Network security vulnerability knowledge graph construction method based on HPO-BiLSTM-CRF

Abstract

The application discloses a network security vulnerability knowledge graph construction method based on HPO-BiLSTM-CRF, which comprises the following steps: collecting public vulnerability data from related databases in the network space security field, preprocessing, and constructing a data set; analyzing and extracting existing data source feature information, and constructing a network security vulnerability domain ontology model CSVDO; based on the optimized bidirectional long short-term memory network and the conditional random field fusion model HPO-BiLSTM-CRF, realizing named entity recognition and relationship extraction; adopting an integrated entity alignment method for knowledge fusion, matching different instances of the same object in different ontologies based on an improved similarity measurement algorithm, and constructing a knowledge graph; carrying out knowledge graph embedding, storing the result into a graph database, and completing knowledge graph construction and graphic visualization. The application can improve the efficiency of entity recognition and relationship extraction in network security vulnerability knowledge, and has the advantages of high efficiency and high accuracy compared with other graph construction methods.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically a method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF. Background Technology

[0002] In recent years, attacks and exploits of network vulnerabilities have increased significantly, posing a serious challenge to internet security. In 2021, the U.S. National Vulnerability Database (NVD) reported 18,378 vulnerabilities, averaging 50 Common Vulnerabilities and Exposures (CVEs) per day, a record high. A vulnerability refers to a flaw in the specific implementation of hardware, software, protocols, or system security policies, enabling attackers to access or damage the system without authorization, threatening the integrity, availability, and access control of the system or other applications and data. Therefore, timely analysis of vulnerabilities and threats can not only effectively prevent attackers from launching cyberattacks by exploiting vulnerabilities but also help security analysts better maintain network security.

[0003] Knowledge graphs, a technology proposed by Google, use semantic knowledge for web search to enhance its search engine capabilities. Since then, many companies have developed their own knowledge graphs, such as Wikidata, YAGO, and Freebase. Knowledge graphs describe concepts, entities, and relationships between entities in a structured way. Applying them to the field of computer security can better organize, manage, and utilize the massive amounts of information in cyberspace. The architecture of a knowledge graph consists of three parts: knowledge extraction, knowledge fusion, and knowledge computation and application.

[0004] Early research on knowledge extraction primarily relied on manually written rules and templates, which was time-consuming, labor-intensive, and lacked portability. Deep learning-based methods significantly reduced the dependence on manually constructed features, solving the problem of feature extraction error propagation. Applying Convolutional Neural Networks (CNNs) to named entity recognition greatly improved entity extraction efficiency, but it lost valuable information from long-range words. With the development of attention mechanisms, the inability of traditional CNNs to capture long-term information in sentences was addressed by fusing attention mechanisms with CNNs using different convolutional kernels and residual structures, enhancing the model's ability to capture contextual information. Besides CNNs, Recurrent Neural Networks (RNNs) and their variants are also widely used in entity recognition tasks. Basic models such as Long Short-Term Memory (LSTM) and Bi-directional LSTM, along with their improved versions, have been studied to investigate the effectiveness of word embeddings, character features, and word features in entity recognition, effectively improving entity recognition accuracy.

[0005] Research on knowledge fusion currently falls into two main categories: ontology fusion and data fusion. Ontology fusion methods primarily include those based on Natural Language Processing (NLP), with popular instance-based methods often employing machine learning algorithms. Data fusion encompasses entity merging, entity alignment, and entity attribute fusion. Entity alignment based on similarity propagation transforms the entity alignment problem into a global matching scoring optimization problem, introducing entity relationships and attributes and iteratively discovering all entity matching pairs. Probabilistic model-based entity alignment methods typically utilize statistical relationships for computation, such as Conditional Random Fields (CRF) and Markov Logic Networks (MLR).

[0006] In recent years, commonly used knowledge reasoning models based on distributed features mainly include translation models such as TranE and its variants TransH and TransR, as well as the RESCAL model based on tensor decomposition and the DistMult model based on semantic matching. However, none of these can perfectly satisfy the modeling of all relations, ignoring the semantic diversity of entities and relations. Currently, deep neural networks have also been widely applied in the field of NLP and have achieved significant results. Researchers have designed deep sequence models, using independent RNN units to handle the entity layer and relation layer respectively. Later, a knowledge graph embedding method based on LSTM was proposed, which uses LSTM to encode the sentences describing entities, and then combines TransE with the LSTM model to embed the sentences describing entities, thereby realizing knowledge reasoning. Such neural network models can automatically capture features, map input data from the original space to another feature space through nonlinear transformations, and automatically learn feature representations, making them suitable for abstract tasks of knowledge reasoning.

[0007] Since its inception, knowledge graph technology has been widely applied in various fields both domestically and internationally, but research in the field of cybersecurity is still in its early stages. Currently, some scholars have constructed a vulnerability knowledge graph, VulKG, using a Resource Description Framework (RDF) to store entities and relationships and mapping them to the Neo4j database, proposing a vulnerability chain reasoning method based on the knowledge graph. The main body of VulKG is extracted from NVD, but it does not contain detailed information about CWE and CAPEC. To address the problem of security information being stored in different knowledge bases, making it difficult to integrate all information for real-time and accurate alarm correlation, other scholars have integrated vulnerability knowledge bases, network fundamental knowledge bases, and threat and alarm knowledge bases to construct a unified knowledge graph model. Jia et al. proposed a method for constructing a cybersecurity knowledge graph and inference rules based on a quintuple model. The paper uses machine learning methods (Stanford Named Entity Recognizer, StanfordNER) to achieve entity extraction and constructs a cybersecurity knowledge base based on the constructed ontology. In China, researchers have proposed a method for constructing a cybersecurity knowledge base oriented towards vulnerability databases based on cybersecurity ontology. This method uses rule-based approaches to identify vulnerability-related entities and introduces an entity dictionary into a conditional random field model to identify three types of entities: operating systems, software, and files. The dictionary features improve the effectiveness of cybersecurity entity recognition. However, the problems of high false negative and high false positive rates in entity recognition results still need to be addressed.

