Network security entity tag identification method, device, equipment and medium

Abstract

The invention discloses a network security entity tag identification method, apparatus and device, and a medium. The method comprises the steps of obtaining text data used for indicating network security information; inputting the text data into a preset entity tag identification model, so that the entity tag identification model performs entity tag prediction according to the text data, and an entity tag corresponding to each vocabulary in the text data is generated; the entity label identification model is obtained by taking a plurality of text data used for indicating network security information and a labeled entity label corresponding to each vocabulary in the text data as input and taking the predicted entity label as output for training. Therefore, by implementing the method and the device, the entity tag in the text data can be identified more accurately, and the accuracy of identifying the network security entity tag is improved.

Description

Technical Field

[0001] The present invention relates to the field of text recognition, and in particular to a network security entity label recognition method, device, equipment and medium. Background Art

[0002] Currently, a large number of text resources on cybersecurity are publicly available on the Internet, covering security concepts, events, tools, guidelines, strategies, risk management methods, best practices, technologies, security bulletins, and online reports. However, these texts are usually stored in an unstructured manner, which poses a challenge to information retrieval. The characteristics of this unstructured data limit security analysts from making full use of the extracted information. Therefore, researchers at home and abroad have begun to try to process unstructured, large-scale cybersecurity information to assist security analysts in identifying entities in the field of cybersecurity and thus dealing with cybersecurity issues.

[0003] In order to ensure the security of network systems, security analysts usually use Natural Language Processing (NLP) technology to extract useful information from network security reports. In NLP, named entity recognition plays an important role because it can identify and classify named entities in unstructured text, such as organizations, places, people, dates and time expressions, etc.

[0004] In the prior art, entity label recognition methods based on rules and dictionaries are usually adopted. The above methods require experts to formulate detailed rule sets based on domain knowledge. However, these rules are often difficult to cover all possible situations, and as domain knowledge is updated and developed, they need to be constantly adjusted and optimized. Once the rules are set improperly or some important situations are omitted, recognition errors may occur. They are overly dependent on rules and vocabulary libraries and have poor portability. Summary of the invention

[0005] The present invention provides a network security entity label recognition method, device, equipment and medium. The method inputs the text data into a preset entity label recognition model so that the entity label recognition model predicts the entity label according to the text data and outputs the prediction result, so as to achieve the purpose of accurately generating the entity label corresponding to each word in the text data.

[0006] An embodiment of the present invention provides a network security entity tag identification method, comprising:

[0007] Acquire text data for indicating network security information; wherein the text data includes a plurality of words;

[0008] Inputting the text data into a preset entity tag recognition model so that the entity tag recognition model predicts entity tags based on the text data and generates entity tags corresponding to each word in the text data;

[0009] The entity label recognition model is obtained after training, with a number of text data indicating network security information and annotated entity labels corresponding to each word in the text data as input, and a predicted entity label as output. During the training process, the annotated entity label corresponding to each word is compared with the predicted entity label, and the network parameters of the entity label recognition model are adjusted according to the comparison results.

[0010] Furthermore, the training process of the entity tag recognition model includes:

[0011] Acquire a network security text data set; wherein the network security text data set includes a number of text data for indicating network security information and a marked entity label corresponding to each word in the text data;

[0012] Construct a RoBERTa-BiGRU-CRF model, take the cybersecurity text dataset as input, take the predicted entity label as output, and iteratively train the RoBERTa-BiGRU-CRF model;

[0013] The trained RoBERTa-BiGRU-CRF model is used as the entity label recognition model;

[0014] Among them, in each iterative training, the entity label predicted by the current RoBERTa-BiGRU-CRF model is compared with the corresponding labeled entity label, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the RoBERTa-BiGRU-CRF model after training, if not, the network parameters of the RoBERTa-BiGRU-CRF model are adjusted to obtain the RoBERTa-BiGRU-CRF model for the next iterative training.

