Attack behavior extraction method and device, equipment, storage medium and program product
By applying sentences and words to remove modules in threatening intelligence, the key information related to attack behavior in threatening intelligence is extracted, and the problem of low efficiency of attack behavior in existing technologies has been solved, and more efficient attack behavior extraction is achieved.
Patent Information
- Application Number
- CN202411454729.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-17
- Publication Date
- 2025-01-21
AI Technical Summary
The prior art is less efficient in extracting attack behavior from threat intelligence and takes a long time to accurately extract relevant information.
Remove the module and word redundant removal module by the sentence redundant in the model extraction of the attack behavior, first remove the sentences that are not related to the attack behavior in the threat intelligence, then remove the redundant words from the remaining sentences, and extract key words to determine the attack behavior.
This method greatly reduces the complexity and text length of threat intelligence, improves the efficiency of attack behavior extraction, and retains the most important sentence components that describe attack behavior.
Smart Images
Figure CN119337875A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment, storage medium and program product for extracting attack behaviors. Background Art
[0002] Recently, cyber attacks have occurred frequently, and network security has become a primary concern. CTI (Cyber Threat Intelligence) is evidence-based knowledge about existing or emerging threats, usually reported in technical reports, white papers, blogs, and news groups, and is a valuable source of information for cyber attacks. These reports describe many aspects of the attack in natural language, including the sequence of behaviors, the impact on the attacked system, and intrusion indicators (IOC). The knowledge contained in the threat reports is essential for network operations and response personnel, system administrators, and intrusion detection and prevention product vendors.
[0003] At present, a piece of threat intelligence often contains a lot of content. It takes a long time to accurately extract the attack behavior from a large amount of threat intelligence, and the efficiency is low. Summary of the invention
[0004] The purpose of the embodiments of the present application is to provide a method, device, equipment, storage medium and program product for extracting attack behaviors, so as to improve the efficiency of extracting attack behaviors from threat intelligence.
[0005] In a first aspect, an embodiment of the present application provides a method for extracting attack behaviors, including:
[0006] Get threat intelligence text;
[0007] Through the sentence redundancy removal module in the attack behavior extraction model, sentences irrelevant to the attack behavior in the threat intelligence text are removed to obtain the target sentence;
[0008] Extract key words from the target sentence through the word redundancy removal module in the attack behavior extraction model;
[0009] Identify attack behaviors in threat intelligence text based on key words.
[0010] The embodiment of the present application first removes redundant sentences in the threat intelligence to obtain sentences related to the threat, and then removes redundant words in the sentences related to the threat to obtain a concise description of the attack behavior, thereby greatly reducing the complexity and text length of the threat intelligence. At the same time, the most important sentence components describing the attack behavior are retained, thereby improving the efficiency of attack behavior extraction.
[0011] In any embodiment, sentences irrelevant to the attack behavior in the threat intelligence text are removed by a sentence redundancy removal module in the attack behavior extraction model, including:
[0012] Input the threat intelligence text into the pre-trained BERT model, analyze the sentences contained in the threat intelligence text through the BERT model, and obtain the correlation between each sentence and the attack behavior;
[0013] Sentences whose relevance is lower than a preset threshold are regarded as sentences irrelevant to the attack behavior and are deleted.
[0014] In the embodiment of the present application, since the BERT model can understand threat intelligence well and effectively process words outside the vocabulary, the BERT model can accurately distinguish which sentences in the threat intelligence are related to the attack behavior and which sentences are not related to the threat intelligence.
[0015] In any embodiment, the word redundancy removal module includes a BiLSTM layer and an optimal label sequence calculation layer; extracting key words from the target sentence through the word redundancy removal module in the attack behavior extraction model includes:
[0016] The forward and backward context information of each word in the target sentence is captured through the BiLSTM layer;
[0017] Obtaining a complete hidden state representation of the corresponding word according to the forward context information and the backward context information, and outputting a hidden state representation sequence corresponding to the target sentence; the hidden state representation sequence includes the complete hidden state representation of each word corresponding to the target sentence;
[0018] According to the hidden state, the conditional probability of the label corresponding to each word in the target sentence is obtained through softmax;
[0019] The optimal label sequence calculation layer combines the conditional probability of known labels and heuristic estimation to obtain the label sequence with the highest score; the label sequence includes the labels corresponding to each word in the target sentence;
[0020] Based on the tag sequence, keywords are extracted from the target sentence.