[0008] In summary, knowledge graphs, as a strong artificial intelligence tool with cognitive capabilities, have matured, but the following problems still exist in the field of cybersecurity: (1) Research on cybersecurity knowledge graphs is in its initial stage. Existing vulnerability knowledge graphs cannot effectively correlate and analyze multi-source vulnerability data, and the rich semantic information hidden between vulnerabilities needs to be further reasoned and analyzed through knowledge graphs; (2) The identification of entities related to cybersecurity vulnerabilities is still incomplete and inaccurate. This invention proposes a method for constructing a cybersecurity vulnerability knowledge graph based on HPO-BiLSTM-CRF, constructing a novel cybersecurity vulnerability domain ontology five-tuple model CSVDO; based on the optimized bidirectional long short-term memory network and conditional random field fusion model HPO-BiLSTM-CRF, named entity recognition and relation extraction are realized, improving the accuracy of entity recognition and relation extraction in vulnerability knowledge, and constructing a more comprehensive and accurate cybersecurity vulnerability knowledge graph. Summary of the Invention

[0009] The purpose of this invention is to address the problems existing in the prior art by providing a method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF, constructing a novel network security vulnerability domain ontology five-tuple model CSVDO; and based on the optimized bidirectional long short-term memory network and conditional random field fusion model HPO-BiLSTM-CRF, achieving named entity recognition and relation extraction, improving the accuracy of entity recognition and relation extraction in vulnerability knowledge, and constructing a more comprehensive and accurate network security vulnerability knowledge graph.

[0010] The technical solution to achieve the purpose of this invention is as follows: On the one hand, a method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF is provided, including the following steps:

[0011] Step 1: Collect publicly disclosed vulnerability data from relevant databases in the field of cybersecurity using web scraping technology, and preprocess the data to build a dataset;

[0012] Step 2: Analyze and extract the feature information of the data source in the dataset, and construct a network security vulnerability ontology model CSVDO for the target network;

[0013] Step 3: Based on the fusion method of bidirectional long short-term memory network and conditional random field HPO-BiLSTM-CRF with hyperparameter optimization, construct a joint entity and relation extraction model to perform joint entity and relation extraction;

[0014] Step 4: Based on the improved similarity measurement algorithm, match different instances of the same object in different ontologies, and use the integrated entity alignment method for knowledge fusion;

[0015] Step 5: Use the TransE model to embed the knowledge graph and store the results in a graph database to complete the construction and graphical visualization of the target network security vulnerability knowledge graph.

[0016] On the other hand, a network security vulnerability knowledge graph construction system based on HPO-BiLSTM-CRF is provided, the system comprising:

[0017] The first module is used to collect publicly disclosed vulnerability data from databases related to cybersecurity using web crawling technology, and to preprocess and build a dataset.

[0018] The second module is used to analyze and extract feature information from the data sources in the dataset, and to construct a network security vulnerability ontology model CSVDO for the target network.

[0019] The third module is used to implement the HPO-BiLSTM-CRF method, which is based on hyperparameter optimization and combines bidirectional long short-term memory networks with conditional random fields, to construct a joint entity and relation extraction model and perform joint entity and relation extraction.

[0020] The fourth module is used to implement an improved similarity measurement algorithm to match different instances of the same object in different ontologies and to perform knowledge fusion using an integrated entity alignment method.

[0021] The fifth module is used to embed knowledge graphs using the TransE model and store the results in a graph database, thereby completing the construction and graphical visualization of the target network security vulnerability knowledge graph.

[0022] Compared with existing technologies, this invention has the following significant advantages: 1) By collecting multi-source heterogeneous network security vulnerability data and analyzing its characteristics, a series of concept categories and their relationships and attributes in this field are defined, and a CSVDO ontology model for the network security vulnerability field is constructed. This model aims to classify data from multiple dimensions and build a comprehensive vulnerability ontology model, providing a systematic basis for knowledge graph construction. 2) A network security knowledge graph construction method based on HPO-BiLSTM-CRF is proposed. An entity-relationship joint extraction model is constructed by integrating an improved long short-term memory network and a conditional random field, achieving high accuracy in knowledge extraction.

[0023] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0024] Figure 1 This is a flowchart of a method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF.

[0025] Figure 2This is a schematic diagram of a network security vulnerability ontology model CSVDO in one embodiment.

[0026] Figure 3 This is a structural diagram of an entity-relationship extraction model based on HPO-BiLSTM-CRF in one embodiment.

[0027] Figure 4 This is a comparison chart of experimental results for an entity-relation extraction model based on HPO-BiLSTM-CRF in one embodiment.

[0028] Figure 5 Here is a visualization of a cybersecurity vulnerability knowledge graph in one embodiment, wherein Figure 5 (a) in the image is part of a cybersecurity vulnerability knowledge graph. Figure 5 (b) in the diagram is an example of the knowledge graph for the CVE-2011-2351 vulnerability. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] It should be noted that if the embodiments of the present invention involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0031] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0032] In one embodiment, a method for constructing a cybersecurity vulnerability knowledge graph based on HPO-BiLSTM-CRF is provided, the method comprising the following steps:

[0033] Step 1: Collect publicly disclosed vulnerability data from relevant databases in the field of cybersecurity using web scraping technology, and preprocess the data to build a dataset;

[0034] Here, preprocessing includes data cleaning and data classification.

[0035] The data cleaning includes removing duplicate and empty information based on the vulnerability ID, removing special symbols (text language tags, illegal characters, etc.) and code segments;

[0036] The data classification divides it into structured data, semi-structured data, and unstructured data (including but not limited to vulnerability descriptions, APT reports, etc.).

[0037] This step specifically includes:

[0038] Step 1.1: Use web crawling technology to collect publicly available vulnerability data. The publicly available databases in the cybersecurity field include the U.S. National Vulnerability Database (NVD), the Common Vulnerability Disclosure Database (CVE), the Common Weakness Enumeration Database (CWE), the Common Platform Enumeration Database (CPE), and the Common Attack Pattern Enumeration and Classification Database (CAPEC).

[0039] Step 1.2 Clean the unstructured data by removing duplicate and empty information based on the vulnerability ID; remove special symbols (text language tags, illegal characters, etc.) and code segments.

[0040] Step 1.3: Classify the cybersecurity dataset into semi-structured data, structured data, and unstructured data (including but not limited to vulnerability descriptions, APT reports, etc.).

[0041] Step 2: Analyze and extract the feature information of the data source in the dataset, and construct a network security vulnerability ontology model CSVDO for the target network. Figure 2 As shown.

