A method for generating network asset threat information based on RAG framework

Abstract

The present invention relates to the field of data processing technology. More specifically, the present invention relates to a method for generating network asset threat information based on a RAG framework, including: taking each piece of network asset threat information as a text block, obtaining entities of various types in each text block; determining the weight of each entity; determining the comprehensive entity length; in response to the total length of all entities in the text block accounting for less than a preset threshold in the initial length of the text block, making an expected adjustment to the initial length of the text block; adjusting both sides of the text block according to the expected adjusted length and the number of categories of entities of various types in the text blocks adjacent to it; vectorizing the text block through RAG technology and writing it into a database to complete the generation of network asset threat information. The quality and semantic accuracy of the generated text are improved through entity weight calculation and comprehensive entity length evaluation; the efficiency of information retrieval is improved by adjusting the length of the text block and reasonably adjusting the boundary.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and more specifically, to a method for generating network asset threat information based on a RAG framework. Background Art

[0002] Cyber ​​asset threat information can help security teams take more proactive and effective data-driven measures and take defensive measures before cyber attacks occur; security analysts collect original security cyber asset threat information and related security information from multiple sources, then correlate and analyze these data to gain a deeper understanding of actual or potential threats; in order to better operate and maintain cyber assets, it is necessary to collect a large amount of cyber asset threat information, and then better operate and maintain cyber assets by analyzing more cyber asset threat information. With the development of artificial intelligence technology, large language models are constantly enriching and improving our work and life. Large language models can generate more threat information to better operate and maintain cyber assets. However, large language model technology has hallucination problems, which sometimes generate illogical or false information that is irrelevant to the prompt words, affecting the operation and maintenance of cyber assets. RAG (Retrieval Augmented Generation) technology can usually be used to reduce the hallucination problem of large language models.

[0003] The patent application document with publication number CN118312579A discloses a large model-based advanced retrieval enhanced chunking and vectorization method, which includes: using advanced text segmentation tools to effectively divide text documents into small paragraphs with rich semantics, and using advanced Transformer encoder models to convert text paragraphs into vector form. Subsequently, these vectors are aggregated into one or more hierarchical indexes to support efficient vector space search and quickly retrieve the content most relevant to the user query through approximate nearest neighbor methods.

[0004] However, the above method processes the source text document set and converts it into a series of fixed-size text blocks, which may cause the text to be cut off at inappropriate positions, resulting in incomplete or broken semantics, incoherent context, affecting the generation ability of the model, and reducing the quality of the generated text; at the same time, this method does not consider the document structure, thereby losing important semantic information of the text block, affecting the quality of generation and retrieval. Summary of the invention

[0005] In order to solve the problem that the quality of generated text is degraded, the existing methods do not consider the document structure, thereby losing important semantic information of the text block, affecting the quality of generation and retrieval, the present invention proposes a network asset threat information generation method based on the RAG framework, the method comprising the following steps:

[0006] Each piece of network asset threat information is taken as a text block, and entities of various types in each text block are obtained; the weight of each entity is determined, and the weight is positively correlated with the ratio of the number of occurrences of entities of the same type of the entity in all text blocks to the total number of entities, and the ratio of the number of characters of the entity in all text blocks; the number of characters of all entities is weighted and summed according to the weight to obtain the comprehensive entity length; in response to the total length of all entities in the text block accounting for less than a preset threshold in the initial length of the text block, the initial length of the text block is expected to be adjusted, and the expected adjusted length is proportional to the relative difference between the average length of the entities in the text block and the comprehensive entity length, the initial length of the text block, and the initial length of the text block. The length is positively correlated, and negatively correlated with the proportion and the richness of the types of entities in the text block; the two sides of the text block are adjusted according to the expected adjusted length and the number of categories of entities of each type in the text blocks adjacent to it, the adjusted length of one side is positively correlated with the normalized result of the difference between the expected adjusted length of the text block and the initial length, the total length of all entities in the adjacent text blocks on this side of the text block and the initial length of the adjacent text blocks on this side, the adjusted length of the other side is positively correlated with the expected adjusted length of the text block, and negatively correlated with the initial length and the adjusted length of one side; the text blocks are vectorized and written into the database through RAG technology to complete the generation of network asset threat information.

