Natural language processing-based interpretable authorization method and device

Abstract

The invention discloses an interpretable authorization method and device based on natural language processing. The method comprises the following steps: 1) acquiring labeled vulnerability description and a corresponding CVSS vector as training data, and optimizing a pre-trained BERT model to obtain a classifier; 2) inputting a text description of a target security vulnerability into the classifier, and predicting to obtain a CVSS vector corresponding to the target security vulnerability; 3) calculating a severity score of the target security vulnerability according to the predicted CVSS vector, and adjusting a user authorization level according to the severity score; 4) analyzing vocabularies in the text description of the target security vulnerability by using a gradient-based input saliency method, and obtaining vocabularies playing a key role in the CVSS vector corresponding to the target security vulnerability predicted by the classifier as key vocabularies; and 5) generating an authorization adjustment interpretability text corresponding to the target security vulnerability according to the adjusted user authorization level and the key vocabulary.

Description

Technical Field

[0001] The present invention belongs to the field of information security and artificial intelligence technology, and relates to a method and device for improving the interpretability of security system authorization decisions by utilizing natural language processing technology. Background Art

[0002] In the field of network security, authorization management is a key component to ensure the security of information systems. The system needs to make accurate authorization decisions for access requests from different users to prevent unauthorized data access or potential security threats. The assignment of authorization levels usually relies on an assessment of the user's identity, requested resources, and the sensitivity of the operation. However, when faced with complex security vulnerabilities, how to dynamically adjust the user's authorization level based on the severity of the vulnerability has become an important but not yet fully addressed issue.

[0003] The severity of vulnerabilities is usually assessed through the Common Vulnerability Scoring System (CVSS), which provides a numerical score for each identified security vulnerability, reflecting its potential degree of harm. These scores are based on a series of metrics, such as access vectors, access complexity, and impact scope. However, traditional authorization systems are often disconnected from these dynamic vulnerability assessment results and cannot effectively use these scores to adjust or restrict user operation permissions, which may lead to over-authorization or under-authorization problems.

[0004] With the development of natural language processing (NLP) technology, especially the introduction of deep learning models such as BERT, we now have the opportunity to improve the accuracy and interpretability of vulnerability assessments by automatically parsing and understanding vulnerability descriptions. In addition, by integrating vulnerability scoring results with authorization systems, smarter authorization decisions can be made. For example, the system can automatically adjust user access rights to certain system resources based on the severity of the vulnerability to prevent potential security threats.

[0005] However, existing NLP-based authorization methods rarely directly use vulnerability assessment results to adjust the user's authorization level. In addition, these methods often lack transparency in explaining how vulnerability scores affect authorization decisions. Therefore, developing a new natural language processing-based explainable authorization method that can not only accurately predict and explain vulnerability severity scores, but also dynamically adjust the user's authorization level based on these scores is an urgent problem to be solved in the existing technology. Summary of the invention

[0006] According to the above technical background, the purpose of the present invention is to provide an explainable authorization method based on natural language processing, which aims to dynamically adjust the user's authorization level by using information extracted from the text description of the security vulnerability, while providing a high degree of transparency and explainability, so as to solve the problem that the existing methods cannot use the vulnerability assessment results to dynamically adjust the user's authorization level, and generally lack transparency in explaining how the vulnerability score affects the authorization decision.

[0007] The technical contents of the present invention include:

[0008] A natural language processing-based explainable authorization method, the steps of which include:

[0009] 1) Obtain the annotated vulnerability descriptions and their corresponding CVSS vectors as training data to fine-tune the pre-trained BERT model. By optimizing the model using the cross entropy loss function, a classifier is finally obtained that can automatically extract CVSS vectors from text descriptions. This vector is then used to further assess the risk level of the vulnerability and assist in the automated vulnerability management process.

[0010] 2) Input the text description of the target security vulnerability into the trained BERT classifier, and the model predicts and generates the complete CVSS vector corresponding to the vulnerability. The CVSS vector consists of multiple indicators (such as attack vector, attack complexity, etc.).

[0011] Each metric value is predicted by a different BERT classifier, such as N (Normal), L (Low), H (High).

[0012] Furthermore, multiple indicators of CVSS vectors include:

[0013] a) AC (Attack Complexity) metric evaluates the complexity of the vulnerability to attack.

[0014] b) AV (Attack Vector) indicators evaluate the conditions required by attackers, such as whether close contact, local access or remote access is required.

[0015] c) The PR (Privileges Required) metric evaluates the level of permissions required to actually exploit a vulnerability.

[0016] d) UI (User Interaction) metrics evaluate the level of user interaction required to carry out an attack.

[0017] e) The S (Scope) indicator evaluates the impact of the vulnerability on other systems or data.

[0018] f) The C (Confidentiality) metric assesses the potential impact of a vulnerability leaking sensitive information.

[0019] g) I (Integrity) measures the impact on integrity after a successful exploit. Integrity refers to the credibility and authenticity of information.