[0021] In the embodiment of the present application, the BiLSTM network is capable of processing long-distance dependencies appearing in threat intelligence. Therefore, through the BiLSTM network, the semantic roles of sentence components can be first inferred, and then keywords can be selected based on the role labels of each word, thereby improving the accuracy of keyword extraction and further improving the accuracy of attack behavior extraction.
[0022] In any embodiment, extracting keywords from the target sentence according to the tag sequence includes:
[0023] In the label sequence, the words corresponding to the agent, the patient, and the behavior are used as keywords.
[0024] In the embodiment of the present application, the agent, patient and behavior in the semantic role label can be used to characterize who did what to whom, that is, attack behavior. Therefore, the words corresponding to the labels of agent, patient and behavior are used as keywords, so that the attack behavior can be quickly determined based on the keywords.
[0025] In any embodiment, the method further comprises:
[0026] Using regular expressions and a database containing application names and / or known processes to detect words in a target sentence to determine whether the target sentence contains a system entity name;
[0027] If included, the words containing the system entity name are used as keywords.
[0028] In an embodiment of the present application, there may also be sentence components containing important objects in the threat intelligence. In order to retain these sentence components, regular expressions and databases can be used to detect words in the target sentences, thereby improving the accuracy of the attack behavior.
[0029] In any embodiment, the label sequence with the highest score is obtained by combining the conditional probability of known labels and heuristic estimation through the optimal label sequence calculation layer, including:
[0030] ∧
[0031] According to the formula y = argmax[f(x,y 1:t )+g(x,y 1:t )] to obtain the label sequence with the highest score;
[0032] Among them, x is the given input, y 1:t is the label sequence of the first t words, f(x,y 1:t ) is the score from the empty sequence to the tth word, which is the sum of the logarithms of the conditional probabilities of the determined labels based on the given input x; g(x,y 1:t ) is a heuristic function used to estimate the minimum cost from generating a partial label sequence to generating a complete label sequence.
[0033] The embodiment of the present application can accurately determine the label corresponding to each word in the target sentence through the above formula, which is convenient for subsequent extraction of attack behavior.
[0034] In any embodiment, before removing sentences irrelevant to the attack behavior in the threat intelligence text by the sentence redundancy removal module in the attack behavior extraction model, the method further includes:
[0035] The threat intelligence text is divided into sentences through the preprocessing module in the attack behavior extraction model to obtain multiple sentences;
[0036] Eliminate sentences with fewer words than a preset number from multiple sentences.
[0037] In the embodiment of the present application, since there are shorter sentences among the multiple sentences obtained after the threat intelligence is divided into sentences, these sentences are often irrelevant to the attack behavior. Therefore, these shorter sentences can be deleted, thereby increasing the computational complexity of the subsequent algorithm.
[0038] In a second aspect, an embodiment of the present application provides an attack behavior extraction device, including:
[0039] Text acquisition module, used to obtain threat intelligence text;
[0040] A redundant sentence removal module is used to remove sentences irrelevant to the attack behavior in the threat intelligence text through the redundant sentence removal module in the attack behavior extraction model to obtain the target sentence;
[0041] A redundant word removal module is used to extract key words from the target sentence through the redundant word removal module in the attack behavior extraction model;
[0042] The attack behavior determination module is used to determine the attack behavior in the threat intelligence text based on key words.
[0043] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor, a memory, and a bus, wherein:
[0044] The processor and the memory communicate with each other via the bus;
[0045] The memory stores program instructions that can be executed by the processor, and the processor can execute the method of the first aspect by calling the program instructions.
