Open source intelligence relevance identification method and system based on semantic analysis driven model

Abstract

The present application relates to a method and system for identifying the relevance of open source intelligence based on a semantic analysis driven model. The method includes: using natural language processing technology based on deep learning to perform fine-grained semantic analysis on network security reports and forum discussion posts, respectively mining the word-granular contextual semantic association feature representations of network security reports and forum discussion posts, and performing fine-grained semantic interaction response analysis on the two, so as to intelligently identify whether the forum discussion post is the associated intelligence of the network security report. In this way, the accuracy and efficiency of open source intelligence relevance identification can be effectively improved, effectively assisting enterprises to promptly discover potential security threats and improve network security management capabilities.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular, to a method and system for identifying the relevance of open source intelligence based on a semantic analysis driven model. Background Art

[0002] With the rapid development and popularization of the Internet, the amount of information in cyberspace has exploded, especially in the field of network security, where a large amount of information such as various network security incidents, vulnerability reports, user discussions, etc. has emerged. For enterprises, timely and accurate discovery of security threats related to themselves from these open source intelligence is crucial for network security protection and emergency response.

[0003] However, due to the diversity, heterogeneity and massiveness of information, traditional correlation intelligence identification methods based on keyword search or rule matching often fail to effectively identify the potential correlations between different information due to the lack of understanding and utilization of the deep semantic information of network data, which may lead to false alarms and omissions.

[0004] Therefore, we look forward to an open source intelligence relevance identification method based on a semantic analysis driven model. Summary of the invention

[0005] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0006] In a first aspect, the present application provides a method for identifying the relevance of open source intelligence based on a semantic analysis driven model, the method comprising:

[0007] Get cybersecurity reports and first forum discussion posts;

[0008] Performing word-granularity-based semantic coding on the network security report and the first forum discussion post respectively to obtain a sequence of word-granularity semantic coding feature vectors of the network security report and a sequence of word-granularity semantic coding feature vectors of the first forum discussion post;

[0009] Inputting the sequence of the cybersecurity report word granularity semantic encoding feature vectors and the sequence of the first forum discussion post word granularity semantic encoding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of cybersecurity report word granularity enhanced semantic encoding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors;

[0010] Inputting the sequence of the cybersecurity report word granularity enhanced semantic encoding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors into a local fine-grained sequence interaction response aggregation network to obtain a cybersecurity report-forum post fine-grained semantic interaction global representation vector;

[0011] Based on the network security report-forum post fine-grained semantic interaction global representation vector, it is determined whether to regard the first forum discussion post as associated intelligence of the network security report.

[0012] Optionally, the network security report and the first forum discussion post are respectively semantically encoded based on word granularity to obtain a sequence of network security report word granularity semantic encoding feature vectors and a sequence of first forum discussion post word granularity semantic encoding feature vectors, including: extracting the text portion of the network security report to obtain a network security report text description; performing word segmentation on the network security report text description and then passing it through a semantic encoder containing a Bert model to obtain a sequence of network security report word granularity semantic encoding feature vectors; performing word segmentation on the first forum discussion post and then passing it through the semantic encoder containing a Bert model to obtain a sequence of first forum discussion post word granularity semantic encoding feature vectors.

[0013] Optionally, the sequence of the cybersecurity report word granularity semantic encoding feature vectors and the sequence of the first forum discussion post word granularity semantic encoding feature vectors are respectively input into a feature association optimization network based on a sequence intrinsic correlation semantic metric to obtain a sequence of cybersecurity report word granularity enhanced semantic encoding feature vectors and a sequence of first forum discussion post word granularity enhanced semantic encoding feature vectors, including: calculating the semantic association score vector between any two cybersecurity report word granularity semantic encoding feature vectors in the sequence of cybersecurity report word granularity semantic encoding feature vectors to obtain a set of semantic association score vectors; calculating the mean vector of the set of semantic association score vectors to obtain a global set of sequence intrinsic correlation. Representation vector; based on the global representation vector of the intrinsic correlation of the sequence, calculate the associated optimization factor of each network security report word granularity semantic coding feature vector in the sequence of network security report word granularity semantic coding feature vector to obtain a sequence of associated optimization factors; input the sequence of associated optimization factors into the Softmax activation function to obtain a sequence of associated optimization weight factors; use each associated optimization weight factor in the sequence of associated optimization weight factors as a weight, and weight each network security report word granularity semantic coding feature vector in the sequence of network security report word granularity semantic coding feature vector to obtain a sequence of network security report word granularity enhanced semantic coding feature vectors.

[0014] Optionally, the semantic association score vector between any two network security report word granularity semantic encoding feature vectors in the sequence of network security report word granularity semantic encoding feature vectors is calculated to obtain a set of semantic association score vectors, including: cascading any two network security report word granularity semantic encoding feature vectors in the sequence of network security report word granularity semantic encoding feature vectors and multiplying them by a first weight coefficient matrix, and then dot-adding them with a first bias vector to obtain the semantic association score vector.

[0015] Optionally, based on the global representation vector of intrinsic correlation of the sequence, the association optimization factor of each network security report word granular semantic coding feature vector in the sequence of network security report word granular semantic coding feature vectors is calculated to obtain a sequence of association optimization factors, including: multiplying the network security report word granular semantic coding feature vector and the global representation vector of intrinsic correlation of the sequence by different weight coefficient vectors and then performing addition operation to obtain a semantic association coefficient; adding a bias parameter to the semantic association coefficient and then passing it through a sigmoid activation function to obtain the association optimization factor.