[0015] Furthermore, the RoBERTa-BiGRU-CRF model includes: an input layer, an intermediate layer, and an output layer;

[0016] The input layer is used to receive a network security text data set and transmit the network security text data set to the middle layer;

[0017] The intermediate layer is used to convert the text data in the network security text data set into an initial word vector sequence, perform feature extraction on the initial word vector sequence to obtain a feature word vector sequence containing contextual semantic information, perform sequence labeling on the feature word vector sequence, and determine the predicted entity label;

[0018] The output layer is used to output the predicted entity label.

[0019] Furthermore, the intermediate layer includes: a RoBERTa layer, a BiGRU layer and a CRF layer;

[0020] The RoBERTa layer is used to convert the text data in the network security text data set into an initial word vector sequence, and transmit the initial word vector sequence to the BiGRU layer;

[0021] The BiGRU layer is used to capture the forward text information and backward text information of each word vector in the initial word vector sequence; determine a feature word vector sequence containing contextual semantic information according to the forward text information and backward text information of each word vector; and transmit the feature word vector sequence to the CRF layer;

[0022] The CRF layer is used to perform sequence labeling on the feature word vector sequence, and use the label sequence with the highest correlation with the feature word vector sequence as the target label sequence; according to the target label sequence, determine the entity label corresponding to each word vector in the feature word vector sequence, and use the entity label corresponding to each word vector as the final predicted entity label.

[0023] Furthermore, capturing the forward text information and the backward text information of each word vector in the initial word vector sequence includes:

[0024] Perform linear transformation on each word vector in the initial word vector sequence to obtain the query vector, key vector and value vector corresponding to each word vector;

[0025] Input the query vector, the key vector, and the value vector into a preset attention mechanism, so that the attention mechanism generates attention weights corresponding to each word vector according to the input vector, and performs weighted summation on the value vectors corresponding to each word vector according to the attention weights corresponding to each word vector to obtain a weighted feature representation;

[0026] According to the weighted feature representation, the forward text information of each word vector and the backward text information of each word vector are determined.

[0027] Furthermore, each entity tag consists of a location tag and an entity category.

[0028] An embodiment of the present invention further provides a network security entity label recognition device, comprising: a text data acquisition module and an entity label generation module;

[0029] The text data acquisition module is used to acquire text data indicating network security information; wherein the text data includes a number of words;

[0030] The entity label generation module is used to input the text data into a preset entity label recognition model so that the entity label recognition model predicts the entity label according to the text data and generates an entity label corresponding to each word in the text data; wherein the entity label recognition model takes a number of text data for indicating network security information and annotated entity labels corresponding to each word in the text data as input, and takes the predicted entity label as output, and is obtained after training, and during the training process, the annotated entity label corresponding to each word is compared with the predicted entity label, and the network parameters of the entity label recognition model are adjusted according to the comparison result.

[0031] Furthermore, the training process of the entity tag recognition model includes:

[0032] Acquire a network security text data set; wherein the network security text data set includes a number of text data for indicating network security information and a marked entity label corresponding to each word in the text data;

[0033] Construct a RoBERTa-BiGRU-CRF model, take the cybersecurity text dataset as input, take the predicted entity label as output, and iteratively train the RoBERTa-BiGRU-CRF model;

[0034] The trained RoBERTa-BiGRU-CRF model is used as the entity label recognition model;

[0035] Among them, in each iterative training, the entity label predicted by the current RoBERTa-BiGRU-CRF model is compared with the corresponding labeled entity label, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the RoBERTa-BiGRU-CRF model after training, if not, the network parameters of the RoBERTa-BiGRU-CRF model are adjusted to obtain the RoBERTa-BiGRU-CRF model for the next iterative training.

[0036] The present application also provides a terminal device, including:

[0037] one or more processors;

[0038] A memory, coupled to the processor, for storing one or more programs;

[0039] When the one or more programs are executed by the one or more processors, the one or more processors implement the network security entity label identification method as described in the above-mentioned embodiment of the invention.

[0040] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the network security entity label identification method as described in the above-mentioned embodiment of the invention is implemented.