[0046] In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, including:
[0047] The non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute the method of the first aspect.
[0048] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer program instructions, wherein when the computer program instructions are read and executed by a processor, the method of the first aspect is executed.
[0049] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0051] Figure 1 A schematic diagram of a method for extracting attack behaviors provided in an embodiment of the present application;
[0052] Figure 2 A schematic diagram of the structure of an attack behavior extraction device provided in an embodiment of the present application;
[0053] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0054] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.
[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.
[0056] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.
[0057] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.
[0058] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.
[0059] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).
[0060] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.
[0061] With the rapid development of network information technology, the frequency and intensity of network attack incidents have continued to increase, and the requirements for network security monitoring and prevention capabilities have continued to increase. Among them, attack event tracing is an important part of monitoring and prevention work. However, with the continuous improvement of the level of network attack technology, network attacks have gradually developed from single attacks to organized and planned multi-step attacks, such as advanced persistent attacks (APT). In recent years, using big data analysis, machine learning and other technologies to discover various malicious behaviors and their correlations in the network attack chain and gradually realize the review and tracing of the attack chain has always been a difficult problem in the field of network security. At present, the description information of attack events mainly flows in the form of text-based threat intelligence in the network security industry. The work of converting unstructured data such as text-based threat intelligence into attack chain information is usually done manually, with a low degree of automation. Therefore, it is necessary to realize the automatic extraction of network security event attack chains from unstructured text information such as text-based threat intelligence based on natural language processing technology to improve the efficiency of network security event analysis.
[0062] The traditional method of extracting attack behaviors is to extract text from threat intelligence. Since there is a lot of content in threat intelligence, if it is analyzed sentence by sentence, the computational workload will be very large and the efficiency will be low.
[0063] In order to solve this technical problem, the embodiments of the present application provide a method, device, equipment, storage medium and program product for extracting attack behaviors. In the method, before extracting attack behaviors, sentences irrelevant to attack behaviors in threat intelligence are first deleted, and then words irrelevant to attack behaviors in the remaining sentences are removed, and finally key words used to characterize attack behaviors are obtained. The efficiency of attack behavior extraction is greatly improved.
[0064] It can be understood that the attack behavior extraction method provided in the embodiment of the present application can be applied to electronic devices, which include terminals and servers; wherein the terminal can specifically be a smart phone, a tablet computer, a computer, a personal digital assistant (PDA), etc.; the server can specifically be an application server or a Web server.
[0065] Figure 1 A schematic diagram of a method for extracting attack behaviors provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:
[0066] Step 101: Obtain threat intelligence text; wherein the threat intelligence text may be obtained from a website by means of web crawling, specifically from social media, from a cybersecurity industry portal, and from a dedicated threat intelligence sharing platform.
[0067] Step 102: Using the sentence redundancy removal module in the attack behavior extraction model, sentences irrelevant to the attack behavior in the threat intelligence text are removed to obtain target sentences.
[0068] Among them, the attack behavior extraction model is pre-trained, which mainly includes a sentence redundancy removal module and a word redundancy removal module. The threat intelligence text includes multiple sentences, but not every sentence is related to the attack behavior. In order to improve the subsequent processing efficiency, the sentence redundancy removal module can be used to remove sentences that are not related to the attack behavior.
[0069] Step 103: extract key words from the target sentence through the word redundancy removal module in the attack behavior extraction model.
[0070] The target sentence output by the sentence redundancy removal model is input into the word redundancy removal module, and the word redundancy removal module is used to remove words that are not related to the attack behavior in the target sentence, so that only the words related to the attack behavior are retained.
[0071] Step 104: Determine attack behaviors in the threat intelligence text based on the key words.
[0072] After obtaining the key words, since the key words are all related to the attack behavior, the attack behavior in the threat intelligence text can be determined through the key words.
