A gpt4-based network security field knowledge enhancement method and system

Abstract

The application relates to the technical field of network security, in particular to a network security field knowledge enhancement method and system based on GPT4, which regards a knowledge graph in the network security field as an external knowledge base of GPT-4, forms a GPT-4 reasoning chain through continuous interaction with GPT-4, lets the GPT-4 utilize the powerful reasoning capability to gradually reason out information most related to a problem in the knowledge graph, and simultaneously combines the powerful knowledge reserve of the GPT-4 to continue analyzing and processing the obtained effective information, so as to realize network security field knowledge enhancement of the GPT-4; the method comprises the following steps: preprocessing the knowledge graph to obtain entity vectors; obtaining key elements of a question input by a user to obtain embedded vectors; obtaining semantic similarity score between all entity vectors and the embedded vectors, and the entity with the highest semantic similarity score is the most similar semantic entity; a threshold value is set, if the semantic similarity score of the most similar semantic entity is still lower than the threshold value, the method is switched to large model question and answer processing.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and specifically to a method and system for enhancing network security domain knowledge based on GPT4. Background Art

[0002] The GPT (Generative Pre-training Transformer) series of models, often called large language models, are a series of natural language processing (NLP) models developed by OpenAI. They are designed to understand and generate human language using deep learning techniques. These models are based on the Transformer architecture and improve their performance and flexibility through pre-training and fine-tuning on large amounts of text data.

[0003] The question-answering system (KGQAN) queries the knowledge graph to answer user questions by identifying the semantics of the user's question. Its implementation is divided into three steps: (i) Question Understanding: Extracting entities and relations from the question and generating abstract representations. Seq2Seq neural networks are trained to learn how to extract formal abstract representations from natural language questions. The trained Seq2Seq model extracts the entities and relations in the question and generates abstract representations. Furthermore, the expected data type and unknown semantic types are predicted to help filter entity information in the target knowledge graph to improve the accuracy of the answer. Data type prediction is defined as a classification task, using a deep neural network to predict the data and semantic types of user questions. The expected data type can be a date, number, Boolean value, or string. (ii) Linking: This is divided into node linking and relationship linking. Nodes and relationships in the target knowledge graph are combined with their descriptions to identify the nodes and relationships that are semantically closest to the abstract description of the target knowledge graph and the question. The abstract representations are then mapped to the corresponding entities and relationships in the target knowledge graph to construct a knowledge graph query. (iii) Filtering: Nodes and relationships in the target knowledge graph that do not conform to the predicted data type or semantic type are filtered out. The filtered nodes and relationships are combined to generate a set of knowledge graph subgraphs with all possible valid combinations. The scores of this set of subgraphs are calculated and the top K are returned as the answer to the user.

[0004] The above system uses a model to identify all triples in a user's question, searches for the most relevant triples in the target knowledge graph, and ultimately expands the triples to create a sub-knowledge graph, which is then returned to the user. This approach identifies triples in user questions without considering domain knowledge, so the returned information may contain excessive amounts of irrelevant knowledge. This excessive redundancy results in inaccurate information returned to the user, forcing the user to verify that the information provided contains valid information, resulting in poor system usability.

[0005] In addition, the core problem solved by the above-mentioned question-and-answer system is graph query. Regardless of the correctness and accuracy of the graph query, even if the corresponding information is correctly and accurately queried, it will be returned to the user in the form of a knowledge graph. However, due to the characteristics of the knowledge graph as a structured organization of information, the returned information has poor readability and a high user threshold, making it difficult to achieve a good user experience. Summary of the Invention

[0006] (1) Technical problems solved

[0007] In response to the shortcomings of the existing technology, the present invention provides a method and system for enhancing knowledge in the field of network security based on GPT4. The knowledge graph in the field of network security is used as the external knowledge base of GPT-4. By continuously interacting with GPT-4, a GPT-4 reasoning chain is formed, allowing it to use its own powerful reasoning ability to gradually infer the most relevant information in the knowledge graph to solve the problem. At the same time, combined with the powerful knowledge reserve of GPT-4, the obtained effective information is further analyzed and processed, thereby realizing the enhancement of its own knowledge in the field of network security.