[0041] The following beneficial effects are achieved by implementing the present invention:

[0042] The present invention provides a network security entity label recognition method, device, equipment and medium. The method obtains text data for indicating network security information; inputs the text data into a preset entity label recognition model, so that the entity label recognition model predicts entity labels according to the text data, and generates entity labels corresponding to each word in the text data; thereby, through training with a large amount of annotated network security information text data, the entity label recognition model can learn the inherent laws in the data without relying on fixed rules and vocabulary libraries, so that the entity label recognition model can make relatively accurate predictions when facing new text data input by users, thereby improving the generalization ability of the system; and because the entity label recognition model can adjust the network parameters of the entity label recognition model according to the comparison results, it can more accurately identify the entity labels in the text data, further improving the recognition accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the implementation manner will be briefly introduced below. Obviously, the drawings described below are only some implementation manners of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 It is a flowchart of a network security entity tag identification method provided by a certain embodiment of the present application;

[0045] Figure 2 It is a structural diagram of the RoBERTa layer provided in a certain embodiment of the present application;

[0046] Figure 3 is a schematic diagram of the structure of an intermediate layer provided in a certain embodiment of the present application;

[0047] Figure 4This is a schematic diagram of the structure of a network security entity tag identification device provided by a certain embodiment of the present application;

[0048] Figure 5 It is a structural diagram of a terminal device provided in a certain embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0051] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0052] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0053] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0054] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0055] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0056] See also Figure 1 , is a flow chart of a network security entity tag identification method provided by an embodiment of the present invention, including:

[0057] S1. Acquire text data for indicating network security information; wherein the text data includes a number of words;

[0058] S2. Input the text data into a preset entity label recognition model, so that the entity label recognition model predicts entity labels according to the text data, and generates entity labels corresponding to each word in the text data; wherein the entity label recognition model takes a number of text data indicating network security information and annotated entity labels corresponding to each word in the text data as input, and takes the predicted entity labels as output, and is obtained after training, and during the training process, the annotated entity labels corresponding to each word are compared with the predicted entity labels, and the network parameters of the entity label recognition model are adjusted according to the comparison results;

[0059] In a preferred embodiment, the training process of the entity tag recognition model includes:

[0060] Acquire a network security text data set; wherein the network security text data set includes a number of text data for indicating network security information and a marked entity label corresponding to each word in the text data;

[0061] Construct a RoBERTa-BiGRU-CRF model, take the cybersecurity text dataset as input, take the predicted entity label as output, and iteratively train the RoBERTa-BiGRU-CRF model;

[0062] The trained RoBERTa-BiGRU-CRF model is used as the entity label recognition model;

[0063] In each iterative training, the entity label predicted by the current RoBERTa-BiGRU-CRF model is compared with the corresponding labeled entity label, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the RoBERTa-BiGRU-CRF model after the training is completed, if not, the network parameters of the RoBERTa-BiGRU-CRF model are adjusted to obtain the RoBERTa-BiGRU-CRF model for the next iterative training;

[0064] In a preferred embodiment, each entity tag consists of a location tag and an entity category;

[0065] Schematically, the network security text data set includes a number of text data for indicating network security information, which are derived from the National Vulnerability Database (NVD); NVD mainly provides vulnerability information existing in computer systems, with a total of 719,463 words, which are divided into 13 entity categories;

[0066] Specifically, each entity tag consists of two parts, namely, the location tag and the entity category; among them, the location tags include B, I, and O, B represents the beginning position of the entity, I represents the middle position of the entity, and O represents that it does not belong to any entity; the entity categories include 13 types, namely, application, CVE number, version, function, hardware, method, operating system, parameter, programming language, related tasks, update, vendor and version.