[0042] The cybersecurity vulnerability ontology is defined as a four-tuple model, expressed as equation (1):

[0043] CSVDO=<Concept, Relation, Properties, Instances> (1)

[0044] Here, CSVDO represents Cyber ​​Security Vulnerability Domain Ontology, Concept is the collection of concept classes in the cyber security vulnerability ontology model, Relation is the collection of relationships between cyber security vulnerability-related concept classes, Instances represents the collection of entities, such as the network type concept class containing entities like WAN, LAN, and Ethernet, the operating system class containing entities like Windows, Linux, and MacOS, and Properties is the collection of attributes corresponding to the target model concept classes.

[0045] Specifically, in the network security vulnerability ontology CSVDO model constructed in this invention:

[0046] (1) The Concept class collection contains four dimensions, as shown in equation (2):

[0047] Concept={Device, Network, Fragliity, Attack} (2)

[0048] Wherein, Device represents the set of concept classes at the device level, Network represents the set of concept classes at the network level, Fraglity represents the set of concept classes at the vulnerability level, and Attack represents the set of concept classes at the attack level;

[0049] a) The set of concept classes for the device dimension is shown in equation (3):

[0050] Concept(Device)={Vendor, OS, Hardware, Software} (3)

[0051] Among them, Vendor represents the supplier class, OS represents the operating system class, Hardware represents the hardware class, and Software represents the software class;

[0052] b) The set of concept classes for network dimensions is shown in equation (4):

[0053] Concept(Network)={IP, Type, DomainName, Port, Service, Protocol} (4)

[0054] Where IP represents IP address, Type represents network type, DomainName represents domain name, Port represents port, Service represents the service provided by the port, and Protocol represents network protocol;

[0055] c) The set of concept classes for the vulnerability dimension is shown in Equation (5):

[0056] Concept(Fraglity)={Vulnerability, Weakness} (5)

[0057] Among them, Vunlerability represents the vulnerability class, and Weakness represents the weakness class;

[0058] d) The set of concept classes for attack dimensions is shown in equation (6):

[0059] Concept(Attack)={Group, Attacker, Attack, Concequence} (6)

[0060] Where Group represents the attack organization class, Attacker represents the attacker class, Attack represents the attack class, and Concequence represents the consequences of the attack.

[0061] (2) The Relation class set contains the relationships between the concept classes of the CSVDO model, as shown in Equation (7):

[0062] Relation (CSVDO) = {supplyDevice, hasOS, hasHardware, hasSoftware, expose, belongsTo, hasDNSName, hasIP, hasPort, supplyService, useProtocal, hasVulnerability, relatedCWE, hasAttacker, useWeakness, useAttack, cause, involved} (7)

[0063] Among them, supplyDevice represents the relationship between the supplier and the device; hasOS, hasHardware, and hasSoftware represent the relationship between the device entity and the operating system, hardware, and software entities, respectively; expose represents the relationship between the device and the network; belongsTo, hasDNSName, hasIP, and hasPort represent the relationship between the network and network type, IP address, domain name, and port, respectively; supplyService represents the relationship between the port and the service; useProtocal represents the relationship between the IP address and the protocol; hasVulnerability represents the relationship between the operating system, hardware, and software entities and the vulnerability; relatedCWE represents the relationship between the vulnerability and the weakness; hasAttacker represents the relationship between the attacking organization and the attacker; useWeakness represents the relationship between the attack and the weakness; useAttack represents the relationship between the attacker and the attack; cause represents the relationship between the vulnerability and the potential malicious consequences; and involved represents the relationship between the consequences and the attack.

[0064] (3) Collection of Properties property classes

[0065] a) At the device level, the properties of the Vendor class are represented as in equation (8):

[0066] Properties (Vendor) = {vendorName, orgId, shortName} (8)

[0067] Wherein, vendorName represents the supplier name, orgId represents the organization ID to which the supplier belongs, and shortName represents the supplier's abbreviation.

[0068] b) At the device level, the common attributes of the three classes OS, Hardware, and Software are represented by equation (9):

[0069] Properties(OS|Hardwar|Software)={product, version, versionType} (9)

[0070] Where product represents the device name, version represents the version number, and versionType represents the version type;

[0071] c) In the vulnerability dimension, the properties of the Vulnerability class are represented by equation (10):

[0072] Properties (Vulnerability) = {cveId, cveName, cveDesc, cveType, severLevel, threatType, score, patch, references, datePunlished, dateUpdated} (10)

[0073] Wherein, cveId represents the CVE-ID of the vulnerability, uniquely identifying the vulnerability entity; cveName represents the vulnerability name; cveDesc represents the vulnerability description; cveType represents the vulnerability type; serverLevel represents the severity level; threatType represents the threat type; score represents the vulnerability score; patch represents the vulnerability patch information; references represent the vulnerability reference information; datePunlished represents the release time; and dateUpdated represents the update time.

[0074] d) In the vulnerability dimension, the attributes of the Weakness class are represented by equation (11):

[0075] Properties(Weakness)={cweId,cweName,cweDesc,modeReriod,consequence,likelihood} (11)

[0076] Wherein, cweId represents the CWE-ID of the vulnerability, which is a unique identifier of the vulnerability entity; cweName represents the vulnerability name; cweDesc represents the vulnerability description; modeReriod represents the stage at which the vulnerability may occur; consequences represent the consequences caused by the vulnerability; and likelihood represents the possibility of it being exploited.

[0077] e) In the attack dimension, according to the CACPE attack type enumeration set, the attributes of the Attack class are as shown in equation (12):

[0078] Properties (Attack) = {attackPatternId, attName, attDesc, likelihood, attSeverity, prerequist, executionFlow, mitigations, references, dateSubmitted} (12)

[0079] Among them, attackPatternId represents the attack pattern ID, which can uniquely identify the attacking entity; attName represents the attack name; attDesc represents the attack description; likelihood represents the probability of the attack occurring; attSeverity represents the severity of the attack; prerequist represents the conditions under which the attack occurs; executionFlow represents the attack implementation process; mitigations represent mitigation measures; references represent relevant reference information; and dateSubmitted represents the publication time.

[0080] Furthermore, unstructured data in the cybersecurity field is mainly presented in text form, requiring the use of pre-trained entity recognition models to identify cybersecurity entities and relationships outside of preset categories from the text.