[0016] Optionally, the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors are input into a local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector, including: calculating the local semantic association interaction vector between each group of corresponding network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vector in the sequence of the network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vector to obtain a network security report. - a sequence of local semantic association interaction vectors of network security reports - forum posts; calculating the fine-grained attention weights of each network security report - forum post local semantic association interaction vector in the sequence of network security reports - forum posts local semantic association interaction vectors to obtain a sequence of fine-grained attention weights; inputting the sequence of fine-grained attention weights into a random deactivation module to obtain a sequence of fine-grained attention weights after deactivation; using the sequence of fine-grained attention weights after deactivation as a weight distribution, calculating the weighted sum of the sequence of network security reports - forum posts local semantic association interaction vectors to obtain the network security report - forum post fine-grained semantic interaction global representation vector.

[0017] Optionally, the local semantic association interaction vector between each group of corresponding network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vectors in the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors is calculated to obtain a sequence of network security report-forum post local semantic association interaction vectors, including: calculating the network security report word granularity enhanced semantic coding feature vector and the corresponding first forum discussion post word granularity enhanced semantic coding feature vector by point-by-point addition, point-by-point subtraction and point-by-point multiplication to obtain a first fusion result, a second fusion result and a third fusion result; after cascading the first fusion result, the second fusion result and the third fusion result into a network security report-forum post multi-scale fusion feature vector, one-dimensional convolution processing and maximum pooling processing are performed on them to obtain the network security report-forum post local semantic association interaction vector.

[0018] Optionally, the fine-grained attention weights of each network security report-forum post local semantic association interaction vector in the sequence of network security report-forum post local semantic association interaction vectors are calculated to obtain a sequence of fine-grained attention weights, including: multiplying the network security report-forum post local semantic association interaction vector by a second weight coefficient matrix, adding the second bias vector and then passing the result through a tanh function to obtain a network security report-forum post local semantic association interaction encoding feature vector; using an attention score reference vector multiplied by the network security report-forum post local semantic association interaction encoding feature vector to obtain the fine-grained attention weight.

[0019] Optionally, based on the network security report-forum post fine-grained semantic interaction global representation vector, determining whether to regard the first forum discussion post as associated intelligence of the network security report includes: inputting the network security report-forum post fine-grained semantic interaction global representation vector into a classifier-based intelligence association recognition module to obtain an identification result, wherein the identification result is used to indicate whether to regard the first forum discussion post as associated intelligence of the network security report.

[0020] In a second aspect, the present application provides an open source intelligence relevance identification system based on a semantic analysis driven model, the system comprising:

[0021] A network security report acquisition module is used to obtain network security reports and first forum discussion posts;

[0022] A semantic encoding module, used to perform word-granularity-based semantic encoding on the network security report and the first forum discussion post, respectively, to obtain a sequence of word-granularity semantic encoding feature vectors of the network security report and a sequence of word-granularity semantic encoding feature vectors of the first forum discussion post;

[0023] A feature association optimization network module, used to input the sequence of the network security report word granularity semantic encoding feature vectors and the sequence of the first forum discussion post word granularity semantic encoding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of network security report word granularity enhanced semantic encoding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors;

[0024] A local fine-grained sequence interaction response aggregation network module is used to input the sequence of the network security report word granularity enhanced semantic encoding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors into a local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector;

[0025] The network security report related intelligence determination module is used to determine whether to regard the first forum discussion post as the related intelligence of the network security report based on the network security report-forum post fine-grained semantic interaction global representation vector.

[0026] The above technical solution uses deep learning-based natural language processing technology to perform fine-grained semantic analysis on network security reports and forum discussion posts, respectively mining the word-granular contextual semantic association feature representations of network security reports and forum discussion posts, and performing fine-grained semantic interaction response analysis on the two to intelligently identify whether the forum discussion post is related intelligence of the network security report. In this way, the accuracy and efficiency of open source intelligence relevance identification can be effectively improved, effectively assisting enterprises to timely discover potential security threats and improve network security management capabilities.

[0027] Other features and advantages of the present application will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0029] Figure 1The present invention is a flowchart of a method for identifying the relevance of open source intelligence based on a semantic analysis driven model according to an exemplary embodiment.

[0030] Figure 2 It is a block diagram of an open source intelligence relevance identification system based on a semantic analysis driven model according to an exemplary embodiment.

[0031] Figure 3 It is a block diagram of an electronic device according to an exemplary embodiment.

[0032] Figure 4 It is an application scenario diagram of an open source intelligence relevance identification method based on a semantic analysis driven model according to an exemplary embodiment. DETAILED DESCRIPTION

[0033] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0034] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0035] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0036] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0037] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0038] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0039] The specific implementation of the present application is described in detail below with reference to the accompanying drawings.