[0073] The embodiment of the present application first removes redundant sentences in the threat intelligence to obtain sentences related to the threat, and then removes redundant words in the sentences related to the threat to obtain a concise description of the attack behavior, thereby greatly reducing the complexity and text length of the threat intelligence. At the same time, the most important sentence components describing the attack behavior are retained, thereby improving the efficiency of attack behavior extraction.
[0074] On the basis of the above embodiment, sentences irrelevant to the attack behavior in the threat intelligence text are removed through the sentence redundancy removal module in the attack behavior extraction model, including:
[0075] Input the threat intelligence text into the pre-trained BERT model, analyze the sentences contained in the threat intelligence text through the BERT model, and obtain the correlation between each sentence and the attack behavior;
[0076] Sentences whose relevance is lower than a preset threshold are regarded as sentences irrelevant to the attack behavior and are deleted.
[0077] In the specific implementation process, in order to distinguish between sentences that describe real attack behaviors and sentences that do not represent attack behaviors, it is necessary to go beyond topic classification and have a deeper understanding of the text. Intuitively, attack-related sentences can express the "direct" connection between the subject and the object better than other sentences. Therefore, in order to classify these connections, the language model of the text needs to establish a fine-grained representation of the word context. The BERT model is able to build such a fine-grained representation well. The BERT model builds a contextual representation of words, taking into account the text before and after the word. The BERT model can handle out-of-vocabulary words more effectively. In general, this ability is beneficial for technical cybersecurity texts, which may contain vocabulary that does not appear in the BERT model training set. Therefore, the BERT model can better classify sentences into threat-related and threat-irrelevant than other methods.
[0078] To train the model, 8,000 sentences can be manually labeled and BERT with 12 hidden layers can be used to distinguish threat-related and threat-irrelevant sentences. It should be noted that the number of hidden layers of the BERT model can be set according to actual conditions. After the model training is completed, when a threat intelligence text is input, the sentence redundancy removal module can calculate the correlation between each sentence in the threat intelligence text and the attack behavior. Based on the correlation, it can identify which sentences are related to the attack behavior and which sentences are not related to the attack behavior, and remove the sentences in the report that are not related to the attack behavior.
[0079] The correlation can be compared with a preset threshold. If it is higher than the preset threshold, it means that the corresponding sentence is more likely to be related to the attack behavior; otherwise, it means that the corresponding sentence is less likely to be related to the attack behavior. Sentences with correlations lower than the preset threshold are deleted.
[0080] In the embodiment of the present application, since the BERT model can understand threat intelligence well and effectively process words outside the vocabulary, the BERT model can accurately distinguish which sentences in the threat intelligence are related to the attack behavior and which sentences are not related to the threat intelligence.
[0081] On the basis of the above embodiment, the word redundancy removal module includes a BiLSTM layer and an optimal label sequence calculation layer; through the word redundancy removal module in the attack behavior extraction model, key words are extracted from the target sentence, including:
[0082] The forward and backward context information of each word in the target sentence is captured through the BiLSTM layer;
[0083] Obtaining a complete hidden state representation of the corresponding word according to the forward context information and the backward context information, and outputting a hidden state representation sequence corresponding to the target sentence; the hidden state representation sequence includes the complete hidden state representation of each word corresponding to the target sentence;
[0084] According to the hidden state, the conditional probability of the label corresponding to each word in the target sentence is obtained through softmax;
[0085] The optimal label sequence calculation layer combines the conditional probability of known labels and heuristic estimation to obtain the label sequence with the highest score; the label sequence includes the labels corresponding to each word in the target sentence;
[0086] Based on the tag sequence, keywords are extracted from the target sentence.
[0087] After using the sentence redundancy removal module to delete redundant sentences, the target sentence can be obtained, and the word redundancy removal module can be used to delete unnecessary words in the target sentence. The deletion process can be divided into two stages: one is to derive the semantic roles of sentence components through the BiLSTM network, and the other is to remove unnecessary words based on the semantic roles of sentence components.
