Network threat intelligence processing method, device, electronic device and storage medium

Abstract

The embodiments of the present application provide a network threat intelligence processing method, device, electronic device and storage medium, which belongs to the field of network security technology. The method includes: based on a pre-set extraction model, extracting triple features from the acquired sample intelligence information to obtain positive samples and negative samples; using the initial generator to obtain negative samples that match the number of positive samples after amplification and update; using the initial discriminator to discriminate the positive samples and the negative samples after amplification, and training the generator and discriminator according to the discrimination results to obtain the trained discriminator; obtaining target intelligence information, and based on the extraction model, extracting triple features from the target intelligence information to obtain positive information and negative information; inputting the positive information and negative information into the trained discriminator to obtain target extraction information. The present application can improve the accuracy and efficiency of extracting the relationship between named entities in network threat intelligence.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network threat intelligence processing method, device, electronic device and storage medium. Background Art

[0002] At present, cybersecurity incidents occur frequently with the continuous development of Internet technology, which seriously affects the information security of individuals, enterprises and society. Cyber ​​Threat Intelligence (CTI) refers to information about potential and persistent threats related to network security and infrastructure. Analyzing cyber threat intelligence can help identify and respond to cyber attacks, and plays an important role in maintaining network security.

[0003] In the related art, the relationship between the named entities of network threat intelligence is defined by manually formulating network threat rules, so as to determine the threat relationship corresponding to the queried named entity that is logically matched with the formulated rules in the network threat intelligence. However, such a network threat intelligence processing method relies on manual experience and requires a lot of time to accurately define threat rules, which leads to inaccurate and inefficient analysis of the threat relationship between the named entities of network threat intelligence. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a network threat intelligence processing method, device, electronic device and storage medium, aiming to improve the accuracy and efficiency of extracting relationships between named entities in network threat intelligence.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a network threat intelligence processing method, the method comprising:

[0006] Acquire sample intelligence information, and perform triple feature extraction on the sample intelligence information based on a pre-set extraction model to obtain positive samples representing true threat relationships between multiple named entities and negative samples representing false threat relationships between multiple named entities;

[0007] Inputting the negative samples into the initial generator, introducing disturbance noise based on the sample features of the negative samples, so as to generate and obtain the negative samples that match the number of the positive samples after amplification and updating;

[0008] Using the initial discriminator to discriminate the positive samples and the negative samples after the number increase, and training the generator and the discriminator according to the discrimination results to obtain the trained discriminator;

[0009] Acquire target intelligence information, and perform triple feature extraction on the target intelligence information based on the extraction model to obtain positive information and negative information;

[0010] The positive information and the negative information are input into the trained discriminator to obtain target extraction information.

[0011] In some embodiments, the step of training the generator and the discriminator according to the discrimination result to obtain the trained discriminator includes:

[0012] Obtaining sample verification information corresponding to the sample intelligence information;

[0013] Using an initial discriminator to discriminate the positive sample and the negative sample, to obtain a positive evaluation score representing the degree of difference between the positive sample and the sample verification information, and a negative evaluation score representing the degree of difference between the negative sample and the sample verification information;

[0014] Adjusting a first parameter of the initial generator according to the negative evaluation score to obtain the trained generator;

[0015] The second parameter of the initial discriminator is adjusted according to the positive evaluation score and the negative evaluation score to obtain the trained discriminator.

[0016] In some embodiments, the negative sample includes a negative head named entity, a negative tail named entity, and false threat relationship information corresponding to the negative head named entity and the negative tail named entity;

[0017] The negative evaluation score is obtained by the following steps, which include:

[0018] Based on the sample verification information, calculating a first similarity distance between the negative head named entity and the false threat relationship information, and calculating a second similarity distance between the negative tail named entity and the false threat relationship information;

[0019] The first similarity distance and the second similarity distance are weightedly calculated according to a first relationship weight corresponding to the first similarity distance and a second relationship weight corresponding to the second similarity distance to obtain the negative evaluation score.

[0020] In some embodiments, adjusting the first parameter of the initial generator according to the negative evaluation score to obtain the trained generator includes:

[0021] Calculating a negative sample expected value corresponding to the negative evaluation score, determining a first loss value based on the negative sample expected value, and performing a derivative operation on the first loss value to obtain gradient information;

[0022] The strategy gradient direction is adjusted according to the gradient information, and the first parameter of the generator is adjusted according to the adjusted strategy gradient direction until a preset first condition is reached, thereby obtaining the trained generator, and the trained generator is used to perform sample amplification on the negative sample input next time.

[0023] In some embodiments, the positive sample includes a positive head named entity, a positive tail named entity, and real threat relationship information corresponding to the positive head named entity and the positive tail named entity;

[0024] The positive evaluation score is obtained by the following steps, which include:

[0025] Based on the sample verification information, calculating a third similarity distance between the head named entity and the real threat relationship information, and calculating a fourth similarity distance between the tail named entity and the real threat relationship information;

[0026] The third similarity distance and the fourth similarity distance are weightedly calculated according to the third relationship weight corresponding to the third similarity distance and the fourth relationship weight corresponding to the fourth similarity distance to obtain the positive evaluation score.

[0027] In some embodiments, adjusting the second parameter of the initial discriminator according to the positive evaluation score and the negative evaluation score to obtain the trained discriminator includes:

[0028] Based on a preset boundary parameter, calculating a score difference between the positive evaluation score and the negative evaluation score;

[0029] Adding the fractional differences that are positive values ​​to obtain a second loss value;

[0030] The second parameter of the discriminator is adjusted according to the second loss value until a preset second condition is reached, thereby obtaining the trained discriminator, and the trained discriminator is used to discriminate the positive samples and the negative samples input next time.

[0031] In some embodiments, after obtaining the sample intelligence information, the method further includes:

[0032] Based on a preset context embedding model, semantic processing is performed on the sample intelligence information to obtain sample embedding information corresponding to the sample intelligence information;

[0033] The using the initial discriminator to discriminate the positive sample and the negative sample after the number is amplified includes:

[0034] The sample embedding information, the positive sample and the negative sample after the number is amplified are input into an initial discriminator, and the positive sample and the negative sample after the number is amplified are discriminated by the initial discriminator with the sample embedding information as a constraint condition to obtain a discrimination result.