[0007] The beneficial effects are: by systematically considering the entities and their weights within the text block, the semantic information of the generated text can be effectively maintained and enhanced; by adjusting the length of the text block and extending its two sides, the generated text is ensured to be more complete and coherent, while also enhancing the retrieval and generation quality of network asset threat information; thereby improving the accuracy and relevance of the final text generation.

[0008] Furthermore, the network asset threat information is obtained through the ATT&CK website.

[0009] Furthermore, the entity is acquired through named entity recognition technology.

[0010] Furthermore, the weight satisfies the following relationship:

[0011] ; In the formula, For the The weight of an entity, For all text blocks The number of occurrences of entities of the same type as the entity, is the total number of entities in all text blocks, For the The number of characters in the entity.

[0012] The beneficial effect is that by calculating the ratio of the number of entity occurrences and the character length as the preliminary weight, and then normalizing the weights of all entities to ensure that the total weight is 1, the weights are made comparable, which can fairly reflect the importance of each entity in the text and improve the accuracy and consistency of the weight calculation.

[0013] Furthermore, the expected adjusted length satisfies the following relationship:

[0014] ; In the formula, For the The expected adjusted length of the text block, For the The initial length of the text block, For the The total length of all entities in a text block as a percentage of the initial length of the text block. For the The richness of the entity types of a text block, For the The number of entity types in a text block, For the The number of entities in a text block, For the The average length of entities in a text block, is the comprehensive entity length, is the natural exponential function, is the maximum value function, The symbol for rounding up.

[0015] The beneficial effect is that the length of the text block is adjusted by combining the total length ratio of entities in the text block, the number of entity types, the number of entities and the average length, and these factors are weighted using a natural exponential function to reflect the impact of entities on the length of the text block, thereby ensuring that the length of the text block can more accurately match the actual needs of the entities and improve the accuracy and adaptability of text processing.

[0016] Furthermore, the adjustment length of the one side satisfies the following relationship:

[0017] ; In the formula, For the The adjusted length of one side of the text block, For the The expected adjusted length of the text block, For the The initial length of the text block, For the The total length of all entities in the adjacent text blocks on one side of the text block, For the The total length of all entities in the adjacent text block on the other side of the text block, For the The initial length of the adjacent text block on one side of the text block, For the The initial length of the adjacent text block on the other side of the text block, The symbol for rounding up.

[0018] The beneficial effect is that the adjusted length of one side of each text block is calculated by comparing the ratio of the total length of entities in adjacent text blocks to the initial length, and the adjusted length is dynamically adjusted according to the ratio of the entity length of adjacent text blocks to the initial length to adapt to changes in content, so that the text block can more accurately reflect the actual needs of adjacent text blocks when processed, thereby optimizing the text adjustment process.

[0019] Furthermore, the adjustment length of the other side satisfies the following relationship:

[0020] ; In the formula, For the The adjusted length of the other side of the text block, For the The initial length of the text block, For the Adjust the length of one side of the text block.

[0021] The beneficial effect is that the formula calculates the adjusted length of the other side of the text block by subtracting the initial length and the adjusted length of one side from the expected adjusted length, thereby ensuring that the total length of the text block remains consistent during adjustment, while taking symmetry into consideration, which helps to achieve balanced adjustment when adjusting the text block and optimize the overall structure of the text block.

[0022] Furthermore, the generation of network asset threat information includes:

[0023] The questions and prompt words input by the user are vectorized, and the data with the highest relevance to the questions are recalled from the database and integrated into the prompt words. The network asset threat information is obtained through the integrated prompt words to complete the generation of network asset threat information.

[0024] The beneficial effects are: the use of vectorization technology improves the accuracy of information retrieval, and by integrating relevant data and prompt words, the relevance and accuracy of generated information are enhanced, thereby being able to efficiently provide accurate threat information against network assets.

[0025] The present invention has the following beneficial effects:

[0026] Through entity weight calculation and comprehensive entity length evaluation, the quality and semantic accuracy of the generated text are significantly improved; by adjusting the length of text blocks and reasonably adjusting boundaries, the consistency and coherence of the document structure are enhanced, and the efficiency of information retrieval is improved; the RAG framework is used for text vectorization and storage, which effectively improves the efficiency of generating and managing network asset threat information; by ensuring the importance of entities and the integrity of context, the generated text can more accurately convey its intent and semantics; higher quality information helps users understand and process threat information more quickly, thereby improving user satisfaction and trust. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] By reading the following detailed description with reference to the accompanying drawings, the above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0028] Figure 1 It is a flowchart of the steps in the method for generating network asset threat information based on the RAG framework in an embodiment of the present invention.