[0020] h) A (Availability) measures the impact of a successfully exploited vulnerability on availability. This metric refers to the loss of availability of the affected component itself, such as a network service (such as a website, database, email, etc.).

[0021] 3) Calculate the severity score of the vulnerability from the predicted CVSS vector and adjust the user authorization level based on the severity score of the vulnerability, ensuring that the predicted score is close to the actual score and that the calculated output is consistent with the user's expected authorization intent;

[0022] By referencing the CVSS scores in existing vulnerability databases (such as NVD) as the actual scores of the vulnerabilities, these scores have been reviewed and confirmed by security experts and serve as the reference standard for the model. In order to ensure that the CVSS severity scores predicted by the model are close to the actual scores, the cross entropy loss function is used for optimization during the model training phase to minimize the difference between the predicted scores and the actual scores and ensure the accuracy of the model.

[0023] Furthermore, the CVSS vector calculates the severity score of the vulnerability as follows: Calculate the impact sub-score (ISS) and exploitability sub-score (ESS). The impact sub-score ESS calculation formula is: ISS = 1-[(1-C) × (1-I) × (1-A)]; the exploitability sub-score ESS calculation formula is: ESS = 8.22 × AV × AC × PR × UI; Next, combine ISS and ESS to calculate the unadjusted base score BaseScore, which is the severity score of the vulnerability. If ISS ≤ 0.5: BaseScore = round up (min(ESS+ISS,10); if ISS>0.5: BaseScore=round up (min(1.08×(ESS+ISS,10)); where round up It is rounded up to the nearest tenth.

[0024] Furthermore, the present invention sets a mapping rule between the severity score of the vulnerability and the user authorization level. When the score exceeds 9.0, the privileges of advanced users are adjusted to read-only, and the access rights of ordinary users are frozen. When the score ranges from 7.0 to 8.9, the privileges of advanced users are maintained unchanged, but some functions of ordinary users are restricted. The system analyzes the user's expected authorization intention through historical data, and calculates the consistency of the adjusted authorization with the expected intention, using the Euclidean distance as the difference metric.

[0025] 4) Use the gradient-based input saliency method to analyze the words in the vulnerability description file to determine which words play a key role in the model's generation of CVSS vectors. In this way, the interpretability of the model's prediction results can be improved and help users better understand the decision-making basis of the model.

[0026] 5) Based on the processing result in step 3), that is, the user authorization level adjusted according to the CVSS severity score, combined with the key words affecting the CVSS score identified in step 4), an explainable authorization adjustment text of the target security vulnerability is generated; the text clearly explains the reason for the authorization adjustment to the user to ensure that the user understands the decision-making process of the system.

[0027] The present invention first proposes a gradient-based input saliency method for explaining user authorization level adjustment, which includes:

[0028] For a given CVSS prediction result (such as the CVSS vector generated in the previous step), we can calculate the output value (i.e., logit value) corresponding to the prediction result and determine the importance of each input token to the prediction. The logit value refers to the unnormalized score of each indicator (such as attack vector AV, complexity AC, etc.) in the CVSS vector output by the classifier. By calculating the gradient of the logit value relative to the input text token (such as each word in the vulnerability description), we can evaluate the importance of each input token to the final prediction result, thereby providing an explanation for the adjustment of the user's authorization level. Specifically, the smallest change in the input token with the highest gradient-based significance value will result in the largest change in the model output. We use the gradient multiplied by input (Gradient×Input) method. First, we extract the embedding vector of each input word from the BERT model, which is generated by BERT's word embedding layer. Next, the gradient of each word embedding vector is calculated. This gradient vector represents the sensitivity of the model output to the input word. Then, this gradient vector is multiplied with the corresponding input embedding vector to obtain the importance score of each word. To further quantify these importance scores, we calculate the L2 norm of the product vector. The L2 norm here is not used to directly measure the feature importance of the input embedding vector itself, but to measure the overall sensitivity of the model output to the input vocabulary. More specifically, the importance of the token at position i in the input token is given by the following formula: X i is the embedding vector of the i-th input token; X 1:n is the embedding vector of all input tokens; f c (X 1:n ) is the model's classification (N, L, H) for the predicted class c; is the score about X i ; ∥·∥2 represents the L2 norm of the calculated vector. A larger L2 norm means that the corresponding input token plays a greater role in the model's prediction decision.

[0029] A natural language processing interpretability authorization device is proposed, the device comprising:

[0030] Data preprocessing module: This module is responsible for processing the user's CVE vulnerability record input data. By applying the BERT classifier, the module can automatically identify and extract key information in the vulnerability description, including determining the CVSS basic vector of the vulnerability and the associated severity score. This step is achieved by deeply analyzing the natural language description of the CVE record to ensure that the core metrics of the vulnerability are accurately captured from the text.