[0088] BiLSTM network, or Bidirectional Long Short-Term Memory network, is a special type of recurrent neural network (RNN) that is widely used in natural language processing (NLP), time series analysis and other fields. BiLSTM network consists of two independent LSTM layers, one for processing the forward sequence and the other for processing the reverse sequence. Its output is the combination of the outputs of these two LSTM layers. Specifically:
[0089] For the input sequence X = (x1, x2, ..., xT), the forward LSTM layer generates a forward hidden state sequence (h1→, h2→, ..., hT→), and the reverse LSTM layer generates a reverse hidden state sequence (h1←, h2←, ..., hT←). The final output of BiLSTM is the concatenation of these two hidden state sequences (ht→, ht←), where t represents the time step.
[0090] The BiLSTM network includes a BiLSTM layer and an optimal label sequence calculation layer. The BiLSTM layer is used to capture the forward and backward context information of each word in the target sentence, and then obtains the complete hidden state representation of the corresponding word based on the forward and backward context information, and obtains the conditional probability of the label corresponding to each word in the target sentence through softmax. The optimal label sequence calculation layer combines the conditional probability of known labels and heuristic estimates to obtain the label sequence with the highest score; the label sequence includes the labels corresponding to each word in the target sentence.
[0091] The task of the first stage is: given a sentence x = {x1, x2, ..., x n}, x i is the word embedding of the i-th word in the input sentence, n is the number of words, and the word redundancy removal model is used to predict the component semantic role sequence y of the sentence, where y i ∈y belongs to the set of SRL (Semantic Role Labeling), including Agent, Patient, Action, Time, Location, ARGM-DIS, etc. That is, find the label sequence with the highest score in all possible semantic role spaces:
[0092]
[0093] Among them, x is the given input, y 1:t is the label sequence of the first t words, f(x,y 1:t ) is the score of the partial label sequence starting from the empty sequence to the tth time step. The score is the sum of the logarithms of the conditional probabilities of the determined labels under the given input x; g(x,y 1:t ) is a heuristic function used to estimate the minimum cost from the current state (partial label sequence has been generated) to the target state (complete label sequence), which is calculated by accumulating the logarithm of the probability of the possible optimal label for all future time steps (starting from t+1 and ending at n, where n is the total length of the sequence). Label distribution p(y i |x) is calculated by BiLSTM-softmax, and the formula is as follows:
[0094] p(y t |x)=exp(Wh t + b);
[0095] For a given time step t, W is the weight parameter matrix, b is the bias term, and h t is the set of forward and backward hidden states.
[0096] By combining the conditional probabilities of known labels with heuristic estimates and modeling the dependencies between output tags, the above method can effectively find the optimal or near-optimal label sequence during the search process.
[0097] After obtaining the tag sequence, the words related to the attack behavior are extracted as keywords, and irrelevant ones are removed.
[0098] In the embodiment of the present application, the BiLSTM network is capable of processing long-distance dependencies appearing in threat intelligence. Therefore, through the BiLSTM network, the semantic roles of sentence components can be first inferred, and then keywords can be selected based on the role labels of each word, thereby improving the accuracy of keyword extraction and further improving the accuracy of attack behavior extraction.
[0099] Based on the above embodiment, keywords are extracted from the target sentence according to the tag sequence, including:
[0100] In the label sequence, the words corresponding to the agent, the patient, and the behavior are used as keywords.
[0101] In the specific implementation process, the agent in the label is used to represent the attack object, the patient is used to represent the attacked object, and the behavior is used to represent the attack behavior. Therefore, the agent, patient and behavior can be used to represent the relevant information of the attack behavior. Therefore, the words corresponding to these labels in the target sentence are extracted as keywords.
[0102] It should be noted that in addition to extracting words corresponding to the agent, the patient, and the behavior, other words can also be extracted according to actual conditions.
[0103] In the embodiment of the present application, the agent, patient and behavior in the semantic role label can be used to characterize who did what to whom, that is, attack behavior. Therefore, the words corresponding to the labels of agent, patient and behavior are used as keywords, so that the attack behavior can be quickly determined based on the keywords.