[0035] In some embodiments, inputting the positive information and the negative information into the trained discriminator to obtain target extraction information includes:

[0036] Based on the context embedding model, semantic processing is performed on the target intelligence information to obtain target embedding information corresponding to the target intelligence information;

[0037] Taking the target embedded information as a constraint condition, the trained discriminator is used to discriminate the positive information and the negative information to obtain a discrimination result, and the positive information or the negative information whose discrimination result is less than a preset discrimination threshold is determined as the target extracted information.

[0038] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a network threat intelligence processing device, the device comprising:

[0039] A sample acquisition module is used to acquire sample intelligence information and perform triple feature extraction on the sample intelligence information based on a pre-set extraction model to obtain positive samples representing real threat relationships between multiple named entities and negative samples representing false threat relationships between multiple named entities;

[0040] A negative sample amplification module, used to input the negative sample into the initial generator, introduce disturbance noise based on the sample characteristics of the negative sample, so as to generate and obtain the negative sample whose number matches the positive sample after amplification and updating;

[0041] A training module, used to use the initial discriminator to discriminate the positive samples and the negative samples after the number is amplified, and train the generator and the discriminator according to the discrimination results to obtain the trained discriminator;

[0042] A target acquisition module is used to acquire target intelligence information and perform triple feature extraction on the target intelligence information based on the extraction model to obtain positive information and negative information;

[0043] The target discrimination module is used to input the positive information and the negative information into the trained discriminator to obtain target extraction information.

[0044] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the network threat intelligence processing method described in the first aspect when executing the computer program.

[0045] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the network threat intelligence processing method described in the first aspect above.

[0046] The network threat intelligence processing method and device, electronic device and storage medium proposed in the present application obtain sample intelligence information, and extract triplet features of the sample intelligence information based on a pre-set extraction model to obtain positive samples representing real threat relationships between multiple sample named entities and negative samples representing false threat relationships between multiple sample named entities; the negative samples are input into an initial generator, and disturbance noise is introduced based on the sample features of the negative samples to generate and obtain negative samples that match the number of positive samples after amplification and update, so that the data volume of positive samples and negative samples is more balanced, and the overall generalization ability of the processing device is improved; the initial discriminator is used to discriminate the positive samples and the negative samples after the number is amplified, and the negative samples are judged according to the discriminant. The generator and discriminator are trained based on the identification results to obtain the trained discriminator; the training goal of the discriminator is to distinguish positive samples from negative samples as accurately as possible, while the generator "cheats" the discriminator by generating samples that are as realistic as possible, making it difficult for it to distinguish mixed positive and negative samples. Such adversarial training process prompts the generator to continuously improve and generate samples that are closer to the real data distribution, while the discriminator also continuously improves its recognition ability; after completing the training of the generator and discriminator, the target intelligence information is obtained, and based on the extraction model, the triplet feature extraction of the target intelligence information is performed to obtain positive information and negative information; the positive information and negative information are input into the trained discriminator to extract the target extraction information with high accuracy with high efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a schematic diagram of an optional application scenario of the network threat intelligence processing device provided in an embodiment of the present application;

[0048] Figure 2 This is an optional flowchart of the network threat intelligence processing method provided by the embodiment of the present application;

[0049] Figure 3 It is an optional structural diagram of a training process of the network threat intelligence processing device provided in an embodiment of the present application;

[0050] Figure 4It is an optional structural diagram in the application process of the network threat intelligence processing device provided in the embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of an optional functional module of the network threat intelligence processing device provided in an embodiment of the present application;

[0052] Figure 6 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0056] First, some nouns involved in this application are analyzed:

[0057] A deep neural network (DNN) is a type of artificial neural network that consists of multiple hidden layers (i.e., depth), each of which usually contains multiple neurons, for extracting and learning high-level feature representations of data layer by layer. Deep neural networks are widely used in various machine learning tasks, such as image and speech recognition, natural language processing, and recommendation systems. The deep structure they contain can effectively learn complex nonlinear relationships and patterns of input data.

[0058] At present, cybersecurity incidents occur frequently with the continuous development of Internet technology, which seriously affects the information security of individuals, enterprises and society. Cyber ​​Threat Intelligence (CTI) refers to information about potential and persistent threats related to network security and infrastructure. Analyzing cyber threat intelligence can help identify and respond to cyber attacks, and plays an important role in maintaining network security.

[0059] In the related art, the relationship between the named entities of network threat intelligence is defined by manually formulating network threat rules, so as to determine the threat relationship corresponding to the queried named entity that is logically matched with the formulated rules in the network threat intelligence. However, such a network threat intelligence processing method relies on manual experience and requires a lot of time to accurately define threat rules, which leads to inaccurate and inefficient analysis of the threat relationship between the named entities of network threat intelligence.

[0060] Based on this, the embodiments of the present application provide a network threat intelligence processing method, device, electronic device and storage medium, which aim to improve the accuracy and efficiency of extracting relationships between named entities in network threat intelligence.

[0061] It should be noted that in the embodiments of the present application, when it comes to information related to user characteristics such as user basic information or user identity, the user's permission or consent will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the user's separate permission or consent will be obtained first. After the user's separate permission or consent is clearly obtained, the necessary data for the normal operation of the embodiments of the present application will be obtained. For example, when the embodiments of the present application obtain sample intelligence information containing user basic information, the consent of the relevant user will be obtained first; or, if the sample intelligence information obtained involves, including but not limited to, the user's network information privacy and login information privacy, the consent of the relevant user will be obtained first, otherwise the sample intelligence information used in the embodiments of the present application for training the generator and the discriminator cannot be obtained.

[0062] The network threat intelligence processing method, device, electronic device and storage medium provided in the embodiments of the present application are specifically described through the following embodiments.

[0063] In order to better understand the network threat intelligence processing method proposed in this application, the application scenario of the network threat intelligence processing device in the embodiment of this application (for the convenience of description, it may also be referred to as "processing device" below) is first described, wherein the network threat intelligence processing device is provided with an extraction model and a trained discriminator, and the discriminator is trained based on the network threat intelligence processing method proposed in this application (for the convenience of description, it may also be referred to as "processing method" below). Figure 1 As shown, Figure 1It is a schematic diagram of an optional application scenario of the network threat intelligence processing device provided in the embodiment of the present application. Specifically, the acquired target intelligence information is input into the processing device, and the processing device can extract the triple features in the target intelligence information, and judge the authenticity of the extracted triple features to obtain target extraction information. It should be noted that since the processing device is trained by the processing method proposed in the embodiment of the present application, its ability to analyze and process complex network intelligence information is improved, and thus the relationship between the extracted triple features can be more accurately judged; on the other hand, for users, there is no need to spend a lot of energy to formulate network threat rules. It only needs to input the network threat intelligence into the processing device to obtain the target extraction information that represents the real threat relationship between the named entities, thereby improving the efficiency of relationship extraction.