[0081] Step 3: Based on the fusion method of bidirectional long short-term memory network and conditional random field HPO-BiLSTM-CRF with hyperparameter optimization, construct the entity and relation joint extraction model and perform joint entity and relation extraction.

[0082] Step 3 describes the use of the HPO-BiLSTM-CRF-based network security vulnerability knowledge graph construction method to perform named entity recognition on unstructured text, extracting entities and relationships from the unstructured data. The model structure diagram is shown below. Figure 2 As shown. The specific steps include:

[0083] Step 3.1: Traverse the structured and semi-structured data to obtain the relationships between entities and the value of each attribute of an entity, forming <entity, relation, entity> and <entity, attribute, value> triples respectively. For unstructured text, a BiLSTM model is first used for pre-recognition, with the specific steps as follows:

[0084] Step 3.1.1: Select 20% of the network security vulnerability description text as the sample set. Based on the network security vulnerability ontology CSVDO model, manually annotate the entities and relation sequences in the text data. Select 65% as the test set and the remaining 15% as the cross-validation set.

[0085] Step 3.1.2, given the vulnerability description sentence S as shown in equation (13):

[0086] S = {w1, w2, ..., w} n} (13)

[0087] Where n represents the sentence length, w i This represents the i-th word in the description text of a cybersecurity vulnerability;

[0088] Using the word2vec word embedding method, w i Mapped to word vector x i The word vector matrix X of sentence S is shown in equation (14):

[0089] X = {x1, x2, ..., x} n}∈R d (14)

[0090] Where, x i Indicates w i The corresponding word vector sequence, d represents the matrix dimension, and X is the input sequence of the BiLSTM-based network security vulnerability entity-relationship pre-identification model;

[0091] Step 3.1.3: Randomly initialize the weights W of the BiLSTM network. i W f W c W o and bias parameter b i b f b c b o The value of the current hidden layer state of a single-layer LSTM is calculated using the formula (15):

[0092]

[0093] Among them, LSTM(x) t) represents the value of the current hidden state of a single-layer LSTM, and σ is the sigmoid function; x t The input text vector, i.e., the word vector matrix, of the vulnerability entity-relationship pre-identification model built on BiLSTM at time t is h. t-1 It is the hidden state of the previous time step t-1, f t It is the value of the forget gate in a single-layer LSTM network, i t It is the value of the memory gate, c t This is the current state of the network cell, o t It is the value of the model output gate, h t It is a hidden layer state; W i W f W c W o It is the network weight, b i b f b c b o It is a bias parameter;

[0094] Step 3.1.4, for the word vector sequence x input at time t t The forward LSTM encoding process yields a sequence length x equal to the word vector sequence length. t Same text feature vector sequence The backward LSTM encoding process yields a sequence of feature vectors. Will and By concatenating the vectors, we obtain the input word vector sequence x at time t. t Complete feature vector sequence

[0095] Finally, all feature vectors are concatenated to obtain the combined output vector matrix as shown in equation (16):

[0096] H′=[h′1,h′2,...,h′ n (16)

[0097] In the formula, H′ represents the set of word vector labels of the output vulnerability description text after processing by the BiLSTM-based network security vulnerability entity-relationship pre-identification model. The labels represent the preliminary prediction results of the joint entity-relationship extraction. n represents the length of the input sequence text, that is, the length of X in Equation 14, and h′ n This represents the nth eigenvector in the output vector matrix.

[0098] Step 3.2: For the BiLSTM-based network security vulnerability entity and relationship joint identification model constructed in Step 3.1, the population-based hunter-prey optimization (HPO) algorithm is used to optimize its hyperparameters; the specific steps are as follows:

[0099] Step 3.2.1: Randomly initialize the number of population members n and the maximum number of iterations MaxIt; randomly initialize the predator position information matrix p in the population, where p represents the hyperparameter combination matrix of the network during the optimization process, as shown in Equation (17):

[0100]

[0101] Where, p i ={p i，1 P i，2 , ..., P i，d} represents a combination of hyperparameters, 1≤i≤n, and the length d of the combination vector is equal to the number of parameters to be optimized;

[0102] Step 3.2.2: Use the parameters of the constructed BiLSTM-based network security vulnerability entity-relationship pre-identification model as the optimization objective. The parameters include the number of iterations, the learning rate, and the number of hidden layer nodes.

[0103] p for each individual predator in the population i Treating it as a combination of hyperparameters, we initialize the BiLSTM-based network security vulnerability entity-relationship pre-identification model by using the word vector matrix of the vulnerability description text as input data for training.

[0104] Step 3.2.3: Based on the predicted labels output by the BiLSTM network layers, calculate the current hyperparameter combination p in the population. i The adaptive value Z, combined with the objective of the entity recognition task, is calculated using the formula (18):

[0105]

[0106] Among them, correct num It is the number of correctly predicted word vector labels. num It predicts the total number of tags;

[0107] Compare the adaptive values ​​and record the optimal parameter position T. pos ;

[0108] Step 3.2.4: Calculate and sort the distance between each individual's position and the average position. The position furthest from the average position is considered the target search position for the hyperparameter combination, i.e., the prey position P in the population. posThe calculation formula is shown in equation (19):

[0109] P pos =p i |Max(sort(Dis(p i ))) (19)

[0110] Among them, Dis(p i ) represents an individual p in the population. i The Euclidean distance from the average position is calculated using the formula shown in equation (20):

[0111]

[0112] Where μ represents the average value at all locations, and d represents p i The length of the vector with μ, where j represents the j-th element of the vector, p i，j μ j They represent p respectively i The j-th element in μ;

[0113] Step 3.2.5: Determine whether the maximum number of iterations has been reached. If so, take the position of the individual with the optimal hyperparameter combination as the result to obtain the optimal BiLSTM recognition model training dataset; otherwise, iteratively search for the position of the target hyperparameter combination, as shown in Equation (21):

[0114]

[0115] Where, p i (t) is the current target search position, p i (t+1) is the position of the next iteration, a is a random number in the range [-1, 1], b is a random number in the range [0, 1], β is an adjustment parameter, and T pos It is the location of the globally optimal hyperparameter combination;

[0116] The adaptive parameter Z is calculated according to equation (18); the equilibrium parameter C of the HPO algorithm is calculated according to equation (22), and its value decreases continuously during the iteration process.

[0117]

[0118] Where it is the current iteration number and MaxIt is the maximum iteration number.

