all words contained in each fragment to form a semantic matrix of each fragment; Inputting the semantic matrix of each fragment of each sentence into a trained entity recognition model to perform recognition, the entity recognition model being composed of two layers of feedforward neural networks, and performing normalization operation on the recognition result by a normalization exponential function softmax to obtain all entities and corresponding entity types in each sentence; in the two layers of feedforward neural networks, a linear rectifier function is used as an activation function of a first layer of hidden layers, and the number of neurons of a second layer of hidden layers is the same as the number of types in an entity type set; Obtaining a plurality of entity pairs by pairing entities in the same sentence, re-encoding vectors of the entity pairs, adding subject-object boundary identifiers and entity type identifiers of the entities, and extracting attribute features of each entity, adding the subject-object boundary identifiers, the entity type identifiers and the attribute features of the entities to the vectors of the entity pairs, simultaneously obtaining semantic vectors of the subject-object boundary identifiers, the entity type identifiers and the attribute features of the entities, and outputting the encoded entity pair vectors; the subject-object boundary identifiers of the entities are added by marking start words and end words in the subject and the object, specifically, corresponding identifier symbols are added to word vectors of the start words and the end words of the subject, and corresponding identifier symbols are added to word vectors of the start words and the end words of the object; Inputting the encoded entity pair vectors into a trained neural network-based relation extraction model, and recording a relationship type with the maximum output probability after the softmax layer as a relationship existing between the entity pair.

2. The method of claim 1, wherein, The word vectors are obtained by a pre-trained language model BERT.

3. The method of claim 1, wherein, The semantic vectors of the subject-object boundary identifiers, the entity type identifiers and the attribute features of the entities are obtained by the pre-trained language model BERT.

4. The method of claim 1, wherein, The entity types include a general type, a network security personnel type, a network security organization type, a network security asset type, a network security system type and a network security resource type.

5. The method of claim 1 or 4, wherein, An entity type set is formed by the entity types, and a non-deterministic entity type item is further contained in the entity type set to expand according to actual recognition results that do not belong to known entity types; an entity relationship set is formed by relationships between entity pairs and relationships between different entity types, and a non-deterministic entity relationship item is further contained in the entity relationship set to expand according to actual recognition results that do not belong to known entity relationships.

6. The method of claim 5, wherein, The entity recognition model filters and recognizes fragments that cannot be judged, filters out and judges the first several fragments with the highest frequency in actual scenarios, and expands the entity type set by the non-deterministic entity type item according to the requirements of network security entity recognition. 7.A network security entity relationship extraction device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the method in any one of claims 1-6 when executing the program.

8. A computer readable storage medium storing a computer program which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

Images