[0064] Next, the network threat intelligence processing method proposed in the embodiment of the present application is described.

[0065] In the embodiments of the present application, the description will be made from the perspective of a processing device, which can be integrated into a computer device, such as a server. Figure 2 As shown, Figure 2 is an optional flowchart of the network threat intelligence processing method provided in the embodiment of the present application. Figure 2 The method in the embodiment may include but is not limited to the following steps 101 to 105. When the processing device executes the processing method, the specific process is as follows. It should be noted that the present embodiment Figure 2 The order of step 101 to step 105 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0066] Step 101, obtain sample intelligence information, and extract triple features from the sample intelligence information based on a pre-set extraction model to obtain positive samples representing real threat relationships between multiple named entities and negative samples representing false threat relationships between multiple named entities.

[0067] The following is a detailed description of step 101.

[0068] In some embodiments, in order to train the processing device to improve the accuracy of processing the target intelligence information in actual use, it is necessary to first obtain sample intelligence information to train the pre-built processing device. The sample intelligence information refers to the relevant network threat intelligence obtained for training the generator and the discriminator.

[0069] Furthermore, sample intelligence information can be obtained through the following methods:

[0070] Internal data: network logs, incident responses, and recorded data obtained after manual investigation collected from the intranet are used as sample intelligence information;

[0071] Open source data (OSINT): resource information from the public domain, such as obtaining sample intelligence information from the shared network through data crawling;

[0072] Further, after obtaining the sample intelligence information, it is input into the extraction model of the processing device, and the extraction model identifies the named entities contained in the sample intelligence information, and determines the threat relationship between the identified named entities, so as to extract the characteristics of the sample intelligence information triples and obtain positive samples and negative samples. Exemplarily, a certain sample intelligence information A is input into the extraction model to obtain positive samples and negative samples. For example, one of the positive samples is (phishing incident, tool, social media website), and the positive sample represents that the "social media website" (named entity) is a "tool" (threat relationship) for executing the "phishing incident" (named entity), and the threat relationship between multiple named entities is true; for example, one of the negative samples is (phishing incident, victim, social media website), and the negative sample represents that the "social media website" (named entity) is a "victim" (threat relationship) for executing the "phishing incident" (named entity), and the threat relationship between multiple named entities is false.

[0073] Among them, the named entities refer to five types of network security event blocks and attribute information related to these security event blocks. The five types of network security event blocks usually refer to the five basic categories of security events in the field of network security. These categories are:

[0074] Harmful program events: These events mainly involve the spread and infection of various malware, such as infection of user devices through email attachments, download links, ad clicks, etc., which in turn leads to information leakage, device crashes and other problems;

[0075] Cyber ​​attack incidents: including denial of service attacks, backdoor attacks, vulnerability attacks, network scanning and eavesdropping, phishing and other forms. Cyber ​​attacks are intended to disrupt the normal operation of the target network system, steal sensitive information, or control the target system to conduct illegal activities;

[0076] Information destruction incidents: including information tampering, information forgery, information leakage, information theft, information loss, etc. Information destruction incidents may cause incomplete, inaccurate or unavailable data, thus affecting the normal operation of users or organizations;

[0077] Information content security incidents: including information that is prohibited from being disseminated and information that may cause losses to individuals and organizations;

[0078] Other types of events: In addition to the above four types of events, there are other types of network security events, such as equipment and facility failure events (software and hardware failures, peripheral facility failures, man-made sabotage accidents, etc.), catastrophic events (network security events caused by natural disasters and other emergencies), etc. Although these events may not directly involve network attacks or malware, they may also pose a threat or impact to network security.

[0079] Furthermore, since network threat intelligence is domain-specific and its common words have different meanings from general fields, before inputting the sample intelligence information into the extraction model, the embodiment of the present application uses a domain word vector model (Domain-Word2vec) and a network security word vector model (Cyber-Word2vec) to digitize the words in the network threat intelligence text to help the processing device better understand the sample intelligence information and facilitate the subsequent preliminary extraction of named entities.

[0080] Among them, the extraction model can be a model with a bidirectional gated recurrent unit (Bidirectional Gated Recurrent Unit, BiGRU) as the core network architecture, a model with a transformation module (Transformer) as the core network architecture, etc. The embodiment of the present application does not limit the specific type of the extraction model.

[0081] It should be noted that since most of the sample intelligence information obtained is obtained from the real world, the data information will be inclined towards the direction of real threat events, resulting in a phenomenon where the number of positive samples is greater than the number of negative samples.

[0082] Furthermore, although the extraction model has the ability to identify and extract named entities in the acquired sample intelligence information, due to the continuous advancement of Internet technology and the increasing complexity of network attack tools, the acquired sample intelligence information has become increasingly complex, and the named entities and their corresponding threat relationships have become blurred in long sequence texts, which makes the extraction model only able to identify some positive samples that represent real threat relationships. For the remaining named entities, the extraction model has difficulty identifying the threat relationships. In the related art, only the extraction model is used to perform relationship extraction operations on the input intelligence information, which easily leads to the inability to accurately and completely identify all the real threat relationships of the named entities.

[0083] Based on this, Figure 3 As shown, Figure 3This is an optional structural diagram of the training process of the network threat intelligence processing device provided by the embodiment of the present application. The processing device proposed in the embodiment of the present application includes an extraction model, a context embedding model, a generator and a discriminator. The context embedding model, the generator and the discriminator are used to make up for the lack of accuracy of the extraction model in the extraction of named entity relationships. Figure 3 The following description is provided to help readers better understand the network threat intelligence processing method proposed in the embodiments of the present application.

[0084] In some embodiments, after obtaining the sample intelligence information, the following steps 201 are also included:

[0085] Step 201 : semantically process the sample intelligence information based on a preset context embedding model to obtain sample embedding information corresponding to the sample intelligence information.

[0086] The following is a detailed description of step 201.

[0087] Furthermore, named entities in network threat intelligence (such as attackers, malware, vulnerabilities, etc.) often do not exist in isolation, but are closely related to the surrounding text content. Therefore, the embodiment of the present application captures this dependency by setting a preset context embedding model to output sample embedding information, helping the processing device understand the semantics of the entire text environment, so that the processing device can accurately obtain target extraction information in subsequent practical applications.