[0040] Figure 1 is a flowchart of a method for identifying open source intelligence relevance based on a semantic analysis driven model according to an exemplary embodiment. Figure 1 As shown, the method includes:

[0041] Step S101, obtaining a network security report and a first forum discussion post;

[0042] Step S102: performing word granularity-based semantic coding on the network security report and the first forum discussion post respectively to obtain a sequence of word granularity semantic coding feature vectors of the network security report and a sequence of word granularity semantic coding feature vectors of the first forum discussion post;

[0043] Step S103, respectively inputting the sequence of the network security report word granularity semantic coding feature vectors and the sequence of the first forum discussion post word granularity semantic coding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of network security report word granularity enhanced semantic coding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors;

[0044] Step S104: input the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors into a local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector;

[0045] Step S105: determining whether to regard the first forum discussion post as associated intelligence of the network security report based on the network security report-forum post fine-grained semantic interaction global representation vector.

[0046] In response to the above technical problems, the technical concept of this application is to use natural language processing technology based on deep learning to perform fine-grained semantic analysis on network security reports and forum discussion posts, respectively dig out the word-granular contextual semantic association feature representations of network security reports and forum discussion posts, and perform fine-grained semantic interaction response analysis on the two to intelligently identify whether the forum discussion post is the associated intelligence of the network security report. In this way, the accuracy and efficiency of open source intelligence correlation identification can be effectively improved, effectively assisting enterprises to timely discover potential security threats and improve network security management capabilities.

[0047] Based on this, in the technical solution of the present application, first, obtain the network security report and the first forum discussion post. It should be understood that the network security report usually contains in-depth analysis and description of network security incidents, vulnerabilities, threats and other information, which is the key information for understanding the current network security situation. The real-time information on platforms such as online forums and social media contains real-time discussions and opinions on network security incidents, technologies, tools, etc. by the majority of netizens, security experts, hackers and other groups, which may contain intelligence clues such as undisclosed vulnerability information, attack methods, and defense strategies. Based on this, in the technical solution of the present application, by extracting the first forum discussion post from the online forum and analyzing its correlation with the network security report, potential related intelligence can be identified to provide strong support for vulnerability repair, security protection and other work.

[0048] In one embodiment of the present application, the network security report and the first forum discussion post are respectively semantically encoded based on word granularity to obtain a sequence of network security report word granularity semantic encoding feature vectors and a sequence of first forum discussion post word granularity semantic encoding feature vectors, including: extracting the text portion of the network security report to obtain a network security report text description; performing word segmentation on the network security report text description and then passing it through a semantic encoder containing a Bert model to obtain a sequence of network security report word granularity semantic encoding feature vectors; performing word segmentation on the first forum discussion post and then passing it through the semantic encoder containing a Bert model to obtain a sequence of first forum discussion post word granularity semantic encoding feature vectors.

[0049] Next, considering that the cybersecurity report may contain a variety of media forms, such as charts, graphs, pictures, statistics, and code snippets, the text part of the cybersecurity report usually contains key information such as the detailed process, technical details, scope of impact, and solutions of the cybersecurity incident, which is an important basis for the identification of related intelligence. Therefore, in order to focus on the core content of the cybersecurity report, first, the text part of the cybersecurity report is extracted to obtain the text description of the cybersecurity report, which provides targeted input for subsequent semantic analysis.

[0050] Then, in order to achieve fine-grained semantic understanding of the text description of the network security report, in the technical solution of the present application, the text description of the network security report is firstly segmented to divide the continuous text string into independent words or phrases to obtain a network security report word sequence after segmentation. Then, a semantic encoder including a Bert model is used to semantically encode the network security report word sequence, and the bidirectional encoding capability of the Bert model is used to capture the deep semantic information of each word or phrase in the context of the network security report text description to obtain a sequence of granular semantic encoding feature vectors of network security report words.

[0051] At the same time, in order to maintain the consistency of the semantic encoding process and make the network security report and the first forum discussion post comparable, the first forum discussion post is also segmented and input into the semantic encoder containing the Bert model for semantic encoding, so as to capture the deep contextual semantic information of each word or phrase in the first forum discussion post, and generate a sequence of word-granular semantic encoding feature vectors of the first forum discussion post, providing a basis for subsequent semantic interaction analysis.

[0052] Furthermore, in order to further strengthen the intrinsic connection and correlation between the words in the text description of the network security report and the first forum discussion post, deep semantic information that may not be fully expressed in the original semantic coding is excavated, such as implicit relationships between words, contextual dependencies, etc. This application further introduces a feature association optimization network based on the semantic measurement of endogenous correlation of the sequence to perform semantic optimization processing on the sequence of the word granularity semantic coding feature vector of the network security report and the sequence of the word granularity semantic coding feature vector of the first forum discussion post, respectively, and improves the quality of feature representation by quantifying and optimizing the semantic association between feature vectors. Specifically, the feature association optimization network first quantifies the similarity or difference between feature vectors by calculating the semantic association between any two vectors in the input sequence, understands the semantic structure within the sequence, and generates a set of semantic association score vectors. Then, the aggregate information of the set of semantic association score vectors is used as the overall context information, and the association optimization factor of each feature vector in the input sequence is calculated to quantify the consistency or deviation between the individual feature vector and the overall semantic structure of the sequence, so as to serve as a guide for feature association optimization. Then, after normalizing the associated optimization factor, each feature vector in the original input sequence is weighted as a weight coefficient to reduce the interference of irrelevant semantic information and strengthen the contribution of key features, thereby obtaining a sequence of word-granularity enhanced semantic coding feature vectors for network security reports and a sequence of word-granularity enhanced semantic coding feature vectors for the first forum discussion posts.