[0029] Figure 2 It is a schematic diagram of adjusting the two sides of a text block in the network asset threat information generation method based on the RAG framework in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0031] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0032] See also Figure 1 , which shows a flowchart of a method for generating network asset threat information based on a RAG framework provided by an embodiment of the present invention, the method comprising the following steps:

[0033] S1: Take each piece of network asset threat information as a text block and obtain entities of each type in each text block.

[0034] Specifically, the network asset threat information is obtained through the ATT&CK website.

[0035] ATT&CK (Adversarial Tactics Techniques and Common Knowledge) website, a knowledge base of adversarial tactics and techniques.

[0036] Specifically, the entity is acquired through named entity recognition technology.

[0037] Different entities in each piece of network asset threat information (such as timestamp, IP address, domain name, exploit software and operating system, etc.; the present invention does not limit the number of labeled categories; implementers can make detailed annotations for each part of the threat information based on actual conditions) are labeled.

[0038] Implementers can select the labeling method and network according to the actual implementation situation. For example, the labeling method is the BIOSE (B-begin, I-inside, O-outside, E-end, S-single) labeling method, and the network is a bidirectional LSTM network.

[0039] S2: Determine the weight of each entity.

[0040] It should be noted that, since different parts of the network asset threat information have different lengths (for example, the length of the date is different from the length of the IP address), it is impossible to determine the length of the text block to be used to judge the completeness of the text information. Therefore, the present invention obtains each component in the existing threat information through named entity recognition, and calculates the comprehensive entity length according to the length of each component in the network asset threat information. Before calculating the comprehensive entity length, it is also necessary to obtain the weight of each entity, so as to ensure that the obtained comprehensive entity length is more reliable.

[0041] Specifically, the weight satisfies the following relationship:

[0042] ;

[0043] In the formula, For the The weight of an entity, For all text blocks The number of occurrences of entities of the same type as the entity, is the total number of entities in all text blocks, For the The number of characters in the entity.

[0044] in, For the The ratio of the number of occurrences of the same type of entities in all text blocks to the total number of entities. The larger the value, the more times the entity appears in all existing network asset threat information, and the more likely the entity is to be an entity related to network asset threats. In order to measure the comprehensive length of entities related to network asset threats, the entity should have a larger weight. The smaller the value, the fewer times the entity appears in all existing network asset threat information, and the more likely the entity is to be an entity unrelated to network asset threats. In order to measure the comprehensive length of entities related to network asset threats, the entity should have a smaller weight. At the same time, the longer the length of the entity, the more likely the entity is a complete URL or domain name, which are important entities for network asset protection. In this case, when calculating the comprehensive length of entities related to network asset threats, the entity has a greater reference value, and the number of characters corresponding to the entity should have a greater weight. The shorter the length of the entity, the more likely the entity is a common entity with a certain degree of repetition and no important meaning. In this case, when calculating the comprehensive length of entities related to network asset threats, the entity has less reference value, and the number of characters corresponding to the entity should have a smaller weight. Therefore, As the first The weights of the entities are adjusted to make the resulting composite entity length closer to the length of the entities related to the network asset threat.

[0045] S3: Determine the length of the composite entity.

[0046] The length of the comprehensive entity satisfies the following relationship:

[0047] ;

[0048] in, is the comprehensive entity length, For the The number of characters in an entity, For the The weight of an entity, is the total number of entities in all text blocks.

[0049] S4: In response to the total length of all entities in the text block accounting for a smaller proportion of the initial length of the text block than a preset threshold, the initial length of the text block is adjusted as expected.

[0050] Implementers can set a preset threshold value, for example, 0.5, based on actual implementation conditions.

[0051] It should be noted that since different network asset threat information has different lengths, some network asset threat information is shorter. When each piece of network asset threat information is used as a text block, some text blocks will have less information. Some network asset threat information is longer. If a fixed-length text block is used, the text block corresponding to the threat information that exceeds the fixed length of the text block will be incomplete and lack context information, which may be detrimental to the generation of network asset threat information. Therefore, it is necessary to adjust the initial length of the text blocks of each existing piece of network asset threat information according to the comprehensive entity length and each piece of network asset threat information.