[0088] The sample embedding information refers to the semantic information corresponding to the sample intelligence information in a format understandable by the processing device. Specifically, the context embedding model converts the named entities in each sentence in the sample intelligence information into a high-dimensional vector to obtain the sample embedding information. The sample embedding information not only contains the semantic information of the sentence, but also can capture the contextual relationship between each named entity to a certain extent.

[0089] Furthermore, the context embedding model can be constructed based on an open source natural language processing framework (KantaiBERT), or the context embedding model can also be a generative pre-trained model (Generative Pre-trained Transformer, GPT), etc. The specific type of the context embedding model can be set according to actual conditions, and the embodiments of the present application do not impose specific restrictions.

[0090] Step 102, inputting negative samples into the initial generator, introducing disturbance noise based on the sample features of the negative samples, so as to generate and obtain negative samples that match the number of positive samples after amplification and updating.

[0091] The following is a detailed description of step 102.

[0092] In some embodiments, in order to improve the accuracy of the processing device in extracting intelligence information relationships, after obtaining a small amount of negative samples output by the extraction model, they are input into the initial generator to amplify the number of negative samples based on the generator, so that the data volume of positive and negative samples is more balanced, thereby improving the overall generalization ability of the processing device.

[0093] Furthermore, in the process of training the processing device, the generator does not randomly use a simple replacement of the head and tail named entities to generate low-quality and false-negative negative samples, but inputs negative samples containing triple features into the initial generator. The generator can learn valuable sample features from them and introduce perturbation noise in a targeted manner based on the learned sample features to generate high-quality negative samples with a higher degree of realism.

[0094] Among them, the generator is constructed based on a deep neural network. For example, the generator can be a complex mathematics generator (ComplEx), an adversarial generator (Generative Adversarial Networks, GANs), etc. The specific type of the generator can be set according to actual conditions, and the embodiments of the present application do not limit it.

[0095] It is understandable that the number of negative samples extracted by the extraction model in the related art is far less than the positive samples, which leads to a tendency to predict more common categories (usually positive samples) during training. The embodiment of the present application generates negative samples that match the number of positive samples through a generator, which can help balance the sample data and thus improve the accuracy of the processing device in distinguishing the threat relationship between named entities.

[0096] Step 103, using the initial discriminator to discriminate the positive samples and the negative samples after the number of amplification, and training the generator and the discriminator according to the discrimination results to obtain a trained discriminator.

[0097] The following is a detailed description of step 103.

[0098] The processing device is also provided with a discriminator associated with the generator extraction model. The positive samples output by the extraction model and the negative samples amplified by the generator will be input into the discriminator. The training goal of the discriminator is to distinguish positive samples from negative samples as accurately as possible, while the generator "cheats" the discriminator by generating samples that are as realistic as possible, making it difficult to distinguish between mixed positive and negative samples. This adversarial training process prompts the generator to continuously improve and generate samples that are closer to the real data distribution, while the discriminator also continuously improves its recognition ability.

[0099] Next, we will explain how the discriminator processes the input positive and negative samples to obtain the discrimination results, and how to jointly train the generator and discriminator based on the discrimination results.

[0100] In some embodiments, using an initial discriminator to discriminate positive samples and negative samples after amplification includes the following steps 301:

[0101] Step 301, input the sample embedding information, positive samples and negative samples after the number of amplification into the initial discriminator, use the sample embedding information as a constraint condition, use the initial discriminator to discriminate the positive samples and the negative samples after the number of amplification, and obtain the discrimination result.

[0102] The following is a detailed description of step 301.

[0103] In some embodiments, the positive samples output by the extraction model, the negative samples amplified by the generator, and the sample embedding information output by the context embedding model in step 201 are input into the discriminator. When the discriminator distinguishes between the positive samples and the negative samples, the sample embedding information can provide a decision basis for the discriminator to distinguish between the input positive samples and negative samples, and filter out the triple information representing the real threat relationship between the named entities to obtain the discrimination result.

[0104] In some embodiments, training the generator and the discriminator according to the discrimination result to obtain the trained discriminator includes the following steps 401 to 404:

[0105] Step 401, obtaining sample verification information corresponding to the sample intelligence information.

[0106] Step 402: Use the initial discriminator to discriminate the positive sample and the negative sample to obtain a positive evaluation score representing the degree of difference between the positive sample and the sample verification information, and a negative evaluation score representing the degree of difference between the negative sample and the sample verification information.

[0107] Steps 401 to 402 are described in detail below.

[0108] The sample verification information corresponds to the sample intelligence information, and the sample verification information represents the output result that the operator expects to obtain after inputting the sample intelligence into the processing device. According to the difference between the sample verification information and the discrimination result output by the processing device during the training process, the generator and the discriminator are jointly adjusted to achieve the purpose of jointly optimizing the generator and the discriminator.

[0109] Furthermore, after the discriminator discriminates the positive sample, it obtains a first discriminant result, based on a positive evaluation score representing the degree of difference between the first discriminant result and the sample verification result; after the discriminator discriminates the negative sample, it obtains a second discriminant result, based on a negative evaluation score representing the degree of difference between the second discriminant result and the sample verification result. It can be understood that the smaller the values ​​of the positive evaluation score and the negative evaluation score, the smaller the degree of difference between the discriminant result and the sample verification information, that is, the better the discriminator distinguishes between positive and negative samples.

[0110] In some embodiments, the negative evaluation score is obtained by following steps 501 to 502:

[0111] Step 501 : Based on sample verification information, a first similarity distance between a negative head named entity and false threat relationship information is calculated, and a second similarity distance between a negative tail named entity and false threat relationship information is calculated.

[0112] Step 502: Perform weighted calculation on the first similarity distance and the second similarity distance according to the first relationship weight corresponding to the first similarity distance and the second relationship weight corresponding to the second similarity distance to obtain a negative evaluation score.

[0113] Steps 501 to 502 are described in detail below.

[0114] Among them, the negative sample includes a negative head named entity, a negative tail named entity, and false threat relationship information corresponding to the negative head named entity and the negative tail named entity. For example, a negative sample A is (phishing incident, attacker, social media website), then "phishing incident" is a negative head named entity, "social media website" is a negative tail named entity, and "attacker" is false threat relationship information.

[0115] Further, the first similarity distance represents the similarity between the negative head named entity of the negative sample and the false threat relationship information, and the negative head named entity of the sample verification information and the false threat relationship information; the second similarity distance represents the similarity between the negative tail named entity of the negative sample and the false threat relationship information, and the negative tail named entity of the sample verification information and the false threat relationship information. Exemplarily, the sample verification A corresponding to the negative sample A is (phishing incident, tool, social media website), and the first similarity distance is obtained by comparing the similarity between (phishing incident, attacker) and (phishing incident, tool).