[0119] Step 3.3 introduces an attention mechanism to calculate the importance of the correlation between the input and output vectors of the network layer. The specific steps are as follows:

[0120] Step 3.3.1: Based on the optimal hyperparameters obtained in Step 3.2, construct an optimized training dataset for the BiLSTM-based network security vulnerability entity and relationship joint identification model. For each vulnerability description text input, output a set of optimal label sequences H′, as shown in Equation (24):

[0121] H′=[h′1,h′2,...,h′ n ] (twenty four)

[0122] Step 3.3.2 introduces an attention mechanism to calculate the importance of the correlation between the input vulnerability text vector and the output predicted label vector of the BiLSTM-based network security vulnerability entity and relationship joint identification model, thereby realizing the extraction of local important features. The calculation formula is shown in Equation (25):

[0123]

[0124] Where H′∈R d×n d is the set of labels for the vulnerability text output by the BiLSTM network layer, where d is the dimension of the word vectors, n is the sentence length, and μ is the parameter vector obtained during training. T Let μ be the transpose of μ; r is the vector representation of the vulnerable sentence; and H″ is the sentence vector representation after processing by the attention mechanism layer.

[0125] Step 3.4, at the CRF layer, adds constraint correction to the predicted labels of the vulnerability description text to ensure the rationality of the output word labels, specifically including:

[0126] Step 3.4.1: Predefine the characteristic function f of the linear chain conditional random field model. θ , including state characteristic function s l (y i , x,i)=H″ and the transition characteristic function t k (y i-1 y i ,x,i)=A; where, y i-1 y i Let x and y represent the labels at the (i-1)th and ith positions of the sequence to be labeled, respectively. x is the sequence to be labeled, and i represents the current position of the sequence. H″ represents using the set of word vector labels of the vulnerable sentence as the initial state feature function, and A represents randomly initializing the transition matrix as the transition feature function. The matrix element A... ij This represents the probability of transitioning from word vector label i to label j;

[0127] Step 3.4.2, train the CRF model for joint extraction of vulnerability entities and relationships. First, determine the weight parameters θ of the feature function, as shown in equation (26):

[0128] θ=(μ1,μ2,...,μl;λ1,λ2,...,λ k (26)

[0129] Where, μ l State characteristic function s l The weighting parameter, λ k These are the weight parameters for the transition feature function;

[0130] Given a sequence of vulnerable text inputs, the formula for calculating the optimal state score for each word in the sentence is shown in equation (27):

[0131]

[0132] Where x represents the input sequence of vulnerability text, y represents the output sequence of predicted labels, and θ is the model weight parameter. [A] i，j This represents the probability of moving from label i of the previous word t-1 to label j of the target word t; Let T represent the feature score of label i assigned to word t in the input sequence, where T represents the number of words;

[0133] For the training set {(x1, y1), (x2, y2), ..., (x... n y n The transition matrix A and weight parameters θ are calculated using the maximum likelihood estimation method.

[0134] Step 3.4.3, after the CRF layer training is completed, for each word w in the sentence sequence of the vulnerability description text described in equation (14) i This yields a corresponding predicted label sequence T = {T1, T2, ..., T}. k}, where k represents the number of tags;

[0135] Dynamic programming to find k n The optimal path among the paths yields the optimal labeled sequence set Y = (y1, y2, ..., y...). n ); where y i The word "w" in the vulnerability text i The corresponding output labels.

[0136] Step 3.5, Figure 4This paper showcases the performance metrics of the proposed HPO-BiLSTM-CRF model compared to other models on the same dataset. These include the original Long Short-Term Memory (LSTM) network model, the BiLSTM model with added bidirectional propagation, the BiLSTM-CRF model incorporating a Conditional Random Field (CRF), and the BiLSTM-Att-CRF model with added attention. The model's recognition performance is evaluated based on four metrics: accuracy, precision, recall, and F1 score. It can be seen that the HPO-BiLSTM-CRF model demonstrates its effectiveness across all four metrics.

[0137] Step 4: Based on the improved similarity measurement algorithm, match different instances of the same object in different ontologies, and perform knowledge fusion using an integrated entity alignment method; specifically including:

[0138] Step 4.1: Obtain records x and y of the entity to be merged in adjacent knowledge sources and the same type of entity in the current knowledge graph, and represent their attribute values ​​as word sets, as shown in equation (28):

[0139]

[0140] Where, x p With y p Let x and y be the sets of attribute values ​​for the vulnerable entities x and y in a network security vulnerability, respectively. pi and y pi Let x and y represent the i-th attribute values ​​of x and y respectively, and n represent the length of the attribute set;

[0141] Step 4.2: Calculate the average edit distance of all elements in the attribute value sets of x and y using dynamic programming;

[0142] First, calculate the minimum edit distance for a single attribute value, for x. pi and y pi The dynamic programming array initialization formula is shown in equation (29):

[0143]

[0144] Where len(x) pi ) and len(y pi ) represent attribute values ​​x respectively pi and y pi The length of the string; x pi and y pi The derivation formula for the minimum edit distance is shown in equation (30):

[0145]

[0146] The minimum edit distance is normalized and the attribute similarity between entities x and y is calculated using the formula shown in equation (31):

[0147]

[0148] Where, sim(x) p y p ) represents the attribute similarity between x and y, n represents the length of the attribute set, and D(len(x) represents the similarity between x and y. pi ), len(y pi )) represents the edit distance of the i-th attribute derived by dynamic programming;

[0149] Step 4.3: Obtain the set of important relations between entity records x and y, and map them into a set of word vectors using the word2vec word embedding method, as shown in equation (32):

[0150]

[0151] Where, x r and y r Let x and y represent the sets of important relations, respectively. ri and y ri Let x and y represent the i-th relation respectively, and m represent the length of the relation vector;

[0152] The cosine similarity is used to calculate the similarity sim(x) between the vulnerable entities x and y. r y r As shown in equation (33):

[0153]

[0154] Step 4.4 introduces a weight γ for weighting attribute similarity and relation similarity. The entity similarity between the vulnerability entities x and y is shown in equation (34):

[0155]

[0156] Where Sim(x, y) represents the similarity between vulnerable entities x and y;

[0157] Step 4.5: Determine whether the similarity in Step 4.4 is greater than the threshold. If the similarity is less than the threshold, it means that there is no entity in the current knowledge graph that is the same as the entity to be merged. Then, add the entity to be merged to the knowledge graph.