[0067] In a preferred embodiment, the RoBERTa-BiGRU-CRF model includes: an input layer, an intermediate layer, and an output layer;

[0068] The input layer is used to receive a network security text data set and transmit the network security text data set to the middle layer;

[0069] The intermediate layer is used to convert the text data in the network security text data set into an initial word vector sequence, perform feature extraction on the initial word vector sequence to obtain a feature word vector sequence containing contextual semantic information, perform sequence labeling on the feature word vector sequence, and determine the predicted entity label;

[0070] The output layer is used to output the predicted entity label;

[0071] See also Figure 3 ,In a preferred embodiment, the intermediate layer ,includes: a RoBERTa layer, a BiGRU layer and a CRF layer;

[0072] The RoBERTa layer is used to convert the text data in the network security text data set into an initial word vector sequence, and transmit the initial word vector sequence to the BiGRU layer;

[0073] The BiGRU layer is used to capture the forward text information and backward text information of each word vector in the initial word vector sequence; determine a feature word vector sequence containing contextual semantic information according to the forward text information and backward text information of each word vector; and transmit the feature word vector sequence to the CRF layer;

[0074] The CRF layer is used to perform sequence labeling on the feature word vector sequence, and use the label sequence with the highest correlation with the feature word vector sequence as the target label sequence; determine the entity label corresponding to each word vector in the feature word vector sequence according to the target label sequence, and use the entity label corresponding to each word vector as the final predicted entity label;

[0075] Schematically, after receiving the cybersecurity text dataset, the RoBERTa layer makes it into an initial word vector sequence;

[0076] Specifically, Figure 2 As shown, first, in order to meet the input requirements of the RoBERTa layer, it is necessary to add the identifier "[CLS]" at the beginning of the text data sequence and the identifier "[SEP]" at the end to separate two adjacent sentences;

[0077] Next, the text data after word segmentation is converted into an encoding vector through three embedding layers with the same dimensions, where the embedding layers are token embedding, segment embedding, and position embedding.

[0078] For example, there is currently a sentence sent = [This malicious code can automatically run on Linux, Windows, and macOS];

[0079] Then, when the sentence sent is received, it is first segmented and then sent1 = [[CLS]This malicious code can automatically run on Linux[SEP]Windows[SEP]and macOS[SEP]] is obtained. Then, three embedding layers are used to convert the sentence sent1 into an initial word vector sequence:

[0080] 1) First, it passes through the word embedding layer, which transforms the words in sent1 into a processable form by mapping each word in sent1 to a real vector in a high-dimensional vector space;

[0081] 2) Next, after passing through the segment embedding layer, the sentence is divided into different segments according to the [CLS] and [SEP] identifiers; for sentence sent1, the segment embedding se = [E A ,E A ,E A ,E A ,E A ,E A ,E A ,E A ,E A ,E A ,E B ,E B ,E C ,E C ,E C ];

[0082] Among them, [[CLS]This malicious code can automatically run on Linux[SEP]] belongs to segment E A , [Windows[SEP]] belongs to segment E B , [and macOS[SEP]] belongs to segment E C ;

[0083] Finally, it passes through the position embedding layer, which is used to represent the position information of the word in the sentence, and a vector is assigned to each position in sent1;

[0084] For sentence sent1, position embedding

[0085] pe=[E0,E1,E2,E3,E4,E5,E6,E7,E8,E9,E 10 ,E 11 ,E 12 ,E 13 ,E 14 ].

[0086] Since these three embedding vectors have the same dimension, they are added element by element to obtain a comprehensive embedding vector representation, and the embedding vector is sent to the multi-head attention mechanism layer and the feedforward neural network layer. After multiple trainings, the initial word vector sequence is obtained.

[0087] Schematically, after receiving the initial word vector sequence, the BiGRU layer captures the forward text information and the backward text information of each word vector in the initial word vector sequence, and determines a feature word vector sequence containing contextual semantic information according to the forward text information and the backward text information of each word vector;

[0088] In a preferred embodiment, capturing the forward text information and the backward text information of each word vector in the initial word vector sequence includes:

[0089] Perform linear transformation on each word vector in the initial word vector sequence to obtain the query vector, key vector and value vector corresponding to each word vector;

[0090] Input the query vector, the key vector, and the value vector into a preset attention mechanism, so that the attention mechanism generates attention weights corresponding to each word vector according to the input vector, and performs weighted summation on the value vectors corresponding to each word vector according to the attention weights corresponding to each word vector to obtain a weighted feature representation;

[0091] Determining the forward text information of each word vector and the backward text information of each word vector according to the weighted feature representation;

[0092] Specifically, the BiGRU layer consists of two independent parts: the forward GRU and the backward GRU. The specific expression is as follows:

[0093]

[0094] In the formula, x t Represents the word vector at the current moment; Represents the forward text information of the word vector at the current moment; Represents the backward text information of the word vector at the current moment; Represents the forward text information of the word vector at the previous moment; Represents the backward text information of the word vector at the previous moment; Represents a bitwise addition operation.