[0116] Then, based on the preset first relationship weight and second relationship weight, the first similarity distance and the second similarity distance are weighted to obtain a negative evaluation score. In the triple information, the importance of each named entity and the threat relationship is different. For example, the correlation between (phishing incident, tool) is higher than that between (tool, social media website). Therefore, the first relationship weight is set higher than the second relationship weight to more accurately reflect the relative importance of the threat relationship between different named entities, thereby improving the accuracy of the discriminator's analysis and decision-making.

[0117] It should be noted that the first relationship weight and the second relationship weight can be set according to actual conditions, and the embodiment of the present application does not limit this.

[0118] It can be understood that by calculating the first similarity distance and the second similarity distance, negative samples can be discriminated with a higher granularity. This fine-grained analysis helps the processing device to more accurately understand the degree of match between each component in the triplet and the sample verification information, and then further analyze and process the complex information that the extraction model cannot discriminate, thereby improving the interpretability of model training and the accuracy of discrimination.

[0119] In some embodiments, the positive evaluation score is obtained by following steps 601 to 602:

[0120] Step 601 : Based on the sample verification information, a third similarity distance between the head named entity and the real threat relationship information is calculated, and a fourth similarity distance between the tail named entity and the real threat relationship information is calculated.

[0121] Step 602: Perform weighted calculation on the third similarity distance and the fourth similarity distance according to the third relationship weight corresponding to the third similarity distance and the fourth relationship weight corresponding to the fourth similarity distance to obtain a positive evaluation score.

[0122] Steps 601 to 602 are described in detail below.

[0123] Among them, the positive sample includes the positive head named entity, the positive tail named entity, and the real threat relationship information corresponding to the positive head named entity and the positive tail named entity. It should be noted that the positive head named entity and the negative head named entity are both the head named entities of the extracted triple information, the positive tail named entity and the negative tail named entity are both the tail named entities of the extracted triple information, and "positive" and "negative" are only used to distinguish between positive and negative samples.

[0124] The processing device can discriminate the input positive sample based on the acquired sample verification information to obtain a corresponding positive evaluation score. The method for determining the positive evaluation score is similar to step 501 to step 502 and will not be repeated here.

[0125] It should be noted that the third relationship weight and the fourth relationship weight can be set according to actual conditions, and the embodiment of the present application does not limit this.

[0126] Step 403, adjusting the first parameter of the initial generator according to the negative evaluation score to obtain a trained generator.

[0127] The following is a detailed description of step 403.

[0128] Among them, the first parameter refers to the relevant parameters of the generator, such as network structure parameters, number of neurons, neuron weights, neuron biases, etc. Of course, the specific content of the first parameter can be set according to actual conditions, and the embodiments of the present application do not limit this.

[0129] Furthermore, the first parameter of the initial generator is adjusted according to the negative evaluation score, so that the adjusted generator continues to amplify the negative samples of the next input sample data until the preset first condition is reached, thereby obtaining the trained generator.

[0130] Specifically, in some embodiments, adjusting the first parameter of the initial generator according to the negative evaluation score to obtain the trained generator includes the following steps 701 to 702:

[0131] Step 701, calculate the negative sample expected value corresponding to the negative evaluation score, determine the first loss value based on the negative sample expected value, and perform a derivative operation on the first loss value to obtain gradient information.

[0132] Step 702, adjust the policy gradient direction according to the gradient information, and adjust the first parameter of the generator according to the adjusted policy gradient direction until the preset first condition is reached, and obtain the trained generator, which is used to perform sample amplification on the negative sample input next time.

[0133] Steps 701 to 702 are described in detail below.

[0134] In some embodiments, the generator is trained based on the following formula (1):

[0135]

[0136] Among them, (h, r', t) is a negative sample, h is a negative head named entity, t is a negative tail named entity, and r' is a false threat relationship. D is the scoring function for negative samples; T is the sample set; (h, r, t) is the positive sample; P G The characterization generator's discrimination of the input negative samples follows a certain probability distribution in the sample set; E represents the expected value calculation, is the expected value of negative samples; L G is the first loss value.

[0137] Furthermore, the policy gradient update method is used to iteratively train the generator. The policy gradient formula is shown in the following equations (2) and (3):

[0138]

[0139] in, represents the derivation of the first loss value calculated by the generator, E represents the calculation of the mathematical expectation value of the independent variable (h, r', t) in the loss function; N represents the total number of categories of alternative false relationship information; r i ′ represents the i-th relation information from a total of N types of false relation information; (h,r * ,t) represents any negative sample of the wrong relation triple; Neg(h,r',t) represents the set of negative samples; log is the logarithmic operation; exp is the exponential operation; Σ is the summation operation; the meanings of other variables are consistent with the corresponding explanations in formula (1), which will not be repeated here.

[0140] Among them, gradient information refers to the gradient of the objective function (loss function) with respect to the generator parameters. For example, the objective function includes the parameter values ​​of the generator, and the gradient information represents the rate and direction of change of the objective function at the current parameter value. The policy gradient direction is used to guide the generator in the update direction of related parameters during the training process.

[0141] Among them, the first condition may be that the number of training times reaches a preset number threshold, or the first condition may be that the training time reaches a preset time threshold. The embodiment of the present application does not impose specific restrictions on this, and the first condition can be specifically set according to actual conditions.

[0142] Step 404: adjust the second parameter of the initial discriminator according to the positive evaluation score and the negative evaluation score to obtain a trained discriminator.

[0143] Step 404 is described in detail below.

[0144] Among them, the second parameter refers to the relevant parameters of the discriminator, such as convolutional layer weight parameters, fully connected layer weight parameters, batch parameters, activation function parameters, etc. Of course, the specific content of the second parameter can be set according to actual conditions, and the embodiment of the present application does not limit this.

[0145] Furthermore, the second parameter of the initial discriminator is adjusted according to the positive evaluation score and the negative evaluation score, so that the adjusted discriminator continues to discriminate the sample data input next time, until the preset second condition is met, thereby obtaining a trained discriminator.

[0146] Specifically, in some embodiments, adjusting the second parameter of the initial discriminator according to the positive evaluation score and the negative evaluation score to obtain the trained discriminator includes the following steps 801 to 803:

[0147] Step 801: Calculate the score difference between the positive evaluation score and the negative evaluation score based on a preset boundary parameter.