[0052] When The ratio of the total length of all entities in a text block to the initial length of the text block , explain If there are many entities in a text block, it may contain enough information and there is no need to further expand the text block. Therefore, there is no need to adjust the initial length of the text block. , explain If there are fewer entities in a text block, the text block may contain less information. In order to make each text block have enough information, the text block needs to be adjusted to obtain a text block containing enough information.

[0053] Specifically, the expected adjusted length satisfies the following relationship:

[0054] ;

[0055] In the formula, For the The expected adjusted length of the text block, For the The initial length of the text block, For the The total length of all entities in a text block as a percentage of the initial length of the text block. For the The richness of the entity types of a text block, For the The number of entity types in a text block, For the The number of entities in a text block, For the The average length of entities in a text block, is the comprehensive entity length, is the natural exponential function, is the maximum value function, The symbol for rounding up.

[0056] in, For the The total length of all entities in a text block accounts for the initial length of the text block. The smaller the value, the The less information an entity in a text block may contain, the more it is necessary to expand the initial text block to obtain a text block containing enough information. The larger the value, the more The entities in a text block may contain relatively more information, so there is no need to significantly increase the initial length of the text block in order to make the resulting text block contain enough information; is the richness of the entity types of the j-th text block. The larger the value, the more entity categories the text block has, and the richer the information in the text block may be, so there is no need to expand the length of the text block too much. The smaller the value, the fewer entity categories the text block has, and the poorer the information in the text block may be, so it is more necessary to expand the length of the text block to contain richer information. For the The difference between the average length of entities in a text block and the length of comprehensive entities. The larger the value, the The greater the difference between the average length of entities in the first text block and the length of the comprehensive entity, the The length of the entity in a text block may be too large or too small compared to the length of the comprehensive entity. When the length of the entity in the text block is too large, the information in the text block may not be rich enough (for example, it is all domain names or IP addresses). It is necessary to expand the text block based on the initial length of the text block to make the text block have richer information. At the same time, if the length of the entity in the text block is too small, since the amount of information contained in the short entity is limited, the text block should be expanded based on the initial length of the text block so that the resulting text block contains more entities and information. The smaller the value, the smaller the difference between the average length of the entity in the jth initial text block and the comprehensive entity length. The current text block may already contain enough information, so there is no need to adjust the size of the text block based on the initial length of the text block. Here, for the convenience of calculation, it is divided by The way to Therefore, right Make corrections, The bigger the The smaller the right The greater the upward correction ability, the larger the text block size and the richer the information. The more hours, The larger the The closer it is to 1, the right The smaller the correction ability of Decide.

[0057] S5: Adjusting the two sides of the text block according to the expected adjusted length and the number of categories of entities of each type in the text block adjacent to the text block.

[0058] It should be noted that, for text blocks that need to be expected to be adjusted, the network asset threat information corresponding to each text block has one or more pieces of information directly or indirectly adjacent to it. The text block is adjusted based on the expected adjusted length of the text block through the initial length of the adjacent text blocks according to the expected adjusted length of the text block. In addition to the text blocks at both ends of each text block, there are other text blocks on both sides of the text block. Therefore, the adjusted length of one side and the adjusted length of the other side are calculated according to the length of each text block and the total length of the entities in the text blocks adjacent to each text block and their initial length to obtain the adjusted text block.

[0059] Specifically, the adjustment length of one side satisfies the following relationship:

[0060] ;

[0061] In the formula, For the The adjusted length of one side of the text block, For the The expected adjusted length of the text block, For the The initial length of the text block, For the The total length of all entities in the adjacent text blocks on one side of the text block, For the The total length of all entities in the adjacent text block on the other side of the text block, For the The initial length of the adjacent text block on one side of the text block, For the The initial length of the adjacent text block on the other side of the text block, The symbol for rounding up.