[0104] Based on the above embodiment, the method further includes:
[0105] Using regular expressions and a database containing application names and / or known processes to detect words in a target sentence to determine whether the target sentence contains a system entity name;
[0106] If included, the words containing the system entity name are used as keywords.
[0107] In the specific implementation, after a sentence is processed by the BiLSTM network, its components are labeled as Agent, Patient, and Action, as well as other types of parameters. In the next stage, unnecessary sentence components are removed. In theory, this is achieved by retaining the Agent, Action, and Patient components of the sentence. However, in some cases, this approach removes important information. In order to make the word removal stage more accurate and not remove sentence components that may contain important objects, regular expressions and databases containing application names or known processes are used to detect possible system entity names, such as file names, process names, IP addresses, and registry keys. The sentence components marked for removal in the first stage are processed and will be removed if they do not contain any entities matching the regular expression or application name.
[0108] Regular expressions are often used to identify system entities, as shown below:
[0109] Filename matching:
[0110] Expression: \b[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+(?:\.[A-Za-z]{2,})\b.
[0111] Note: This regular expression is used to match common file names, including extensions, such as example.txt, document.docx, report.pdf, etc.
[0112] Process name matching:
[0113] Expression: ^[a-zA-Z0-9_]+(\.[a-zA-Z0-9_]+)*$.
[0114] Note: This regular expression is usually used to match Windows process names that do not contain spaces, special characters, or wildcards, such as notepad.exe, chrome.exe, svchost.exe, etc.
[0115] In an embodiment of the present application, there may also be sentence components containing important objects in the threat intelligence. In order to retain these sentence components, regular expressions and databases can be used to detect words in the target sentences, thereby improving the accuracy of the attack behavior.
[0116] Based on the above embodiment, before removing sentences irrelevant to the attack behavior in the threat intelligence text through the sentence redundancy removal module in the attack behavior extraction model, the method further includes:
[0117] The threat intelligence text is divided into sentences through the preprocessing module in the attack behavior extraction model to obtain multiple sentences;
[0118] Eliminate sentences with fewer words than a preset number from multiple sentences.
[0119] In the specific implementation process, threat intelligence includes multiple sentences, but not all of them can be called sentences. Therefore, Stanza can be used to parse the sentences in threat intelligence and retain sentences with more than a preset number of words, for example, retain sentences with more than three words. Stanza is a natural language processing toolkit based on neural networks. In addition, since the text encoder has requirements for input length, for sentences in threat intelligence that are longer than the preset length, they are split into multiple short sentences.
[0120] After obtaining multiple sentences, insert a start tag at the beginning of each sentence, for example: [CLS], and insert an end tag at the end of each sentence, for example: [SEP]. Then obtain the text sequence according to the position of the sentence. For example:
[0121] in, is a text sequence, x1,x2,...,x m For each sentence after splitting.
[0122] In the embodiment of the present application, since there are shorter sentences among the multiple sentences obtained after the threat intelligence is divided into sentences, these sentences are often irrelevant to the attack behavior. Therefore, these shorter sentences can be deleted, thereby increasing the computational complexity of the subsequent algorithm.
[0123] Figure 2 This is a schematic diagram of the structure of an attack behavior extraction device provided in an embodiment of the present application. The device may be a module, program segment or code on an electronic device. It should be understood that the device is similar to the above-mentioned Figure 1 The method embodiment corresponds to and can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device can be found in the above description. To avoid repetition, detailed description is appropriately omitted here. The device includes: a text acquisition module 201, a redundant sentence removal module 202, a redundant word removal module 203 and an attack behavior determination module 204, wherein:
[0124] The text acquisition module 201 is used to acquire threat intelligence text;
[0125] The redundant sentence removal module 202 is used to remove sentences that are not related to the attack behavior in the threat intelligence text through the sentence redundant removal module in the attack behavior extraction model to obtain the target sentence;
[0126] The redundant word removal module 203 is used to extract key words from the target sentence through the redundant word removal module in the attack behavior extraction model;
[0127] The attack behavior determination module 204 is used to determine the attack behavior in the threat intelligence text based on the key words.