[0095] In getting and After that, the two are combined in a network to obtain the output vector z of the final BiGRU layer; this vector contains contextual semantic information and can improve the generalization ability of the model;

[0096] When the BiGRU layer extracts features, it uses the attention mechanism for optimization, so that the BiGRU layer can pay more attention to the important parts, thereby improving the model performance; the attention calculation formula is as follows:

[0097]

[0098] Where Q represents the query vector; K represents the key vector; V represents the value vector; d k Represents the dimension of vector K.

[0099] Assume that the current sentence sent' = [Buffer overflow in the SNMP], and its hidden state set is [h1,h2,h3,h4,h5]; when focusing on "Buffer", Q represents the hidden state h1 of the current word; K represents the set of all hidden states [h1,h2,h3,h4,h5]; V represents the set of all hidden states [h1,h2,h3,h4,h5];

[0100] First, the similarity between Q and K is calculated, and then the attention weight is obtained after softmax normalization. Finally, the weight is used to perform weighted summation on the value vectors corresponding to each word vector, so as to dynamically adjust the features and generate context-aware feature representations; according to the weighted feature representations, the forward text information of each word vector and the backward text information of each word vector are determined; thereby adjusting the weights of the output features of the BiGRU layer.

[0101] Schematically, after receiving the feature word vector sequence, the CRF layer assigns a label to each word, thereby realizing the recognition of named entities in the text;

[0102] The CRF layer calculation formula is as follows:

[0103]

[0104] Among them, z represents the observation sequence, y represents the label; Y z represents all possible token sequences in z;

[0105] Since the same word may have multiple meanings, it is necessary to calculate the score of the relationship between the feature word vector sequence and the entity label, as well as the sequence dependency score between the feature word vector sequences; Used to predict position i to label y i The score represents the direct correlation between the feature word vector sequence and the entity label; Used to calculate the entity label y i To entity tag y i+1 The conversion score is used to capture the dependencies between entity labels;

[0106] By calculating the scores of all possible label sequences and selecting the label sequence with the highest score (i.e., the label sequence with the highest correlation with the feature word vector sequence) as the target label sequence, the entity label corresponding to each word vector in the feature word vector sequence is determined according to the target label sequence, so that the entity label corresponding to each word vector is used as the final predicted entity label.

[0107] Thus, the RoBERTa-BiGRU-CRF model is iteratively trained with the cybersecurity text dataset as input and the predicted entity label as output;

[0108] During the training process, the input layer is used to receive a network security text data set and transmit the network security text data set to the middle layer; the middle layer converts the text data in the network security text data set into an initial word vector sequence, performs feature extraction on the initial word vector sequence, obtains a feature word vector sequence containing contextual semantic information, performs sequence annotation on the feature word vector sequence, and determines the predicted entity label; the output layer outputs the predicted entity label; then, in each iterative training, the entity label predicted by the current RoBERTa-BiGRU-CRF model is compared with the corresponding annotated entity label, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the RoBERTa-BiGRU-CRF model after training, if not, the network parameters of the RoBERTa-BiGRU-CRF model are adjusted to obtain the RoBERTa-BiGRU-CRF model for the next iterative training; the RoBERTa-BiGRU-CRF model after training is used as the entity label recognition model;

[0109] When identifying network security entity labels corresponding to text data, the text data is input into the entity label recognition model so that the entity label recognition model predicts entity labels based on the text data to generate entity labels corresponding to each word in the text data.