[0158] Step 5: Embed the knowledge graph using the TransE model and store the results in a graph database to complete the construction and graphical visualization of the target cybersecurity vulnerability knowledge graph. The specific steps are as follows:

[0159] Step 5.1: Use the TransE model to learn the entities and relations in the vulnerability knowledge base. For each fact triple (h, r, t) in the knowledge graph, map it to the same plane space. Specifically, the relation vector r is regarded as a translation between the head entity vector h and the tail entity vector t. The specific calculation formula is shown in equation (35):

[0160] h+r=t (35)

[0161] The calculation method for the scoring function is shown in equation (25):

[0162]

[0163] Step 5.2: The extracted entities are used as a node set and the relationships as an edge set. The vulnerability semantic information is then stored in the Neo4j graph database in batches using the Py2neo library and the Load_CSV statement, allowing visualization of the relationships between nodes and attributes, and between nodes themselves.

[0164] Figure 5 (a) shows a portion of the knowledge graph. Blue nodes represent CWE vulnerability instances, red nodes represent CVE vulnerability instances, and yellow and green nodes connect the object attributes and data attributes of CVEs. Figure 5 (b) in the diagram is a visualized knowledge graph of the CVE-2011-2351 vulnerability.

[0165] In one embodiment, a network security vulnerability knowledge graph construction system based on HPO-BiLSTM-CRF is provided, the system comprising:

[0166] The first module is used to collect publicly disclosed vulnerability data from databases related to cybersecurity using web crawling technology, and to preprocess and build a dataset.

[0167] The second module is used to analyze and extract feature information from the data sources in the dataset, and to construct a network security vulnerability ontology model CSVDO for the target network.

[0168] The third module is used to implement the HPO-BiLSTM-CRF method, which is based on hyperparameter optimization and combines bidirectional long short-term memory networks with conditional random fields, to construct a joint entity and relation extraction model and perform joint entity and relation extraction.

[0169] The fourth module is used to implement an improved similarity measurement algorithm to match different instances of the same object in different ontologies and to perform knowledge fusion using an integrated entity alignment method.

[0170] The fifth module is used to embed knowledge graphs using the TransE model and store the results in a graph database, thereby completing the construction and graphical visualization of the target network security vulnerability knowledge graph.

[0171] Specific limitations regarding the HPO-BiLSTM-CRF-based network security vulnerability knowledge graph construction system can be found in the limitations of the HPO-BiLSTM-CRF-based network security vulnerability knowledge graph construction method described above, and will not be repeated here. Each module in the aforementioned HPO-BiLSTM-CRF-based network security vulnerability knowledge graph construction system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0172] The method of this invention can improve the efficiency of entity identification and relation extraction in network security vulnerability knowledge. Compared with other network security vulnerability knowledge graph construction methods, this method has the advantages of high efficiency and high accuracy.

[0173] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention without departing from its spirit and scope should be included within the protection scope of the present invention.

Claims

1. A method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF, characterized in that, The method includes the following steps: Step 1: Collect publicly disclosed vulnerability data from relevant databases in the field of cybersecurity using web scraping technology, and preprocess the data to build a dataset; Step 2: Analyze and extract the feature information of the data source in the dataset, and construct a network security vulnerability ontology model CSVDO for the target network; Step 3: Based on the fusion method of bidirectional long short-term memory network and conditional random field HPO-BiLSTM-CRF with hyperparameter optimization, construct a joint entity and relation extraction model to perform joint entity and relation extraction; Step 4: Based on the improved similarity measurement algorithm, match different instances of the same object in different ontologies, and use the integrated entity alignment method for knowledge fusion; Step 5: Use the TransE model to embed the knowledge graph and store the results in the graph database to complete the construction and graphical visualization of the target network security vulnerability knowledge graph. Step 3 specifically involves constructing an end-to-end network security vulnerability entity-relationship joint extraction model based on HPO-BiLSTM-CRF for unstructured vulnerability data. This model performs entity recognition and relation extraction on the text data. The specific process includes: Step 3.1: Based on the Bi-directional Long Short-Term Memory (BiLSTM) network, a preliminary joint pre-identification model of vulnerability entity-relationship is constructed, namely, the BiLSTM-based network security vulnerability entity-relationship pre-identification model, which obtains the predicted label score of the entity type or relationship corresponding to each word in the vulnerability description text input sequence. Step 3.2: For the BiLSTM-based network security vulnerability entity and relationship joint identification model constructed in Step 3.1, the population-based predator optimization algorithm HPO is used to optimize its hyperparameters. Step 3.3 introduces an attention mechanism to calculate the importance of the correlation between the input vector and the output vector of the network layer; Step 3.4: At the CRF layer, add constraint correction to the predicted labels of the vulnerability description text.

2. The method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF according to claim 1, characterized in that, In step 2, the network security vulnerability ontology is defined as a four-tuple model, expressed as equation (1): （1） in, Represents the ontology of cybersecurity vulnerabilities. It is a collection of conceptual classes in the cybersecurity vulnerability ontology model. It is a collection of relationships between concept classes related to network security vulnerabilities. Represents a set of entities. It is the set of attributes corresponding to the target model concept class.