[0148] Step 802: sum the fractional differences that are positive values ​​to obtain a second loss value.

[0149] Step 803, adjusting the second parameter of the discriminator according to the second loss value until the preset second condition is reached, thereby obtaining a trained discriminator, and the trained discriminator is used to discriminate the positive samples and negative samples input next time.

[0150] Steps 801 to 803 are described in detail below.

[0151] Among them, in the related art, the maximization distance between sample verification information and sample intelligence information is used as the training goal. This method is more effective for triplets generated by simple replacement. However, high-quality negative samples are very similar to real samples, which makes it difficult for the discriminator to expand the distance between positive and negative samples and difficult to reach the recognition threshold for negative samples. In order to effectively identify high-quality negative samples, the embodiment of the present application uses the minimization distance between sample verification information and sample intelligence information as the training goal. Specifically, the embodiment of the present application trains the discriminator based on the following formula (4):

[0152]

[0153] Among them, γ represents the boundary parameter; f D (h,r,t)-f D (h,r′,t) is the fractional difference; L D is the first loss value; the meanings of other variables are consistent with the corresponding explanations in formulas (1) to (3), and will not be repeated here.

[0154] In addition, “+” means that only the forward calculation results are considered. In this way, the discriminator can pay more attention to the inaccurate parts of the judgment, thereby accelerating the convergence speed.

[0155] Step 104, obtain target intelligence information, and extract triplet features from the target intelligence information based on the extraction model to obtain positive information and negative information.

[0156] Step 104 is described in detail below.

[0157] In some embodiments, Figure 4 As shown, Figure 4It is an optional structural diagram in the application process of the network threat intelligence processing device provided by the embodiment of the present application. After the training of the processing device is completed, the target intelligence information is obtained and input into the trained processing device; positive information and a small amount of negative information are obtained through processing by the extraction model; then, the generator amplifies the small amount of negative information to obtain updated negative information with more uncertain factors; then, both the positive information and the negative information are input into the discriminator, and the trained discriminator completes the comprehensive identification of the input positive information and negative information to obtain the target extraction information.

[0158] Among them, positive information represents the obvious triple information that the extraction model can obtain based on short sentence extraction; negative information represents the triple information that the extraction model determines to be a false threat relationship or an uncertain threat relationship.

[0159] Alternatively, the generator is only used to improve the discriminator's ability to distinguish input content during adversarial training. In practical applications, there is no need for the generator to generate more negative samples that represent the relationship between named entities. The discriminator can directly distinguish the positive and negative information obtained through the extraction model.

[0160] Step 105, inputting positive information and negative information into the trained discriminator to obtain target extraction information.

[0161] The following is a detailed description of step 105.

[0162] Among them, when the content of the input processing device is only target intelligence information, the target extraction information represents the triple information formed by all two named entities with real threat relationships; when the content of the input processing device is target intelligence information and queried named entities, the target extraction information represents all real threat relationships corresponding to the named entities input for query.

[0163] In some embodiments, the positive information and the negative information are input into the trained discriminator to obtain the target extraction information, including the following steps 901 to 902:

[0164] Step 901: semantically process the target intelligence information based on the context embedding model to obtain target embedding information corresponding to the target intelligence information.

[0165] Step 902, using the target embedded information as a constraint condition, using the trained discriminator to discriminate positive information and negative information to obtain a discrimination result, and determining the positive information or negative information whose discrimination result is less than a preset discrimination threshold as the target extracted information.

[0166] Steps 901 to 902 are described in detail below.

[0167] In some embodiments, while the extraction model processes the target intelligence information, the context embedding model also performs semantic processing on the target intelligence information to obtain corresponding target embedding information. The target embedding information refers to the semantic information corresponding to the target intelligence information in a format understandable by the processing device. Specifically, the context embedding model converts the named entities in each sentence in the target intelligence information into a high-dimensional vector to obtain the target embedding information. The target embedding information not only contains the semantic information of the sentence, but also can capture the contextual relationship between each named entity to a certain extent.

[0168] Furthermore, the positive information output by the extraction model, the negative information amplified by the generator, and the target embedded information are input into the discriminator. When the discriminator distinguishes between positive and negative information, the information embedded information can provide a decision basis for the discriminator to distinguish between the input positive and negative information, and filter out the triple information representing the real threat relationship between named entities to obtain the target extraction information.

[0169] It can be understood that in actual applications, the processing device proposed in the embodiment of the present application obtains target extraction information corresponding to the input target intelligence information, which improves the accuracy and efficiency of extracting the relationship between the named entities in the network threat intelligence, thereby accelerating the understanding of the target network from the perspective of network threat intelligence analysis, facilitating the subsequent execution of corresponding attack or defense operations, and avoiding the occurrence of security incidents.

[0170] like Figure 5 As shown, Figure 5 This is an optional functional module diagram of a network threat intelligence processing device provided in an embodiment of the present application, and the device includes:

[0171] The sample acquisition module 1001 is used to obtain sample intelligence information and perform triple feature extraction on the sample intelligence information based on a pre-set extraction model to obtain positive samples representing real threat relationships between multiple named entities and negative samples representing false threat relationships between multiple named entities.

[0172] The negative sample amplification module 1002 is used to input the negative samples into the initial generator, introduce disturbance noise based on the sample characteristics of the negative samples, so as to generate and obtain negative samples that match the number of positive samples after amplification and updating.

[0173] The training module 1003 is used to use the initial discriminator to discriminate the positive samples and the negative samples after the number is amplified, and train the generator and the discriminator according to the discrimination results to obtain the trained discriminator.

[0174] The target acquisition module 1004 is used to acquire target intelligence information and perform triple feature extraction on the target intelligence information based on the extraction model to obtain positive information and negative information.

[0175] The target discrimination module 1005 is used to input positive information and negative information into the trained discriminator to obtain target extraction information.

[0176] In some embodiments, in order to train the processing device to improve the accuracy of processing the target intelligence information in actual use, it is necessary to first obtain sample intelligence information to train the pre-built processing device. The sample intelligence information refers to the relevant network threat intelligence obtained for training the generator and the discriminator.