[0053] In one embodiment of the present application, the sequence of the network security report word granularity semantic encoding feature vectors and the sequence of the first forum discussion post word granularity semantic encoding feature vectors are respectively input into a feature association optimization network based on a sequence endogenous correlation semantic metric to obtain a sequence of network security report word granularity enhanced semantic encoding feature vectors and a sequence of first forum discussion post word granularity enhanced semantic encoding feature vectors, including: calculating the semantic association score vector between any two network security report word granularity semantic encoding feature vectors in the sequence of network security report word granularity semantic encoding feature vectors to obtain a set of semantic association score vectors; calculating the mean vector of the set of semantic association score vectors to obtain a sequence endogenous correlation vector. A global representation vector of the correlation between network security report words and granularity; based on the global representation vector of the sequence endogenous correlation, the association optimization factor of each network security report word granularity semantic coding feature vector in the sequence of network security report word granularity semantic coding feature vectors is calculated to obtain a sequence of association optimization factors; the sequence of association optimization factors is input into the Softmax activation function to obtain a sequence of association optimization weight factors; using each association optimization weight factor in the sequence of association optimization weight factors as a weight, each network security report word granularity semantic coding feature vector in the sequence of network security report word granularity semantic coding feature vector is weighted respectively to obtain a sequence of network security report word granularity enhanced semantic coding feature vectors.

[0054] Furthermore, in one embodiment of the present application, the semantic association score vector between any two network security report word granularity semantic encoding feature vectors in the sequence of network security report word granularity semantic encoding feature vectors is calculated to obtain a set of semantic association score vectors, including: cascading any two network security report word granularity semantic encoding feature vectors in the sequence of network security report word granularity semantic encoding feature vectors and multiplying them by a first weight coefficient matrix, and then dot-adding them with a first bias vector to obtain the semantic association score vector.

[0055] Furthermore, in one embodiment of the present application, based on the global representation vector of the intrinsic correlation of the sequence, the association optimization factor of each network security report word granular semantic coding feature vector in the sequence of the network security report word granular semantic coding feature vector is calculated to obtain a sequence of association optimization factors, including: multiplying the network security report word granular semantic coding feature vector and the global representation vector of the intrinsic correlation of the sequence by different weight coefficient vectors and then performing addition operations to obtain semantic association coefficients; adding a bias parameter to the semantic association coefficient and then passing it through a sigmoid activation function to obtain the association optimization factor.

[0056] Specifically, the sequence of the network security report word granularity semantic coding feature vectors is processed by the following semantic feature association optimization formula to obtain the sequence of the network security report word granularity enhanced semantic coding feature vectors, wherein the semantic feature association optimization formula is:

[0057] X={x1,x2,...,x n}

[0058] r h =W h [x i ;x j ]+b h

[0059]

[0060] G i =Softmax[Sigmoid(M m R+H m x i +b m )]

[0061] {f 1i}={G i ·x i}

[0062] Where X represents the sequence of the granular semantic encoding feature vectors of the network security report words, x1, x2, x i 、x j and x n represents the first, second, i-th, j-th and n-th network security report word granularity semantic encoding feature vectors in the sequence of network security report word granularity semantic encoding feature vectors respectively, the value of n is the number of feature vectors in the sequence of network security report word granularity semantic encoding feature vectors, [·,·] represents a cascade operation, W h is the first weight coefficient matrix, b h is the first bias vector, r h is the hth semantic association score vector in the set of semantic association score vectors, the value of T is the number of vectors in the set of semantic association score vectors, R is the global representation vector of the sequence endogenous correlation, M m and H m Represent different weight coefficient vectors, b m is the bias parameter, Sigmoid is the sigmoid activation function, Softmax is the normalized exponential function, G i is the i-th correlation optimization factor, f 1i Represents the granularity-enhanced semantic encoding feature vector of the i-th cybersecurity report word.

[0063] Secondly, in order to conduct a semantic interaction analysis at the word level in the text description of the network security report and the first forum discussion post, the sequence of the word-granular enhanced semantic encoding feature vectors of the network security report and the sequence of the word-granular enhanced semantic encoding feature vectors of the first forum discussion post are further input into the local fine-grained sequence interaction response aggregation network to obtain the global representation vector of the network security report-forum post fine-grained semantic interaction. Specifically, the local fine-grained sequence interaction response aggregation network calculates the semantic association between the two corresponding words in the text description of the network security report and the first forum discussion post to capture the fine-grained semantic differences and commonalities of local word interactions to generate a sequence of local semantic association interaction vectors. Then, by performing feature learning on the sequence of the local semantic association interaction vectors to generate a corresponding attention weight sequence, the importance of the local semantic association interaction vector to the overall semantic interaction is quantitatively described, so that the model focuses on key semantic interaction points and ignores irrelevant or minor interaction information, thereby realizing deep mining of local fine-grained semantic interactions. At the same time, in order to prevent overfitting, the generated attention weight sequence is further subjected to random inactivation processing to enhance the generalization ability of the model. Next, the attention weight sequence after inactivation processing is used as the weight distribution, and through weighted aggregation operation, the local semantic association interaction vectors are fused into a global semantic interaction representation to generate a global representation vector of fine-grained semantic interaction between network security report and forum post, thereby accurately capturing the deep semantic association between the text description of the network security report and the first forum discussion post.