[0008] (2) Technical solution

[0009] To achieve the above objectives, the present invention provides the following technical solution: a method for enhancing network security domain knowledge based on GPT4, comprising the following steps:

[0010] Preprocess the knowledge graph to obtain entity vectors;

[0011] Obtain the key elements of the question entered by the user and obtain an embedding vector; obtain the semantic similarity scores between all entity vectors and the embedding vector, and the entity with the highest semantic similarity score is the entity with the closest semantics;

[0012] Set a threshold. If the semantic similarity score of the most semantically similar entity is still lower than the threshold, switch to large model question answering processing; if the semantic similarity score of the most semantically similar entity is higher than the threshold, and the semantic similarity score of more than one entity is higher than the threshold, the semantically closest entity is determined to be the corresponding entity of the question, and the knowledge graph reading is started, and then the GPT-4 reasoning chain processing is performed.

[0013] Furthermore, the method of preprocessing the knowledge graph to obtain entity vectors includes the following steps:

[0014] All entity nodes in the knowledge graph are extracted, and then each entity is mapped into an entity vector in a high-dimensional space through word embedding to complete the entity embedding process. Then, an entity vector library is built to store all entity vectors in the knowledge graph.

[0015] Furthermore, the method for obtaining the embedding vector comprises the following steps:

[0016] The subject in the question given by the user is taken as a key element, and the word embedding method is used to convert the key element into a corresponding embedding vector.

[0017] Further, the method for obtaining the semantic similarity score between all entity vectors and embedding vectors comprises the following steps:

[0018] The method for obtaining the semantic similarity score between all entity vectors and embedding vectors comprises the following steps:

[0019] The semantic similarity score is obtained by calculating the cosine similarity between the embedding vector and the entity vector, and the calculation method is as follows:

[0020] The formula for calculating the cosine similarity of the embedding vector and the entity vector is:

[0021]

[0022] Where:

[0023] A and B are two non-zero vectors;

[0024] A·B represents the dot product of A and B;

[0025] ‖A‖ and ‖B‖ represent the Euclidean norm of vectors A and B, respectively;

[0026] The cosine of the angle between the embedding vector and the entity vector is obtained, and the cosine of the angle is taken as the semantic similarity score of the entity. Then, according to the semantic similarity score, the entities with the most similar semantics are matched out.

[0027] Further, the inference chain of GPT-4 comprises the following steps:

[0028] Optimal relationship inference: all relationships associated with the entity node are queried through the template, and after serialization processing, all relationships are input into GPT-4. GPT-4 infers the most relevant relationship in all relationships according to the user input question;

[0029] Related triple inference: according to the most relevant relationship inferred by GPT-4, all triples containing the entity-most relevant relationship pair are queried, and after serialization processing, GPT-4 is input. GPT-4 further infers all triples related to the question according to the user input question;

[0030] Iterative decision: whether to continue iteration is decided according to whether all the triples found are sufficient to support GPT-4 to answer the user's question.

[0031] Furthermore, the method of deciding whether to continue iteration based on whether all triple information found is sufficient to support GPT-4 in answering the user's question includes the following steps:

[0032] If the current information is not sufficient to answer the question, GPT-4 continues to iterate until sufficient information is obtained; if the current information is sufficient, no iteration is performed and domain knowledge enhancement is completed directly.

[0033] The present invention provides a network security domain knowledge enhancement system based on GPT4, comprising:

[0034] Knowledge graph preprocessing module: used to preprocess the knowledge graph to obtain entity vectors;

[0035] User question processing module: responsible for receiving user input questions, selecting key elements, and generating embedding vectors;

[0036] Similarity calculation module: calculates the semantic similarity score between the embedding vector and the entity vector to determine the entity with the closest semantics;

[0037] Threshold judgment module: Set a threshold to determine whether a suitable entity is found in the knowledge graph; if the semantic similarity score of the most semantically similar entity is higher than the threshold, and the semantic similarity score of more than one entity is higher than the threshold, the most semantically similar entity is determined to be the corresponding entity of the question;

[0038] Knowledge graph reading module: After determining the entity with the closest semantics, the knowledge graph is read and GPT-4 is used to perform reasoning chain processing to generate the final answer.