[0110] See also Figure 4 , is a network security entity label identification device provided by an embodiment of the present invention, comprising: a text data acquisition module and an entity label generation module;

[0111] The text data acquisition module is used to acquire text data indicating network security information; wherein the text data includes a number of words;

[0112] The entity label generation module is used to input the text data into a preset entity label recognition model so that the entity label recognition model predicts the entity label according to the text data and generates an entity label corresponding to each word in the text data; wherein the entity label recognition model takes a number of text data for indicating network security information and annotated entity labels corresponding to each word in the text data as input, and takes the predicted entity label as output, and is obtained after training, and during the training process, the annotated entity label corresponding to each word is compared with the predicted entity label, and the network parameters of the entity label recognition model are adjusted according to the comparison result.

[0113] In a preferred embodiment, the training process of the entity tag recognition model includes:

[0114] Acquire a network security text data set; wherein the network security text data set includes a number of text data for indicating network security information and a marked entity label corresponding to each word in the text data;

[0115] Construct a RoBERTa-BiGRU-CRF model, take the cybersecurity text dataset as input, take the predicted entity label as output, and iteratively train the RoBERTa-BiGRU-CRF model;

[0116] The trained RoBERTa-BiGRU-CRF model is used as the entity label recognition model;

[0117] Among them, in each iterative training, the entity label predicted by the current RoBERTa-BiGRU-CRF model is compared with the corresponding labeled entity label, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the RoBERTa-BiGRU-CRF model after training, if not, the network parameters of the RoBERTa-BiGRU-CRF model are adjusted to obtain the RoBERTa-BiGRU-CRF model for the next iterative training.

[0118] See also Figure 5 , a certain embodiment of the present application further provides a terminal device, including:

[0119] one or more processors;

[0120] A memory, coupled to the processor, for storing one or more programs;

[0121] When the one or more programs are executed by the one or more processors, the one or more processors implement the network security entity tag identification method as described above.

[0122] The processor is used to control the overall operation of the terminal device to complete all or part of the steps of the above-mentioned network security entity tag identification method. The memory is used to store various types of data to support the operation of the terminal device, which data may include, for example, instructions for any application or method used to operate on the terminal device, and application-related data. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk.

[0123] In an exemplary embodiment, the terminal device can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the network security entity tag identification method described in any of the above embodiments and achieve the same technical effect as the above method.

[0124] In another exemplary embodiment, a computer-readable storage medium including a computer program is also provided, and when the computer program is executed by a processor, the steps of the network security entity label identification method as described in any of the above embodiments are implemented. For example, the computer-readable storage medium can be the above-mentioned memory including the computer program, and the above-mentioned computer program can be executed by the processor of the terminal device to complete the network security entity label identification method as described in any of the above embodiments, and achieve the same technical effect as the above method.

[0125] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network security entity tag identification method, characterized in that: include: Acquire text data for indicating network security information; wherein the text data includes a plurality of words; Inputting the text data into a preset entity tag recognition model so that the entity tag recognition model predicts entity tags based on the text data and generates entity tags corresponding to each word in the text data; The entity label recognition model is obtained after training, with a number of text data indicating network security information and annotated entity labels corresponding to each word in the text data as input, and a predicted entity label as output. During the training process, the annotated entity label corresponding to each word is compared with the predicted entity label, and the network parameters of the entity label recognition model are adjusted according to the comparison results.

2. The network security entity tag identification method according to claim 1, characterized in that: The training process of the entity label recognition model includes: Acquire a network security text data set; wherein the network security text data set includes a number of text data for indicating network security information and a marked entity label corresponding to each word in the text data; Construct a RoBERTa-BiGRU-CRF model, take the cybersecurity text dataset as input, take the predicted entity label as output, and iteratively train the RoBERTa-BiGRU-CRF model; The trained RoBERTa-BiGRU-CRF model is used as the entity label recognition model; Among them, in each iterative training, the entity label predicted by the current RoBERTa-BiGRU-CRF model is compared with the corresponding labeled entity label, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the RoBERTa-BiGRU-CRF model after training, if not, the network parameters of the RoBERTa-BiGRU-CRF model are adjusted to obtain the RoBERTa-BiGRU-CRF model for the next iterative training.