[0128] Based on the above embodiment, the redundant sentence removal module 202 is specifically used for:
[0129] Input the threat intelligence text into the pre-trained BERT model, analyze the sentences contained in the threat intelligence text through the BERT model, and obtain the correlation between each sentence and the attack behavior;
[0130] Sentences whose relevance is lower than a preset threshold are regarded as sentences irrelevant to the attack behavior and are deleted.
[0131] On the basis of the above embodiment, the word redundancy removal module includes a BiLSTM layer and an optimal label sequence calculation layer; the redundant word removal module 203 is specifically used for:
[0132] The forward and backward context information of each word in the target sentence is captured through the BiLSTM layer;
[0133] Obtaining a complete hidden state representation of the corresponding word according to the forward context information and the backward context information, and outputting a hidden state representation sequence corresponding to the target sentence; the hidden state representation sequence includes the complete hidden state representation of each word corresponding to the target sentence;
[0134] According to the hidden state, the conditional probability of the label corresponding to each word in the target sentence is obtained through softmax;
[0135] The optimal label sequence calculation layer combines the conditional probability of known labels and heuristic estimation to obtain the label sequence with the highest score; the label sequence includes the labels corresponding to each word in the target sentence;
[0136] Based on the tag sequence, keywords are extracted from the target sentence.
[0137] Based on the above embodiment, the redundant word removal module 203 is specifically used for:
[0138] In the label sequence, the words corresponding to the agent, the patient, and the behavior are used as keywords.
[0139] On the basis of the above embodiment, the device further includes a system keyword extraction module, which is used to:
[0140] Using regular expressions and a database containing application names and / or known processes to detect words in a target sentence to determine whether the target sentence contains a system entity name;
[0141] If included, the words containing the system entity name are used as keywords.
[0142] Based on the above embodiment, the redundant word removal module 203 is specifically used for:
[0143] ∧
[0144] According to the formula y = argmax[f(x,y 1:t )+g(x,y 1:t )] to obtain the label sequence with the highest score;
[0145] Among them, x is the given input, y 1:t is the label sequence of the first t words, f(x,y 1:t ) is the score from the empty sequence to the tth word, which is the sum of the logarithms of the conditional probabilities of the determined labels based on the given input x; g(x,y 1:t ) is a heuristic function used to estimate the minimum cost from generating a partial label sequence to generating a complete label sequence.
[0146] Based on the above embodiment, the device further includes a preprocessing module, which is used to:
[0147] The threat intelligence text is divided into sentences through the preprocessing module in the attack behavior extraction model to obtain multiple sentences;
[0148] Eliminate sentences with fewer words than a preset number from multiple sentences.
[0149] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application, such as Figure 3 As shown, the electronic device includes: a processor (processor) 301, a memory (memory) 302 and a bus 303; wherein,
[0150] The processor 301 and the memory 302 communicate with each other via the bus 303;
[0151] The processor 301 is used to call the program instructions in the memory 302 to execute the methods provided by the above-mentioned method embodiments, for example, including: obtaining threat intelligence text; removing sentences that are not related to attack behaviors in the threat intelligence text through a sentence redundancy removal module in an attack behavior extraction model to obtain a target sentence; extracting key words from the target sentence through a word redundancy removal module in the attack behavior extraction model; and determining attack behaviors in the threat intelligence text based on the key words.
[0152] The processor 301 can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 301 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. It can implement or execute various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.
[0153] The memory 302 may include but is not limited to random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.
[0154] The present embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: obtaining threat intelligence text; removing sentences that are not related to attack behaviors in the threat intelligence text through a sentence redundancy removal module in an attack behavior extraction model to obtain a target sentence; extracting key words from the target sentence through a word redundancy removal module in the attack behavior extraction model; and determining the attack behavior in the threat intelligence text based on the key words.