[0039] (3) Beneficial effects

[0040] Compared with the existing technology, the present invention provides a network security domain knowledge enhancement method and system based on GPT4, which has the following beneficial effects: the present invention applies GPT-4 to the intelligent question-answering system in the network security field for the first time, and enhances its domain knowledge by using the network security knowledge graph as the external knowledge base of GPT-4, making it perfectly adapted to the network security field;

[0041] This invention proposes a new method for obtaining information from knowledge graphs - GPT-4's reasoning chain. By continuously interacting with GPT-4, it uses its reasoning ability to gradually obtain information, and finally uses the obtained information to enhance its own knowledge. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic flow diagram of the present invention; DETAILED DESCRIPTION

[0043] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0044] See also Figure 1 The present invention is a network security domain knowledge enhancement method based on GPT4, comprising the following steps:

[0045] Step 1: Preprocessing of knowledge graph

[0046] This invention is developed for applications in the field of network security and can be used in knowledge graphs in the field of network security. When docking to a new network security knowledge graph, all entity nodes in the knowledge graph are first extracted, and then each entity is converted into a corresponding entity embedding through word embedding. Specifically, each entity is mapped to an entity vector in a high-dimensional space. These entity vectors capture the semantic relationships between entities, such as similarity and co-occurrence relationships, and can be used for downstream tasks such as semantic matching. After the entity embedding is completed, a knowledge graph entity vector library is constructed to store all entity vectors in the knowledge graph for subsequent management and query.

[0047] Step 2: Determination of key elements

[0048] After obtaining user input, the first step is to embed key elements. This involves taking the subject of the user's question as the key element and converting it into a corresponding embedding vector using the same word embedding method. Then, the cosine similarity matching method of the vectors is used to determine whether the subject of the user's question is within the scope of the knowledge graph, and to which entity in the knowledge graph the subject within the scope of the knowledge graph corresponds.

[0049] Vector cosine similarity is a metric used to measure the directional similarity between two vectors. It is widely used in fields such as text analysis, recommendation systems, and information retrieval. It is particularly useful for finding semantically similar words or entities when processing embedding vectors and entity vectors. Specifically, it evaluates the similarity between two embedding vectors and entity vectors by calculating the cosine of the angle between them. Cosine similarity of vectors only considers the direction of the vectors, not their magnitude, to capture semantic similarity.

[0050] The calculation formula for the cosine similarity between the embedding vector and the entity vector is:

[0051]

[0052] in:

[0053] A and B are two non-zero vectors;

[0054] A·B represents the dot product of A and B;

[0055] ‖A‖ and ‖B‖ represent the Euclidean norm of vectors A and B, respectively, i.e., the length of the vector;

[0056] Therefore, the present invention calculates the cosine similarity between the embedding vector of the key element and the entity vector in each knowledge graph as the semantic similarity score of the entity, and then sorts them according to the score to match the entity in the knowledge graph that is most semantically similar to the key element, and sets a threshold for diversion processing. If the entity with the highest score is still lower than the threshold, assuming that the docked knowledge graph is large enough to cover all entities in the network security field, it is considered that the key element in the user's question is not within the scope of the knowledge graph, and it will be determined that the question does not belong to the category of network security, and the large model question and answer processing will be directly adopted; if the entity with the highest score is higher than the threshold, and more than one entity has a score higher than the threshold, the entity with the highest score will be determined as the corresponding entity of the question, and the knowledge graph reading will be started;

[0057] Step 3: Knowledge Graph Reading

[0058] This paper proposes a new method to extract the required effective information from the knowledge graph, which is called the reasoning chain of GPT-4. The reasoning chain of GPT-4 is introduced in detail below:

[0059] First, the entity that matches the question is used as the starting point for reasoning. The first link in GPT-4's reasoning chain is optimal relationship reasoning: all relationships associated with the entity node are queried through the template. All these relationships are serialized and input into GPT-4, which then infers the most relevant relationship among all relationships based on the question entered by the user.