[0064] In one embodiment of the present application, the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors are input into a local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector, including: calculating the local semantic association interaction vector between each group of corresponding network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vector in the sequence of the network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vector to obtain a network A sequence of local semantic association interaction vectors of security reports and forum posts; calculating the fine-grained attention weights of each network security report-forum post local semantic association interaction vector in the sequence of network security report-forum post local semantic association interaction vectors to obtain a sequence of fine-grained attention weights; inputting the sequence of fine-grained attention weights into a random deactivation module to obtain a sequence of fine-grained attention weights after deactivation; using the sequence of fine-grained attention weights after deactivation as a weight distribution, calculating the weighted sum of the sequence of network security report-forum post local semantic association interaction vectors to obtain the network security report-forum post fine-grained semantic interaction global representation vector.

[0065] Further, in one embodiment of the present application, the local semantic association interaction vector between each group of corresponding network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vectors in the sequence of the network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vectors is calculated to obtain a sequence of network security report-forum post local semantic association interaction vectors, including: calculating the position point addition, position point subtraction and position point multiplication between the network security report word granularity enhanced semantic coding feature vector and the corresponding first forum discussion post word granularity enhanced semantic coding feature vector to obtain a first fusion result, a second fusion result and a third fusion result; after cascading the first fusion result, the second fusion result and the third fusion result into a network security report-forum post multi-scale fusion feature vector, one-dimensional convolution processing and maximum pooling processing are performed on it to obtain the network security report-forum post local semantic association interaction vector.

[0066] Furthermore, in one embodiment of the present application, the fine-grained attention weights of each network security report-forum post local semantic association interaction vector in the sequence of the network security report-forum post local semantic association interaction vectors are calculated to obtain a sequence of fine-grained attention weights, including: multiplying the network security report-forum post local semantic association interaction vector by a second weight coefficient matrix, adding the second bias vector and then passing the result through a tanh function to obtain a network security report-forum post local semantic association interaction encoding feature vector; using an attention score reference vector multiplied by the network security report-forum post local semantic association interaction encoding feature vector to obtain the fine-grained attention weight.

[0067] Specifically, the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors are processed by the following interactive response analysis formula to obtain the network security report-forum post fine-grained semantic interaction global representation vector:

[0068]

[0069] E i =v T tanh(W r f i (f 1i , f 2i )+b r )

[0070] W i = dropout(E i )

[0071]

[0072] Among them, f 1i represents the ith network security report word granularity-enhanced semantic coding feature vector in the sequence of network security report word granularity-enhanced semantic coding feature vectors, the value of n is the number of feature vectors in the sequence of network security report word granularity-enhanced semantic coding feature vectors, and f 2i represents the i-th first forum discussion post word granularity-enhanced semantic coding feature vector in the sequence of the first forum discussion post word granularity-enhanced semantic coding feature vectors, ⊙ represents the dot product, Indicates point addition, represents point subtraction, [·,·] represents a cascade operation, MaxPool(·) represents a maximum pooling operation, conv1D(·) represents a one-dimensional convolution operation, and f i (f 1i ,f 2i) represents the ith network security report-forum post local semantic association interaction vector in the sequence of network security report-forum post local semantic association interaction vectors, W r is the second weight coefficient matrix, b r is the second bias vector, tanh is the hyperbolic tangent function, is the attention score reference vector, E i represents the i-th fine-grained attention weight, dropout(·) represents random inactivation processing, and W i represents the fine-grained attention weight after the i-th inactivation process, and v represents the local semantic association interaction vector of the network security report-forum post.

[0073] Next, the network security report-forum post fine-grained semantic interaction global representation vector is input into the classifier-based intelligence association recognition module to obtain a recognition result, and the recognition result is used to indicate whether the first forum discussion post is regarded as the associated intelligence of the network security report. It should be understood that the classifier-based intelligence association recognition module uses known associated and unassociated post pairs as supervisory signals for training and learning, optimizes the network parameters of the classifier, and effectively learns the decision boundary that distinguishes associated and unassociated posts. Furthermore, when the network security report-forum post fine-grained semantic interaction global representation vector is input into the classifier, the classifier can calculate the association probability between the network security report and the first forum discussion post according to the learned decision rules, thereby intelligently judging whether the first forum discussion post has intelligence relevance to the network security report.

[0074] In one embodiment of the present application, based on the network security report-forum post fine-grained semantic interaction global representation vector, determining whether to regard the first forum discussion post as associated intelligence of the network security report includes: inputting the network security report-forum post fine-grained semantic interaction global representation vector into a classifier-based intelligence association recognition module to obtain a recognition result, and the recognition result is used to indicate whether to regard the first forum discussion post as associated intelligence of the network security report.

[0075] In a preferred example, it is considered that the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors represent the word granularity contextual semantic association features of the network security report determined based on word segmentation and the word granularity contextual semantic association features of the first forum discussion post determined based on word segmentation, respectively. In this way, when the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors are input into the local fine-grained sequence interaction response aggregation network, the network security report-forum post fine-grained semantic interaction global representation vector obtained will cause the distribution regression mode shift due to the modal difference between the word granularity contextual semantic association features determined by fine-grained deconstruction, resulting in inconsistent feature fine-grained association responses, that is, causing the overflow of the recognition result obtained by the network security report-forum post fine-grained semantic interaction global representation vector input into the classifier-based intelligence association recognition module, affecting its accuracy.