[0155] The present embodiment provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable the computer to execute the methods provided by the above-mentioned method embodiments, for example, including: obtaining threat intelligence text; removing sentences that are not related to attack behaviors in the threat intelligence text through a sentence redundancy removal module in an attack behavior extraction model to obtain a target sentence; extracting key words from the target sentence through a word redundancy removal module in the attack behavior extraction model; and determining attack behaviors in the threat intelligence text based on the key words.
[0156] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.
[0157] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0158] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
[0159] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.
[0160] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method for extracting attack behavior, characterized in that: include: Get threat intelligence text; Using a sentence redundancy removal module in an attack behavior extraction model, sentences irrelevant to the attack behavior in the threat intelligence text are removed to obtain a target sentence; Extracting key words from the target sentence through a word redundancy removal module in the attack behavior extraction model; Attack behaviors in the threat intelligence text are determined based on the key words.
2. The method according to claim 1, characterized in that The sentence redundancy removal module in the attack behavior extraction model is used to remove sentences irrelevant to the attack behavior in the threat intelligence text, including: Input the threat intelligence text into a pre-trained BERT model, and analyze the sentences contained in the threat intelligence text through the BERT model to obtain the correlation between each sentence and the attack behavior; The sentences whose correlation is lower than a preset threshold are regarded as sentences irrelevant to the attacking behavior and are deleted.
3. The method according to claim 1, characterized in that The word redundancy removal module includes a BiLSTM layer and an optimal label sequence calculation layer. The word redundancy removal module in the attack behavior extraction model extracts key words from the target sentence, including: Capturing forward context information and backward context information of each word in the target sentence through the BiLSTM layer; Obtaining a complete hidden state representation of the corresponding word according to the forward context information and the backward context information, and outputting a hidden state representation sequence corresponding to the target sentence; the hidden state representation sequence includes a complete hidden state representation of each word corresponding to the target sentence; According to the hidden state, the conditional probability of the label corresponding to each word in the target sentence is obtained through softmax; The optimal label sequence calculation layer combines the conditional probability of known labels and heuristic estimation to obtain the label sequence with the highest score; the label sequence includes the label corresponding to each word in the target sentence; Keywords are extracted from the target sentence according to the tag sequence.
4. The method according to claim 3, characterized in that The step of extracting keywords from the target sentence according to the tag sequence includes: The words in the label sequence whose labels are the agent, the patient and the behavior respectively are used as the keywords.
5. The method according to claim 3, characterized in that: The method further comprises: Using regular expressions and a database containing application names and / or known processes to detect words in the target sentence to determine whether the target sentence contains a system entity name; If included, the words containing the system entity name will be used as keywords.
6. The method according to claim 3, characterized in that The step of obtaining the label sequence with the highest score by combining the conditional probability of known labels and heuristic estimation through the optimal label sequence calculation layer includes: ∧ According to the formula y = argmax[f(x,y 1:t )+g(x,y 1:t )] to obtain the label sequence with the highest score; Among them, x is the given input, y 1:t is the label sequence of the first t words, f(x,y 1:t ) is the score from the empty sequence to the tth word, which is the sum of the logarithms of the conditional probabilities of the determined labels based on the given input x; g(x,y 1:t ) is a heuristic function used to estimate the minimum cost from generating a partial label sequence to generating a complete label sequence.
7. The method according to any one of claims 1 to 6, characterized in that: Before removing sentences irrelevant to the attack behavior in the threat intelligence text by the sentence redundancy removal module in the attack behavior extraction model, the method further includes: The threat intelligence text is divided into sentences by a preprocessing module in the attack behavior extraction model to obtain a plurality of sentences; Among the multiple sentences, sentences having a word number less than a preset number are eliminated.
8. An electronic device, characterized in that: include: processor, memory and bus, wherein, The processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method according to any one of claims 1 to 7.
9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 7.
10. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 7 is executed.