3. The network security entity tag identification method according to claim 2, characterized in that: The RoBERTa-BiGRU-CRF model includes: an input layer, an intermediate layer and an output layer; The input layer is used to receive a network security text data set and transmit the network security text data set to the middle layer; The intermediate layer is used to convert the text data in the network security text data set into an initial word vector sequence, perform feature extraction on the initial word vector sequence to obtain a feature word vector sequence containing contextual semantic information, perform sequence labeling on the feature word vector sequence, and determine the predicted entity label; The output layer is used to output the predicted entity label.

4. The network security entity tag identification method according to claim 3, characterized in that: The intermediate layer includes: a RoBERTa layer, a BiGRU layer and a CRF layer; The RoBERTa layer is used to convert the text data in the network security text data set into an initial word vector sequence, and transmit the initial word vector sequence to the BiGRU layer; The BiGRU layer is used to capture the forward text information and backward text information of each word vector in the initial word vector sequence; determine a feature word vector sequence containing contextual semantic information according to the forward text information and backward text information of each word vector; and transmit the feature word vector sequence to the CRF layer; The CRF layer is used to perform sequence labeling on the feature word vector sequence, and use the label sequence with the highest correlation with the feature word vector sequence as the target label sequence; according to the target label sequence, determine the entity label corresponding to each word vector in the feature word vector sequence, and use the entity label corresponding to each word vector as the final predicted entity label.

5. The network security entity tag identification method according to claim 4, characterized in that: The capturing of the forward text information and the backward text information of each word vector in the initial word vector sequence includes: Perform linear transformation on each word vector in the initial word vector sequence to obtain the query vector, key vector and value vector corresponding to each word vector; Input the query vector, the key vector, and the value vector into a preset attention mechanism, so that the attention mechanism generates attention weights corresponding to each word vector according to the input vector, and performs weighted summation on the value vectors corresponding to each word vector according to the attention weights corresponding to each word vector to obtain a weighted feature representation; According to the weighted feature representation, the forward text information of each word vector and the backward text information of each word vector are determined.

6. The network security entity tag identification method according to claim 4, characterized in that: Each entity tag consists of a location tag and an entity category.

7. A network security entity tag identification device, characterized in that: include: Text data acquisition module and entity label generation module; The text data acquisition module is used to acquire text data indicating network security information; wherein the text data includes a number of words; The entity label generation module is used to input the text data into a preset entity label recognition model so that the entity label recognition model predicts the entity label according to the text data and generates an entity label corresponding to each word in the text data; wherein the entity label recognition model takes a number of text data for indicating network security information and annotated entity labels corresponding to each word in the text data as input, and takes the predicted entity label as output, and is obtained after training, and during the training process, the annotated entity label corresponding to each word is compared with the predicted entity label, and the network parameters of the entity label recognition model are adjusted according to the comparison result.

8. The network security entity tag identification device according to claim 7, characterized in that: The training process of the entity label recognition model includes: Acquire a network security text data set; wherein the network security text data set includes a number of text data for indicating network security information and a marked entity label corresponding to each word in the text data; Construct a RoBERTa-BiGRU-CRF model, take the cybersecurity text dataset as input, take the predicted entity label as output, and iteratively train the RoBERTa-BiGRU-CRF model; The trained RoBERTa-BiGRU-CRF model is used as the entity label recognition model; Among them, in each iterative training, the entity label predicted by the current RoBERTa-BiGRU-CRF model is compared with the corresponding labeled entity label, and the loss function value is calculated according to the comparison result; it is determined whether the loss function value converges, if so, the training is stopped to obtain the RoBERTa-BiGRU-CRF model after training, if not, the network parameters of the RoBERTa-BiGRU-CRF model are adjusted to obtain the RoBERTa-BiGRU-CRF model for the next iterative training.

9. A device, characterized in that: include: one or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the network security entity label identification method as described in any one of claims 1-6.

10. A medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security entity label identification method according to any one of claims 1 to 6 is implemented.

Images