[0076] Based on this, the network security report-forum post fine-grained semantic interaction global representation vector is input into the classifier-based intelligence association recognition module to obtain the recognition results, which specifically include:

[0077] Determine the confirmation probability value corresponding to the associated intelligence indicating that the first forum discussion post is regarded as a network security report obtained by inputting the global representation vector of the network security report-forum post fine-grained semantic interaction into the intelligence association recognition module based on the classifier, and pass the global representation vector of the network security report-forum post fine-grained semantic interaction through a probabilistic activation function to obtain a probabilistic global representation vector of the network security report-forum post fine-grained semantic interaction;

[0078] Subtract the probabilistic network security report-forum post fine-grained semantic interaction global representation vector from the unit feature vector, and use the feature vector resulting from the subtraction as the base to calculate a power function with the confirmation probability value as the exponent;

[0079] Performing a dot multiplication of the power function vector and the probabilistic global representation vector of fine-grained semantic interaction between network security report and forum post to obtain an intermediate feature vector of global representation of fine-grained semantic interaction between network security report and forum post;

[0080] Taking the absolute value of each eigenvalue of the probabilistic global representation vector of fine-grained semantic interaction between cybersecurity report and forum post as the base, calculating a power function with the inverse of the confirmation probability value as the exponent, and summing all eigenvalues ​​to obtain the bias eigenvalue of the global representation vector of fine-grained semantic interaction between cybersecurity report and forum post;

[0081] After multiplying the bias eigenvalue of the global representation of network security report-forum post fine-grained semantic interaction by a weight as a hyperparameter, the bias eigenvalue is interpolated with the intermediate eigenvector of the global representation of network security report-forum post fine-grained semantic interaction to obtain an optimized global representation vector of network security report-forum post fine-grained semantic interaction; and

[0082] The optimized network security report-forum post fine-grained semantic interaction global representation vector is input into a classifier-based intelligence association recognition module to obtain a recognition result.

[0083] Wherein, let the probabilistic global representation vector of fine-grained semantic interaction between network security report and forum post be denoted as V, then the optimized global representation vector V′ of fine-grained semantic interaction between network security report and forum post is expressed as:

[0084]

[0085] Where V is the probabilistic global representation vector of the fine-grained semantic interaction between cybersecurity reports and forum posts, I is the unit feature vector, and v i ∈V, is the eigenvalue of the probabilistic global representation vector V of the fine-grained semantic interaction between cybersecurity reports and forum posts, Indicates point addition, represents point subtraction, ⊙ represents point multiplication, α represents the weight as a hyperparameter, V ′ represents the global representation vector of the optimized network security report-forum post fine-grained semantic interaction, and p is the confirmation probability value.

[0086] That is, for the global representation vector of the fine-grained semantic interaction of the network security report and the forum post, based on the convergence limit of the Cauchy-Hadamard form power series probability distribution, the feature set of the global representation vector of the fine-grained semantic interaction of the network security report and the forum post is represented by a formal power series based on the convergence probability, and a set convergence bounded bias based on each eigenvalue of the global representation vector of the fine-grained semantic interaction of the network security report and the forum post is added as a convergence radius representation, so as to avoid the invalid overflow of the classification result caused by the deviation of the distribution pattern of the global representation vector of the fine-grained semantic interaction of the network security report and the forum post in the regression process of the intelligence association recognition module based on the classifier due to the gradient propagation of the model parameters based on the convergence probability under a unified probability convergence limit standard, thereby improving the accuracy of the recognition result obtained by the intelligence association recognition module based on the classifier.

[0087] In summary, the above scheme uses natural language processing technology based on deep learning to perform fine-grained semantic analysis on network security reports and forum discussion posts, respectively digs out the word-granular contextual semantic association feature representations of network security reports and forum discussion posts, and performs fine-grained semantic interaction response analysis on the two to intelligently identify whether the forum discussion post is the associated intelligence of the network security report. In this way, the accuracy and efficiency of open source intelligence correlation identification can be effectively improved, effectively assisting enterprises to timely discover potential security threats and improve network security management capabilities.

[0088] Figure 2 FIG. 1 is a block diagram of an open source intelligence relevance identification system based on a semantic analysis driven model according to an exemplary embodiment. Figure 2 As shown, the system 200 includes:

[0089] A network security report acquisition module 201 is used to acquire a network security report and a first forum discussion post;

[0090] A semantic encoding module 202, configured to perform word-granularity-based semantic encoding on the network security report and the first forum discussion post, respectively, to obtain a sequence of word-granularity semantic encoding feature vectors of the network security report and a sequence of word-granularity semantic encoding feature vectors of the first forum discussion post;

[0091] The feature association optimization network module 203 is used to input the sequence of the network security report word granularity semantic coding feature vectors and the sequence of the first forum discussion post word granularity semantic coding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of network security report word granularity enhanced semantic coding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors;

[0092] The local fine-grained sequence interaction response aggregation network module 204 is used to input the sequence of the network security report word granularity enhanced semantic encoding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors into the local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector;

[0093] The network security report related intelligence determination module 205 is used to determine whether to regard the first forum discussion post as the related intelligence of the network security report based on the network security report-forum post fine-grained semantic interaction global representation vector.

[0094] Reference below Figure 3, which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present application. The terminal device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0095] like Figure 3 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0096] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0097] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0098] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0099] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0100] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0101] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0102] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] The modules involved in the embodiments described in this application can be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the test parameter acquisition module can also be described as a "module for acquiring device test parameters corresponding to the target device".