[0060] The second step is related triple reasoning: Based on the most relevant relationship inferred by GPT-4, all triples containing the entity-most relevant relationship pair are queried. After serialization, they are input into GPT-4, which then infers all triples related to the question entered by the user.

[0061] The third step is iterative decision-making: whether to continue iterating is determined by whether all the triples found are sufficient to support GPT-4 in answering the user's question. If the current information is not sufficient to answer the question, GPT-4 will continue iterating until it has enough information. If the current information is sufficient, no iteration is performed and domain knowledge enhancement is completed directly.

[0062] Domain knowledge enhancement includes the following steps: GPT-4 combines the acquired triple information with its own powerful knowledge reserves, parses and polishes all valid information, and converts it into highly readable natural language and returns it to the user; the present invention combines GPT-4's massive knowledge reserves to parse and polish the acquired triple information, converting it into highly readable natural language, lowering the user's usage threshold and improving the user experience.

[0063] This invention leverages GPT-4's powerful text understanding and reasoning capabilities to gradually infer the most relevant information to the natural language questions posed by users on the knowledge graph. While ensuring accuracy, it can also greatly solve the problem of information redundancy and improve the accuracy of the returned information.

[0064] Through the above steps, the present invention converts the information query process of the knowledge graph into a linear reasoning process by continuously linking and interacting with GPT-4. It is obvious that this query and reasoning process for the knowledge graph is very similar to the way we humans obtain information from the knowledge graph. Therefore, this process is figuratively called knowledge graph reading, and this method of reading knowledge graphs is called GPT-4's reasoning chain.

[0065] The present invention provides a network security domain knowledge enhancement system based on GPT4, comprising:

[0066] Knowledge graph preprocessing module: used to preprocess the knowledge graph to obtain entity vectors;

[0067] User question processing module: responsible for receiving user input questions, selecting key elements, and generating embedding vectors;

[0068] Similarity calculation module: calculates the semantic similarity score between the embedding vector and the entity vector to determine the entity with the closest semantics;

[0069] Threshold judgment module: Set a threshold to determine whether a suitable entity is found in the knowledge graph; if the semantic similarity score of the most semantically similar entity is higher than the threshold, and the semantic similarity score of more than one entity is higher than the threshold, the most semantically similar entity is determined to be the corresponding entity of the question;

[0070] Knowledge graph reading module: After determining the entity with the closest semantics, the knowledge graph is read and GPT-4 is used to perform reasoning chain processing to generate the final answer.

[0071] The GPT-4-based network security knowledge enhancement system of the present invention significantly improves the accuracy and relevance of question answers by integrating knowledge graphs with GPT-4 models. The knowledge graph preprocessing and similarity calculation modules ensure accurate understanding and matching of user questions. The threshold judgment module flexibly determines the processing strategy and optimizes the question-answering efficiency. Combined with the reasoning ability of GPT-4, the system can not only provide in-depth answers based on rich knowledge graphs, but also adapt to complex user queries, enhancing the system's intelligence and responsiveness in the network security field.

[0072] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A network security domain knowledge enhancement method based on GPT4, characterized in that: The following steps are involved: Preprocess the knowledge graph to obtain entity vectors; Obtain the key elements of the question entered by the user and obtain an embedding vector; obtain the semantic similarity scores between all entity vectors and the embedding vector, and the entity with the highest semantic similarity score is the entity with the closest semantics; A threshold is set. If the semantic similarity score of the most semantically similar entity is still below the threshold, the process switches to the large model question answering process. If the semantic similarity score of the most semantically similar entity is above the threshold, and the semantic similarity score of more than one entity is above the threshold, the most semantically similar entity is determined to be the corresponding entity of the question, and the knowledge graph reading is started, followed by GPT-4 reasoning chain processing. The method for obtaining semantic similarity scores between all entity vectors and embedding vectors includes the following steps: The semantic similarity score is obtained by calculating the cosine similarity between the embedding vector and the entity vector. The calculation method is as follows: The formula for calculating the cosine similarity between the embedding vector and the entity vector is: ， in: A and B are two non-zero vectors; A∙B represents the dot product of A and B; ‖A‖ and ‖B‖ represent the Euclidean norms of vectors A and B respectively; The cosine value of the angle between the embedding vector and the entity vector is obtained. The cosine value of the angle is used as the semantic similarity score of the entity. Then, the entities are sorted according to the semantic similarity score to match the entities with the closest semantics. The reasoning chain of GPT-4 includes the following steps: Optimal relationship reasoning: All relationships associated with the entity node are queried through the template. All relationships are serialized and input into GPT-4, which then infers the most relevant relationship among all relationships based on the question entered by the user. Related triple reasoning: Based on the most relevant relationship inferred by GPT-4, all triples containing the entity-most relevant relationship pair are queried. After serialization, they are input into GPT-4, which then infers all triples related to the question entered by the user. Iteration decision: Decide whether to continue iterating based on whether all the triple information found is sufficient to support GPT-4 to answer the user's question.