3. The method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF according to claim 2, characterized in that, In the cybersecurity vulnerability ontology model CSVDO constructed in step 2: (1) The Concept class collection contains four dimensions, as shown in equation (2): （2） in, This represents a collection of concept classes representing the device dimension. A collection of concept classes representing network dimensions. A collection of concept classes representing the vulnerability dimension. A collection of concept classes representing attack dimensions; a) The set of concept classes for the device dimension is shown in equation (3): （3） in, Indicates the supplier class. Represents the operating system class. Indicates hardware class, Represents a software class; b) The set of concept classes for the network dimension is shown in equation (4): （4） in, Indicates IP address, Indicates the network type. Indicates the domain name, Indicates the port. Indicates the services provided by the port. Indicates network protocol; c) The set of concept classes for the vulnerability dimension is shown in equation (5): （5） in, Indicates a vulnerability class. Represents a weakness class; d) The set of concept classes for the attack dimension is shown in equation (6): （6） in, Indicates an attack organization class. Represents the attacker class. Indicates an attack class. Indicates the consequences of the attack; (2) The Relation class set contains the relationships between the concept classes of the CSVDO model, as shown in Equation (7): （7） in, This indicates the relationship between the supplier and the equipment. , , These represent the relationships between the device entity and the operating system, hardware, and software entities, respectively. This indicates the relationship between the device and the network. These represent the relationships between networks and network types, domain names, IP addresses, and ports, respectively. This indicates the relationship between ports and services. This indicates the relationship between IP addresses and protocols. This describes the relationship between operating systems, hardware, software entities, and vulnerabilities. This indicates the relationship between vulnerabilities and weaknesses. This indicates the relationship between the attacking organization and the attacker. This indicates the relationship between attack and weakness. This indicates the relationship between the attacker and the attack. This indicates the relationship between vulnerabilities and their potential malicious consequences. This indicates the relationship between the consequences and the attack; (3) Collection of Properties attribute classes a) At the device level, the properties of the Vendor class are represented as in equation (8): （8） in, Indicates the supplier's name. Indicates the supplier's organization ID. Indicates the supplier's abbreviation; b) At the device level, the common attributes of the three classes OS, Hardware, and Software are represented by equation (9): （9） in, Indicates the device name. Indicates the version number. Indicates the version type; c) In the vulnerability dimension, the properties of the Vulnerability class are represented by equation (10): （10） in, The CVE-ID represents a vulnerability and uniquely identifies the vulnerable entity. Indicate the vulnerability name, Indicates the vulnerability description. Indicate the vulnerability type, Indicates the level of hazard. Indicates the type of threat. Represents vulnerability score, Represents vulnerability patch information. This represents vulnerability reference information. Indicates the release time. Indicates the update time; d) In the vulnerability dimension, the attributes of the Weakness class are represented by equation (11): （11） in, The CWE-ID represents the vulnerability, which uniquely identifies the vulnerable entity. Indicates the name of the weakness. This indicates a description of weaknesses. This indicates a stage where weaknesses may emerge. This indicates the consequences of weaknesses. This indicates the possibility of being exploited; e) In the attack dimension, based on the CACPE attack type enumeration set, the attributes of the Attack class are as shown in equation (12): （12） in, The attack mode ID uniquely identifies the attacking entity. Indicates the attack name. Indicates an attack description. Indicates the likelihood of an attack occurring. This indicates the severity of the attack. Indicates the conditions under which an attack occurs. This indicates the process of carrying out the attack. Indicates relief measures, This indicates information cited from relevant sources. Indicates the publication time.

4. The method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF according to claim 1, characterized in that, The specific process of step 3.1 is as follows: Step 3.1.1: Select 20% of the network security vulnerability description text as the sample set. Based on the network security vulnerability ontology CSVDO model, manually annotate the entities and relation sequences in the text data. Select 65% as the test set and the remaining 15% as the cross-validation set. Step 3.1.2, given the vulnerability description sentence as shown in equation (13). : （13） Where n represents the sentence length. This represents the i-th word in the description text of a cybersecurity vulnerability; Using the word2vec word embedding method, Mapping to word vectors The word vector matrix of sentence S As shown in equation (14): （14） in, express The corresponding word vector sequence, Represents the matrix dimension. It is the input sequence of a BiLSTM-based network security vulnerability entity-relationship pre-identification model; Step 3.1.3: Randomly initialize the weights of the BiLSTM network. , , , and bias parameters , , , The value of the current hidden layer state of a single-layer LSTM is calculated using the formula (15): （15） in, It is the value of the current hidden layer state of a single-layer LSTM. It is the sigmoid function; It is the input text vector, i.e., the word vector matrix, of the vulnerability entity-relationship pre-identification model built on BiLSTM at time t. It is the hidden layer state at the previous time step t-1. It is the value of the forget gate in a single-layer LSTM network. It is the value of the memory gate. This is the current state of the network cells. It is the value of the model output gate. It is a hidden layer state; , , , It is network weight. , , , It is a bias parameter; Step 3.1.4, for the word vector sequence input at time t The forward LSTM encoding process obtains the length of the word vector sequence. Same text feature vector sequence The backward LSTM encoding process yields the feature vector sequence. ;Will and By concatenating the vectors, we obtain the input word vector sequence at time t. Complete feature vector sequence ; Finally, all feature vectors are concatenated to obtain the combined output vector matrix as shown in equation (16): （16） In the formula, This represents the set of word vector labels for the output vulnerability description text after processing by the BiLSTM-based network security vulnerability entity-relationship pre-identification model. The labels represent the preliminary prediction results of the joint entity-relationship extraction, and n represents the length of the input sequence text, i.e., the length of X in equation (14). This represents the nth eigenvector in the output vector matrix.

5. The method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF according to claim 4, characterized in that, The specific process of step 3.2 includes: Step 3.2.1: Randomly initialize the number of population members n and the maximum number of iterations MaxIt; randomly initialize the predator location information matrix in the population. , The hyperparameter combination matrix representing the network during the optimization process is shown in equation (17): （17） in, Represents a combination of hyperparameters. The length d of the combined vector is equal to the number of parameters to be optimized; Step 3.2.2: Use the parameters of the constructed BiLSTM-based network security vulnerability entity-relationship pre-identification model as the optimization objective. The parameters include the number of iterations, the learning rate, and the number of hidden layer nodes. Each individual predator in the population Treating it as a combination of hyperparameters, we initialize the BiLSTM-based network security vulnerability entity-relationship pre-identification model by using the word vector matrix of the vulnerability description text as input data for training. Step 3.2.3: Calculate the current hyperparameter combination in the population based on the predicted labels output by the BiLSTM network layers. The adaptive value Z, combined with the objective of the entity recognition task, is calculated using the formula (18): （18） in, It is the number of correctly predicted word vector labels. It predicts the total number of tags; Compare the adaptive values ​​and record the optimal parameter position. ; Step 3.2.4: Calculate and sort the distance between each individual's position and the average position. The position farthest from the average position is considered the target search position for the hyperparameter combination, i.e., the prey position in the population. The calculation formula is shown in equation (19): （19） in, Represents individuals in a population The Euclidean distance from the average position is calculated using the formula shown in equation (20): （20） in, d represents the average value across all locations. and The length of the vector, where j represents the j-th element of the vector. They represent The j-th element in; Step 3.2.5: Determine if the maximum number of iterations has been reached. If so, take the position of the individual with the optimal hyperparameter combination as the result to obtain the optimal BiLSTM recognition model training dataset; otherwise, iteratively search for the position of the target hyperparameter combination, as shown in equation (21): （21） in, This is the current target search location. It is the position of the next iteration. It is a random number in the range [−1, 1]. It is a random number in the range [0,1]. It is an adjustable parameter. It is the location of the globally optimal hyperparameter combination; The adaptive parameter Z is calculated according to equation (18); the equilibrium parameter C of the HPO algorithm is calculated according to equation (22), and its value decreases continuously during the iteration process: （22） in, It is the current iteration number. It represents the maximum number of iterations.