[0104] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0105] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] Figure 4 FIG. 1 is an application scenario diagram of an open source intelligence relevance identification method based on a semantic analysis driven model according to an exemplary embodiment. Figure 4 As shown, in this application scenario, first, a network security report is obtained (for example, Figure 4 ), and the first forum discussion post (e.g., Figure 4 Then, the obtained network security report and the first forum discussion post are input into a server that is deployed with an open source intelligence relevance identification algorithm based on a semantic analysis driven model (for example, Figure 4 In S) shown in , the server is capable of processing the network security report and the first forum discussion post based on the open source intelligence relevance identification algorithm of the semantic analysis driven model to determine whether to regard the first forum discussion post as related intelligence of the network security report.

[0107] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

[0108] In addition, although each operation is described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or to be performed in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the application. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0109] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely exemplary forms of implementation. With respect to the apparatus in the above-mentioned embodiments, the specific manner in which each module performs the operation has been described in detail in the embodiments related to the method, and will not be described in detail here.

Claims

1. A method for identifying the relevance of open source intelligence based on a semantic analysis driven model, characterized in that: include: Get cybersecurity reports and first forum discussion posts; Performing word-granularity-based semantic coding on the network security report and the first forum discussion post respectively to obtain a sequence of word-granularity semantic coding feature vectors of the network security report and a sequence of word-granularity semantic coding feature vectors of the first forum discussion post; Inputting the sequence of the cybersecurity report word granularity semantic encoding feature vectors and the sequence of the first forum discussion post word granularity semantic encoding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of cybersecurity report word granularity enhanced semantic encoding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors; Inputting the sequence of the cybersecurity report word granularity enhanced semantic encoding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors into a local fine-grained sequence interaction response aggregation network to obtain a cybersecurity report-forum post fine-grained semantic interaction global representation vector; Determining whether to regard the first forum discussion post as associated intelligence of the network security report based on the network security report-forum post fine-grained semantic interaction global representation vector; The sequence of the network security report word granularity semantic coding feature vectors and the sequence of the first forum discussion post word granularity semantic coding feature vectors are respectively input into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of network security report word granularity enhanced semantic coding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors, including: Calculate the semantic association score vector between any two network security report word granular semantic encoding feature vectors in the sequence of network security report word granular semantic encoding feature vectors to obtain a set of semantic association score vectors; Calculating the mean vector of the set of semantic association score vectors to obtain a global representation vector of sequence endogenous correlation; Based on the sequence endogenous correlation global representation vector, calculating the association optimization factor of each network security report word granular semantic encoding feature vector in the sequence of network security report word granular semantic encoding feature vectors to obtain a sequence of association optimization factors; The sequence of the associated optimization factors is input into Activation function to obtain a sequence of associated optimization weight factors; Using each associated optimization weight factor in the sequence of associated optimization weight factors as a weight, weighting each network security report word granular semantic coding feature vector in the sequence of network security report word granular semantic coding feature vectors respectively to obtain the sequence of network security report word granular enhanced semantic coding feature vectors; The sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors are input into a local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector, including: Calculate the local semantic association interaction vector between each group of corresponding network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vectors in the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors to obtain a sequence of network security report-forum post local semantic association interaction vectors; Calculating the fine-grained attention weight of each network security report-forum post local semantic association interaction vector in the sequence of network security report-forum post local semantic association interaction vectors to obtain a sequence of fine-grained attention weights; Inputting the sequence of fine-grained attention weights into a random dropout module to obtain a sequence of fine-grained attention weights after dropout processing; The sequence of fine-grained attention weights after the deactivation process is used as the weight distribution, and the weighted sum of the sequence of network security report-forum post local semantic association interaction vectors is calculated to obtain the network security report-forum post fine-grained semantic interaction global representation vector.

2. The method for identifying open source intelligence relevance based on a semantic analysis driven model according to claim 1 is characterized in that: The network security report and the first forum discussion post are respectively semantically encoded based on word granularity to obtain a sequence of network security report word granularity semantic encoding feature vectors and a sequence of first forum discussion post word granularity semantic encoding feature vectors, including: Extracting a text portion of the network security report to obtain a text description of the network security report; After word segmentation processing is performed on the text description of the network security report, a semantic encoder including a Bert model is used to obtain a sequence of granular semantic encoding feature vectors of the network security report words; After word segmentation processing is performed on the first forum discussion post, the first forum discussion post is passed through the semantic encoder including the Bert model to obtain a sequence of word granularity semantic encoding feature vectors of the first forum discussion post.

3. The open source intelligence relevance identification method based on the semantic analysis driven model according to claim 2 is characterized in that: Calculating the semantic association score vector between any two network security report word granular semantic encoding feature vectors in the sequence of network security report word granular semantic encoding feature vectors to obtain a set of semantic association score vectors, including: Any two network security report word granular semantic coding feature vectors in the sequence of network security report word granular semantic coding feature vectors are cascaded and multiplied by the first weight coefficient matrix, and then dotted with the first bias vector to obtain the semantic association score vector.

4. The method for identifying open source intelligence relevance based on a semantic analysis driven model according to claim 3 is characterized in that: Based on the sequence endogenous correlation global representation vector, calculating the association optimization factor of each network security report word granular semantic encoding feature vector in the sequence of network security report word granular semantic encoding feature vectors to obtain a sequence of association optimization factors, including: The network security report word granular semantic encoding feature vector and the sequence endogenous correlation global representation vector are multiplied by different weight coefficient vectors and then added to obtain a semantic correlation coefficient; The semantic association coefficient is added with a bias parameter and then passed through a sigmoid activation function to obtain the association optimization factor.