[0177] Furthermore, sample intelligence information can be obtained through the following methods:

[0178] Internal data: network logs, incident responses, and recorded data obtained after manual investigation collected from the intranet are used as sample intelligence information;

[0179] Open source data (OSINT): resource information from the public domain, such as obtaining sample intelligence information from the shared network through data crawling;

[0180] Further, after obtaining the sample intelligence information, it is input into the extraction model of the processing device, and the extraction model identifies the named entities contained in the sample intelligence information, and determines the threat relationship between the identified named entities, so as to extract the characteristics of the sample intelligence information triples and obtain positive samples and negative samples. Exemplarily, a certain sample intelligence information A is input into the extraction model to obtain positive samples and negative samples. For example, one of the positive samples is (phishing incident, tool, social media website), and the positive sample represents that the "social media website" (named entity) is a "tool" (threat relationship) for executing the "phishing incident" (named entity), and the threat relationship between multiple named entities is true; for example, one of the negative samples is (phishing incident, victim, social media website), and the negative sample represents that the "social media website" (named entity) is a "victim" (threat relationship) for executing the "phishing incident" (named entity), and the threat relationship between multiple named entities is false.

[0181] Furthermore, since network threat intelligence is domain-specific and its common words have different meanings from general fields, before inputting the sample intelligence information into the extraction model, the embodiment of the present application uses a domain word vector model (Domain-Word2vec) and a network security word vector model (Cyber-Word2vec) to digitize the words in the network threat intelligence text to help the processing device better understand the sample intelligence information and facilitate the subsequent preliminary extraction of named entities.

[0182] Among them, the extraction model can be a model with a bidirectional gated recurrent unit (Bidirectional Gated Recurrent Unit, BiGRU) as the core network architecture, a model with a transformation module (Transformer) as the core network architecture, etc. The embodiment of the present application does not limit the specific type of the extraction model.

[0183] It should be noted that since most of the sample intelligence information obtained is obtained from the real world, the data information will be inclined towards the direction of real threat events, resulting in a phenomenon where the number of positive samples is greater than the number of negative samples.

[0184] Furthermore, although the extraction model has the ability to identify and extract named entities in the acquired sample intelligence information, due to the continuous advancement of Internet technology and the increasing complexity of network attack tools, the acquired sample intelligence information has become increasingly complex, and the named entities and their corresponding threat relationships have become blurred in long sequence texts, which makes the extraction model only able to identify some positive samples that represent real threat relationships. For the remaining named entities, the extraction model has difficulty identifying the threat relationships. In the related art, only the extraction model is used to perform relationship extraction operations on the input intelligence information, which easily leads to the inability to accurately and completely identify all the real threat relationships of the named entities.

[0185] In some embodiments, in order to improve the accuracy of the processing device in extracting intelligence information relationships, after obtaining a small amount of negative samples output by the extraction model, they are input into the initial generator to amplify the number of negative samples based on the generator, so that the data volume of positive and negative samples is more balanced, thereby improving the overall generalization ability of the processing device.

[0186] Furthermore, in the process of training the processing device, the generator does not randomly use a simple replacement of the head and tail named entities to generate low-quality and false-negative negative samples, but inputs negative samples containing triple features into the initial generator. The generator can learn valuable sample features from them and introduce perturbation noise in a targeted manner based on the learned sample features to generate high-quality negative samples with a higher degree of realism.

[0187] Among them, the generator is constructed based on a deep neural network. For example, the generator can be a complex mathematics generator (ComplEx), an adversarial generator (Generative Adversarial Networks, GANs), etc. The specific type of the generator can be set according to actual conditions, and the embodiments of the present application do not limit it.

[0188] It is understandable that the number of negative samples extracted by the extraction model in the related art is far less than the positive samples, which leads to a tendency to predict more common categories (usually positive samples) during training. The embodiment of the present application generates negative samples that match the number of positive samples through a generator, which can help balance the sample data and thus improve the accuracy of the processing device in distinguishing the threat relationship between named entities.

[0189] The processing device is also provided with a discriminator associated with the generator extraction model. The positive samples output by the extraction model and the negative samples amplified by the generator will be input into the discriminator. The training goal of the discriminator is to distinguish positive samples from negative samples as accurately as possible, while the generator "cheats" the discriminator by generating samples that are as realistic as possible, making it difficult to distinguish between mixed positive and negative samples. This adversarial training process prompts the generator to continuously improve and generate samples that are closer to the real data distribution, while the discriminator also continuously improves its recognition ability.

[0190] Furthermore, after completing the training of the processing device, the target intelligence information is obtained and input into the trained processing device; positive information and a small amount of negative information are obtained through processing by the extraction model; then, the generator amplifies the small amount of negative information to obtain updated negative information with more uncertain factors; then, both the positive information and the negative information are input into the discriminator, and the trained discriminator completes the comprehensive identification of the input positive information and negative information to obtain the target extraction information.

[0191] Among them, when the content of the input processing device is only target intelligence information, the target extraction information represents the triple information formed by all two named entities with real threat relationships; when the content of the input processing device is target intelligence information and queried named entities, the target extraction information represents all real threat relationships corresponding to the named entities input for query.

[0192] The specific implementation of the network threat intelligence processing device is basically the same as the specific implementation example of the above-mentioned network threat intelligence processing method, and will not be repeated here.

[0193] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned network threat intelligence processing method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0194] like Figure 6 As shown, Figure 6 : is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application, the electronic device includes:

[0195] The processor 1101 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0196] The memory 1102 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1102 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1102, and the processor 1101 calls and executes the network threat intelligence processing method of the embodiment of this application;

[0197] Input / output interface 1103, used to implement information input and output;

[0198] The communication interface 1104 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0199] A bus 1105 that transmits information between various components of the device (e.g., the processor 1101, the memory 1102, the input / output interface 1103, and the communication interface 1104);

[0200] The processor 1101 , the memory 1102 , the input / output interface 1103 and the communication interface 1104 are connected to each other in communication within the device via the bus 1105 .

[0201] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned network threat intelligence processing method is implemented.