6. The method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF according to claim 5, characterized in that, Step 3.3 specifically includes: Step 3.3.1: Based on the optimal hyperparameters obtained in Step 3.2, construct an optimized training dataset for the BiLSTM-based joint identification model of network security vulnerability entities and relationships. For each vulnerability description text input, output a set of optimal label sequences. As shown in equation (24): （24） Step 3.3.2 introduces an attention mechanism to calculate the importance of the correlation between the input vulnerability text vector and the output predicted label vector of the BiLSTM-based network security vulnerability entity and relationship joint identification model, thereby realizing the extraction of local important features. The calculation formula is shown in Equation (25): （25） in, It is the set of tags for the vulnerability text output by the BiLSTM network layer. It is the dimension of the word vector. It refers to sentence length; It is the parameter vector obtained through training. express transpose; It is the vector representation of the vulnerability sentence. It is the sentence vector representation after processing by the attention mechanism layer.

7. The method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF according to claim 6, characterized in that, Step 3.4 describes adding constraint correction to the predicted labels of the vulnerability description text at the CRF layer, specifically including: Step 3.4.1: Predefine the characteristic functions of the linear chain conditional random field model. Includes state characteristic functions With the transition characteristic function ;in, These represent the labels at positions i-1 and i-th of the sequence to be labeled, respectively. It is a sequence to be labeled. Indicates the current position of the sequence to be labeled; This indicates that the set of word vector labels for the vulnerable sentence is used as the initial state feature function. This indicates that the transition matrix is ​​randomly initialized as the transition characteristic function, and the matrix elements... This represents the probability of transitioning from word vector label i to label j; Step 3.4.2: Train the CRF model for joint extraction of vulnerable entities and relationships. First, determine the weight parameters of the feature functions. As shown in equation (26): （26） in, State characteristic function The weight parameters, These are the weight parameters for the transition feature function; Given a sequence of vulnerable text inputs, the formula for calculating the optimal state score for each word in the sentence is shown in equation (27): （27） in, This represents the input sequence of vulnerable text. This represents the output predicted label sequence. These are the model weight parameters. Indicates the preceding word tags Transfer to target word tags The probability of; Represented as words in the input sequence Assigned tags The characteristic scores, Indicates the number of words; For the training set The transition matrix is ​​calculated using the maximum likelihood estimation method. and weight parameters ; Step 3.4.3: After the CRF layer training is completed, for each word in the sentence sequence of the vulnerability description text described in equation (14) This yields a corresponding predicted label sequence. ,in, Indicates the number of tags; Dynamic programming search The optimal path among the paths yields the optimal set of labeled sequences. ;in, Words in the vulnerability text The corresponding output labels.

8. The method for constructing a network security vulnerability knowledge graph based on HPO-BiLSTM-CRF according to claim 7, characterized in that, Step 4, based on the improved similarity measurement algorithm, matches different instances of the same object in different ontologies and performs knowledge fusion using an integrated entity alignment method, specifically including: Step 4.1: Obtain records x and y of the entity to be merged in adjacent knowledge sources and the same type of entity in the current knowledge graph, and represent their attribute values ​​as word sets, as shown in equation (28): （28） in, and These are the sets of attribute values ​​for vulnerable entities x and y in a network security vulnerability, respectively. and Let x and y represent the i-th attribute values ​​of x and y respectively, and n represent the length of the attribute set; Step 4.2: Calculate the average edit distance of all elements in the attribute value sets of x and y using dynamic programming; First, calculate the minimum edit distance for a single attribute value. and The dynamic programming array initialization formula is shown in equation (29): （29） in, and Representing attribute values and The length of the string; and The derivation formula for the minimum edit distance is shown in equation (30): （30） The minimum edit distance is normalized and the attribute similarity between entities x and y is calculated using the formula shown in equation (31): （31） in, Let represent the attribute similarity between x and y, and n represent the length of the attribute set. This represents the edit distance of the i-th attribute derived by dynamic programming; Step 4.3: Obtain the set of important relations between entity records x and y, and map them into a set of word vectors using the word2vec word embedding method, as shown in equation (32): （32） in, and Let x and y represent the i-th relation respectively, and m represent the length of the relation vector; Cosine similarity is used to calculate the similarity between the vulnerable entities x and y. As shown in equation (33): （33） Step 4.4, introduce weights The weighting of attribute similarity and relation similarity is used for the entity similarity of vulnerable entities x and y, as shown in equation (34): （34） in, Indicates the similarity between vulnerable entities x and y; Step 4.5: Determine whether the similarity in Step 4.4 is greater than the threshold. If the similarity is less than the threshold, it means that there is no entity in the current knowledge graph that is the same as the entity to be merged. Then, add the entity to be merged to the knowledge graph.

9. A network security vulnerability knowledge graph construction system based on HPO-BiLSTM-CRF, using the method described in any one of claims 1 to 8, characterized in that, The system includes: The first module is used to collect publicly disclosed vulnerability data from databases related to cybersecurity using web crawling technology, and to preprocess and build a dataset. The second module is used to analyze and extract feature information from the data sources in the dataset, and to construct a network security vulnerability ontology model CSVDO for the target network. The third module is used to implement the HPO-BiLSTM-CRF method, which is based on hyperparameter optimization and combines bidirectional long short-term memory networks with conditional random fields, to construct a joint entity and relation extraction model and perform joint entity and relation extraction. The fourth module is used to implement an improved similarity measurement algorithm to match different instances of the same object in different ontologies and to perform knowledge fusion using an integrated entity alignment method. The fifth module is used to embed knowledge graphs using the TransE model and store the results in a graph database, thereby completing the construction and graphical visualization of the target network security vulnerability knowledge graph.

Images