2. A network security domain knowledge enhancement method based on GPT4 according to claim 1, characterized in that: The method for preprocessing the knowledge graph to obtain entity vectors includes the following steps: All entity nodes in the knowledge graph are extracted, and then each entity is mapped into an entity vector in a high-dimensional space through word embedding to complete the entity embedding process. Then, an entity vector library is built to store all entity vectors in the knowledge graph.

3. A network security domain knowledge enhancement method based on GPT4 according to claim 2, characterized in that: The method for obtaining the embedding vector comprises the following steps: The subject of the question given by the user is taken as the key element, and the word embedding method is used to convert the key element into the corresponding embedding vector.

4. A network security domain knowledge enhancement method based on GPT4 according to claim 3, characterized in that: The method for deciding whether to continue iteration based on whether all triple information found is sufficient to support GPT-4 in answering the user's question includes the following steps: If the current information is not sufficient to answer the question, GPT-4 continues to iterate until sufficient information is obtained; if the current information is sufficient, no iteration is performed and domain knowledge enhancement is completed directly.

5. A network security domain knowledge enhancement system based on GPT4, characterized by: include: Knowledge graph preprocessing module: used to preprocess the knowledge graph to obtain entity vectors; User question processing module: responsible for receiving user input questions, selecting key elements, and generating embedding vectors; Similarity calculation module: calculates the semantic similarity score between the embedding vector and the entity vector to determine the entity with the closest semantics; Threshold judgment module: Set a threshold to determine whether a suitable entity is found in the knowledge graph; if the semantic similarity score of the most semantically similar entity is higher than the threshold, and the semantic similarity score of more than one entity is higher than the threshold, the most semantically similar entity is determined to be the corresponding entity of the question; Knowledge graph reading module: After determining the entity with the closest semantics, it reads the knowledge graph and uses GPT-4 to perform reasoning chain processing to generate the final answer; The method for obtaining the semantic similarity scores between all entity vectors and embedding vectors includes the following steps: The semantic similarity score is obtained by calculating the cosine similarity between the embedding vector and the entity vector. The calculation method is as follows: The formula for calculating the cosine similarity between the embedding vector and the entity vector is: ， in: A and B are two non-zero vectors; A∙B represents the dot product of A and B; ‖A‖ and ‖B‖ represent the Euclidean norms of vectors A and B respectively; The cosine value of the angle between the embedding vector and the entity vector is obtained. The cosine value of the angle is used as the semantic similarity score of the entity. Then, the entities are sorted according to the semantic similarity score to match the entities with the closest semantics. The reasoning chain of GPT-4 includes the following steps: Optimal relationship reasoning: All relationships associated with the entity node are queried through the template. All relationships are serialized and input into GPT-4, which then infers the most relevant relationship among all relationships based on the question entered by the user. Related triple reasoning: Based on the most relevant relationship inferred by GPT-4, all triples containing the entity-most relevant relationship pair are queried. After serialization, they are input into GPT-4, which then infers all triples related to the question entered by the user. Iteration decision: Decide whether to continue iterating based on whether all the triple information found is sufficient to support GPT-4 to answer the user's question.

Images