[0202] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0203] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0204] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0205] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0206] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0207] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0208] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0209] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0210] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0211] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0212] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0213] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A network threat intelligence processing method, characterized in that: The method comprises: Acquire sample intelligence information, and perform triple feature extraction on the sample intelligence information based on a pre-set extraction model to obtain positive samples representing true threat relationships between multiple named entities and negative samples representing false threat relationships between multiple named entities; Inputting the negative samples into the initial generator, introducing disturbance noise based on the sample features of the negative samples, so as to generate and obtain the negative samples that match the number of the positive samples after amplification and updating; Using the initial discriminator to discriminate the positive samples and the negative samples after the number increase, and training the generator and the discriminator according to the discrimination results to obtain the trained discriminator; Acquire target intelligence information, and perform triple feature extraction on the target intelligence information based on the extraction model to obtain positive information and negative information; Inputting the positive information and the negative information into the trained discriminator to obtain target extraction information; The step of training the generator and the discriminator according to the discrimination result to obtain the trained discriminator includes: Obtaining sample verification information corresponding to the sample intelligence information; Using an initial discriminator to discriminate the positive sample and the negative sample, to obtain a positive evaluation score representing the degree of difference between the positive sample and the sample verification information, and a negative evaluation score representing the degree of difference between the negative sample and the sample verification information; Adjusting a first parameter of the initial generator according to the negative evaluation score to obtain the trained generator; Adjusting the second parameter of the initial discriminator according to the positive evaluation score and the negative evaluation score to obtain the trained discriminator; After obtaining the sample intelligence information, the method further includes: Based on a preset context embedding model, semantic processing is performed on the sample intelligence information to obtain sample embedding information corresponding to the sample intelligence information; The using the initial discriminator to discriminate the positive sample and the negative sample after the number is amplified includes: Inputting the sample embedding information, the positive sample and the negative sample after the number is amplified into an initial discriminator, using the sample embedding information as a constraint condition, using the initial discriminator to discriminate the positive sample and the negative sample after the number is amplified to obtain a discrimination result; The step of inputting the positive information and the negative information into the trained discriminator to obtain target extraction information includes: Based on the context embedding model, semantic processing is performed on the target intelligence information to obtain target embedding information corresponding to the target intelligence information; Taking the target embedded information as a constraint condition, the trained discriminator is used to discriminate the positive information and the negative information to obtain a discrimination result, and the positive information or the negative information whose discrimination result is less than a preset discrimination threshold is determined as the target extracted information.

2. The method according to claim 1, characterized in that The negative sample includes a negative head named entity, a negative tail named entity, and false threat relationship information corresponding to the negative head named entity and the negative tail named entity; The negative evaluation score is obtained by the following steps, which include: Based on the sample verification information, calculating a first similarity distance between the negative head named entity and the false threat relationship information, and calculating a second similarity distance between the negative tail named entity and the false threat relationship information; The first similarity distance and the second similarity distance are weightedly calculated according to a first relationship weight corresponding to the first similarity distance and a second relationship weight corresponding to the second similarity distance to obtain the negative evaluation score.

3. The method according to claim 1, characterized in that The first parameter of the initial generator is adjusted according to the negative evaluation score to obtain the trained generator, comprising: Calculating a negative sample expected value corresponding to the negative evaluation score, determining a first loss value based on the negative sample expected value, and performing a derivative operation on the first loss value to obtain gradient information; The strategy gradient direction is adjusted according to the gradient information, and the first parameter of the generator is adjusted according to the adjusted strategy gradient direction until a preset first condition is reached, thereby obtaining the trained generator, and the trained generator is used to perform sample amplification on the negative sample input next time.

4. The method according to claim 1, characterized in that: The positive sample includes a positive head named entity, a positive tail named entity, and real threat relationship information corresponding to the positive head named entity and the positive tail named entity; The positive evaluation score is obtained by the following steps, which include: Based on the sample verification information, calculating a third similarity distance between the head named entity and the real threat relationship information, and calculating a fourth similarity distance between the tail named entity and the real threat relationship information; The third similarity distance and the fourth similarity distance are weightedly calculated according to the third relationship weight corresponding to the third similarity distance and the fourth relationship weight corresponding to the fourth similarity distance to obtain the positive evaluation score.

5. The method according to claim 1, characterized in that The step of adjusting the second parameter of the initial discriminator according to the positive evaluation score and the negative evaluation score to obtain the trained discriminator includes: Based on a preset boundary parameter, calculating a score difference between the positive evaluation score and the negative evaluation score; Adding the fractional differences that are positive values ​​to obtain a second loss value; The second parameter of the discriminator is adjusted according to the second loss value until a preset second condition is reached, thereby obtaining the trained discriminator, and the trained discriminator is used to discriminate the positive samples and the negative samples input next time.

6. A network threat intelligence processing device, characterized in that: The device comprises: A sample acquisition module is used to acquire sample intelligence information and perform triple feature extraction on the sample intelligence information based on a pre-set extraction model to obtain positive samples representing real threat relationships between multiple named entities and negative samples representing false threat relationships between multiple named entities; A negative sample amplification module, used to input the negative sample into the initial generator, introduce disturbance noise based on the sample characteristics of the negative sample, so as to generate and obtain the negative sample whose number matches the positive sample after amplification and updating; A training module, used to use the initial discriminator to discriminate the positive samples and the negative samples after the number is amplified, and train the generator and the discriminator according to the discrimination results to obtain the trained discriminator; A target acquisition module is used to acquire target intelligence information and perform triple feature extraction on the target intelligence information based on the extraction model to obtain positive information and negative information; A target discrimination module, used for inputting the positive information and the negative information into the trained discriminator to obtain target extraction information; The step of training the generator and the discriminator according to the discrimination result to obtain the trained discriminator includes: Obtaining sample verification information corresponding to the sample intelligence information; Using an initial discriminator to discriminate the positive sample and the negative sample, to obtain a positive evaluation score representing the degree of difference between the positive sample and the sample verification information, and a negative evaluation score representing the degree of difference between the negative sample and the sample verification information; Adjusting a first parameter of the initial generator according to the negative evaluation score to obtain the trained generator; Adjusting the second parameter of the initial discriminator according to the positive evaluation score and the negative evaluation score to obtain the trained discriminator; After obtaining the sample intelligence information, the method further includes: Based on a preset context embedding model, semantic processing is performed on the sample intelligence information to obtain sample embedding information corresponding to the sample intelligence information; The using the initial discriminator to discriminate the positive sample and the negative sample after the number is amplified includes: Inputting the sample embedding information, the positive sample and the negative sample after the number is amplified into an initial discriminator, using the sample embedding information as a constraint condition, using the initial discriminator to discriminate the positive sample and the negative sample after the number is amplified to obtain a discrimination result; The step of inputting the positive information and the negative information into the trained discriminator to obtain target extraction information includes: Based on the context embedding model, semantic processing is performed on the target intelligence information to obtain target embedding information corresponding to the target intelligence information; Taking the target embedded information as a constraint condition, the trained discriminator is used to discriminate the positive information and the negative information to obtain a discrimination result, and the positive information or the negative information whose discrimination result is less than a preset discrimination threshold is determined as the target extracted information.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the network threat intelligence processing method according to any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network threat intelligence processing method according to any one of claims 1 to 5 is implemented.

Images