[0062] in, is the amount by which the initial text block will be adjusted, and Respectively The proportion of the side entity of a text block in the side text block and the The proportion of entities on the other side of a text block in the text block on that side, The larger the The text block on the side of the text block may contain more information, so the first The text block is adjusted to one side so that the resulting text block contains richer information. The larger the The text block on the other side of the text block may contain more information, so the first The initial text block is adjusted to the other side so that the resulting text block contains richer information, so The bigger The larger the value, the larger the adjustment to one side of the initial text block. The more hours The smaller the value, the larger the adjustment amount on the other side of the initial text block, so that the adjusted text block has richer information. For the first and last text blocks, there is no other text block on one of their two sides. For example, there is no other text block on the left side of the first text block, then If is 0, , it can only be adjusted from the other side, that is, the right side. Similarly, if there is no text block on the right side of the last text block, it can only be adjusted from the left side. .

[0063] Specifically, the adjustment length of the other side satisfies the following relationship:

[0064] ;

[0065] In the formula, For the The adjusted length of the other side of the text block, For the The initial length of the text block, For the Adjust the length of one side of the text block.

[0066] See also Figure 2 , which is a schematic diagram after adjusting the two sides of the text block.

[0067] S6: The text blocks are vectorized and written into the database through RAG technology to complete the generation of network asset threat information.

[0068] Specifically, the generation of network asset threat information includes:

[0069] The questions and prompt words input by the user are vectorized, and the data with the highest relevance to the questions are recalled from the database and integrated into the prompt words. The network asset threat information is obtained through the integrated prompt words to complete the generation of network asset threat information.

[0070] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating network asset threat information based on a RAG framework, characterized in that: include: Each piece of network asset threat information is taken as a text block, and entities of various types in each text block are obtained; the weight of each entity is determined, and the weight is positively correlated with the ratio of the number of occurrences of entities of the same type as the entity in all text blocks to the total number of entities and the ratio of the number of characters of the entity in all text blocks, and the weight satisfies the following relationship: ; In the formula, For the The weight of an entity, For all text blocks with The number of occurrences of entities of the same type as the entity, is the total number of entities in all text blocks, For the The number of characters of each entity; the weighted sum of the number of characters of all entities is performed according to the weight to obtain the comprehensive entity length; in response to the proportion of the total length of all entities in the text block in the initial length of the text block being less than a preset threshold, the initial length of the text block is expected to be adjusted, the expected adjusted length is positively correlated with the relative difference between the average length of the entities in the text block and the comprehensive entity length, and the initial length of the text block, and is negatively correlated with the proportion and the richness of the types of entities in the text block, and the expected adjusted length satisfies the following relationship: ; In the formula, For the The expected adjusted length of the text block, For the The initial length of the text block, For the The total length of all entities in a text block as a percentage of the initial length of the text block. For the The richness of the entity types of a text block, For the The number of entity types in a text block, For the The number of entities in a text block, For the The average length of entities in a text block, is the comprehensive entity length, is the natural exponential function, is the maximum value function, is a round-up symbol; the two sides of the text block are adjusted according to the expected adjusted length and the number of categories of entities of each type in the text block adjacent to it, and the adjusted length of one side is positively correlated with the normalized result of the difference between the expected adjusted length of the text block and the initial length, and the total length of all entities in the text blocks adjacent to the text block on the side and the initial length of the text block adjacent to the text block on the side, and the adjusted length of one side satisfies the following relationship: ; In the formula, For the The adjusted length of one side of the text block, For the The expected adjusted length of the text block, For the The total length of all entities in the adjacent text blocks on one side of the text block, For the The total length of all entities in the adjacent text block on the other side of the text block, For the The initial length of the adjacent text block on one side of the text block, For the The initial length of the adjacent text block on the other side of the text block; the adjusted length of the other side is positively correlated with the expected adjusted length of the text block, and negatively correlated with the initial length and the adjusted length of one side, and the adjusted length of the other side satisfies the following relationship: ; In the formula, For the The text block is vectorized through RAG technology and written into the database to complete the generation of network asset threat information.

2. The method for generating network asset threat information based on the RAG framework according to claim 1, characterized in that: The network asset threat information is obtained through the ATT&CK website.

3. The method for generating network asset threat information based on the RAG framework according to claim 1, characterized in that: The entity is obtained through named entity recognition technology.

4. The method for generating network asset threat information based on the RAG framework according to claim 1, characterized in that: The method for completing the generation of network asset threat information includes: The questions and prompt words input by the user are vectorized, and the data with the highest relevance to the questions are recalled from the database and integrated into the prompt words. The network asset threat information is obtained through the integrated prompt words to complete the generation of network asset threat information.

Images