5. The method for identifying open source intelligence relevance based on a semantic analysis driven model according to claim 4 is characterized in that: Calculating the local semantic association interaction vector between each group of corresponding network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vectors in the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors to obtain a sequence of network security report-forum post local semantic association interaction vectors, including: Calculate the position point addition, position point subtraction and position point multiplication between the network security report word granularity enhanced semantic coding feature vector and the first forum discussion post word granularity enhanced semantic coding feature vector corresponding thereto to obtain a first fusion result, a second fusion result and a third fusion result; After the first fusion result, the second fusion result and the third fusion result are cascaded into a network security report-forum post multi-scale fusion feature vector, one-dimensional convolution processing and maximum pooling processing are performed on it to obtain the network security report-forum post local semantic association interaction vector.

6. The method for identifying open source intelligence relevance based on a semantic analysis driven model according to claim 5 is characterized in that: Calculating the fine-grained attention weights of each network security report-forum post local semantic association interaction vector in the sequence of network security report-forum post local semantic association interaction vectors to obtain a sequence of fine-grained attention weights, including: Multiplying the network security report-forum post local semantic association interaction vector by a second weight coefficient matrix, adding the second bias vector and then passing through a tanh function to obtain a network security report-forum post local semantic association interaction encoding feature vector; The attention score reference vector is multiplied by the network security report-forum post local semantic association interaction encoding feature vector to obtain the fine-grained attention weight.

7. The method for identifying open source intelligence relevance based on a semantic analysis driven model according to claim 6 is characterized in that: Determining whether to regard the first forum discussion post as associated intelligence of the network security report based on the network security report-forum post fine-grained semantic interaction global representation vector includes: The network security report-forum post fine-grained semantic interaction global representation vector is input into a classifier-based intelligence association recognition module to obtain a recognition result, and the recognition result is used to indicate whether the first forum discussion post is regarded as associated intelligence of the network security report.

8. An open source intelligence relevance identification system based on a semantic analysis driven model, characterized in that: include: A network security report acquisition module is used to obtain network security reports and first forum discussion posts; A semantic encoding module, used to perform word-granularity-based semantic encoding on the network security report and the first forum discussion post, respectively, to obtain a sequence of word-granularity semantic encoding feature vectors of the network security report and a sequence of word-granularity semantic encoding feature vectors of the first forum discussion post; A feature association optimization network module, used to input the sequence of the network security report word granularity semantic encoding feature vectors and the sequence of the first forum discussion post word granularity semantic encoding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of network security report word granularity enhanced semantic encoding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors; A local fine-grained sequence interaction response aggregation network module is used to input the sequence of the network security report word granularity enhanced semantic encoding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic encoding feature vectors into a local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector; A network security report related intelligence determination module, used to determine whether to regard the first forum discussion post as the related intelligence of the network security report based on the network security report-forum post fine-grained semantic interaction global representation vector; The sequence of the network security report word granularity semantic coding feature vectors and the sequence of the first forum discussion post word granularity semantic coding feature vectors are respectively input into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain a sequence of network security report word granularity enhanced semantic coding feature vectors and a sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors, including: Calculate the semantic association score vector between any two network security report word granular semantic encoding feature vectors in the sequence of network security report word granular semantic encoding feature vectors to obtain a set of semantic association score vectors; Calculating the mean vector of the set of semantic association score vectors to obtain a global representation vector of sequence endogenous correlation; Based on the sequence endogenous correlation global representation vector, calculating the association optimization factor of each network security report word granular semantic encoding feature vector in the sequence of network security report word granular semantic encoding feature vectors to obtain a sequence of association optimization factors; The sequence of the associated optimization factors is input into Activation function to obtain a sequence of associated optimization weight factors; Using each associated optimization weight factor in the sequence of associated optimization weight factors as a weight, weighting each network security report word granular semantic coding feature vector in the sequence of network security report word granular semantic coding feature vectors respectively to obtain the sequence of network security report word granular enhanced semantic coding feature vectors; The sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors are input into a local fine-grained sequence interaction response aggregation network to obtain a network security report-forum post fine-grained semantic interaction global representation vector, including: Calculate the local semantic association interaction vector between each group of corresponding network security report word granularity enhanced semantic coding feature vectors and the first forum discussion post word granularity enhanced semantic coding feature vectors in the sequence of the network security report word granularity enhanced semantic coding feature vectors and the sequence of the first forum discussion post word granularity enhanced semantic coding feature vectors to obtain a sequence of network security report-forum post local semantic association interaction vectors; Calculating the fine-grained attention weight of each network security report-forum post local semantic association interaction vector in the sequence of network security report-forum post local semantic association interaction vectors to obtain a sequence of fine-grained attention weights; Inputting the sequence of fine-grained attention weights into a random dropout module to obtain a sequence of fine-grained attention weights after dropout processing; The sequence of fine-grained attention weights after the deactivation process is used as the weight distribution, and the weighted sum of the sequence of network security report-forum post local semantic association interaction vectors is calculated to obtain the network security report-forum post fine-grained semantic interaction global representation vector.

Images