[0031] Severity Metric Scoring Module: It is used to process the output obtained from the data preprocessing module according to multiple BERT classifiers. Each classifier is responsible for generating the score value of each indicator in the CVSS vector of the vulnerability (such as the attack vector AV value, the attack complexity AC value, etc.), and generating the scores of different basic evaluation indicators of the user vulnerability record;

[0032] Explainable authorization module: The input vulnerability description text is encoded through the BERT model to generate a semantic feature vector, which captures the global semantic information of the text and contains key information related to the severity of the vulnerability. After generating the semantic feature vector, the system analyzes the vector in combination with the gradient-based input saliency analysis method to identify the input words that have the greatest impact on the final CVSS score. Based on these analysis results, the system generates explanatory output (that is, the words that are most relevant to the output and score) to help users understand how the model derives the vulnerability severity score and further support the decision to adjust the user's authorization level. The system dynamically adjusts the user's access rights to the affected system resources based on the overall CVSS score of the vulnerability: for high-risk scores (such as more than 9.0), the access rights of advanced users are adjusted to read-only, and the rights of ordinary users are frozen; for medium-risk scores (such as 7.0 to 8.9), the rights of advanced users are maintained unchanged, but ordinary users are restricted from accessing specific functions; for low-risk scores (such as less than 7.0), the system may expand the rights of ordinary users. Ultimately, the system calculates the consistency of the output (including explanatory output and permission adjustment suggestions) with the user's expected authorization intent, and analyzes the user's historical authorization decision data, using the Euclidean distance or other appropriate methods to measure the consistency score between the two to ensure that the system's decision is consistent with the user's expectations. Ultimately, the system ensures the rationality of the decision by calculating the consistency of the output (including explanatory output and permission adjustment suggestions) with the user's expected authorization intent. Specifically, the system analyzes the user's historical authorization decision data, extracts relevant features (such as CVSS scores, user roles, and historical authorization behaviors), and uses machine learning algorithms (such as clustering or regression analysis) to establish a user's authorization behavior model. In the current vulnerability scenario, the system predicts the user's expected authorization intention E based on these models, that is, the authorization adjustment behavior that the user usually takes in similar scenarios. And compare it with the output result O generated by the system. Use the Euclidean distance formula Calculate the difference between the two and normalize the distance to To ensure the comparability of the results in different dimensions and ranges. Then, the system calculates the consistency score S = 1-D norm (O,E), this score reflects the degree of consistency between system output and user expectations. The higher the score, the more consistent the system decision is with user expectations, ensuring that the system's permission adjustment decisions are consistent with the user's actual needs.

[0033] A computer device, characterized in that it comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute any of the above methods.

[0034] A storage medium stores a computer program, wherein the computer program is configured to execute any of the above methods when running.

[0035] Compared with the prior art, a natural language processing-based interpretable authorization method is provided, which aims to dynamically adjust the user's authorization level using information extracted from the text description of the security vulnerability, while providing a high degree of transparency and interpretability. The present invention solves the shortcomings of the prior art in dynamically adjusting the user's authorization level using vulnerability assessment results, and significantly improves the transparency of explaining how vulnerability scores affect authorization decisions. By accurately extracting and analyzing key information in vulnerability descriptions, and using advanced natural language processing technology and gradient-based input significance methods, the present invention not only improves the responsiveness and accuracy of the authorization system, but also makes the authorization decision process more transparent and easy to understand for users, thereby enhancing users' trust and satisfaction with system decisions. This method effectively bridges the information gap between vulnerability identification and authorization decisions, providing a more sophisticated and dynamic control method for security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a model architecture diagram of the present invention.

[0037] Figure 2 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, scheme and advantages of the present invention more clear, the present invention is further described in detail by taking an experiment conducted on an actual user behavior data set as an example. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0039] The present invention is an explainable authorization method based on natural language processing. Aiming at the shortcomings of the existing technology in dynamically adjusting the user authorization level by using the vulnerability assessment results and the transparency problem of explaining how the vulnerability score affects the authorization decision, a strategy combining the accurate extraction of key information from the text description of the security vulnerability and the application of the gradient-based input saliency method is proposed to achieve the purpose of improving the responsiveness and accuracy of the authorization system, making the authorization decision process more transparent and easy to understand for users, thereby enhancing the user's trust and satisfaction with the system decision. This method effectively bridges the information gap between vulnerability identification and authorization decision, and provides a more sophisticated and dynamic control method for security management.

[0040] like Figure 2 As shown, the implementation steps of this program are as follows:

[0041] 1) The system first collects text descriptions related to vulnerabilities, which may come from public security databases or internal security reports. The text data is preprocessed, including cleaning, standardization, and word segmentation, to adapt to the needs of model input;

[0042] 2) Use the pre-trained BERT model to analyze the text and extract information related to the CVSS scoring system, including the impact of the vulnerability, exploitability, etc. The model maps this information to the basic vectors of CVSS, such as access vectors, complexity, etc.

[0043] 3) For each specific metric of the CVSS vector, such as access complexity (AC), access vector (AV), permission requirement (PR), etc., separate BERT classifiers are configured and trained. These classifiers specialize in processing text information related to their respective metric values;

[0044] 4) Each classifier is individually tuned based on actual data and expected output accuracy to ensure high accuracy and reliability in predicting specific metrics, and the outputs of all classifiers are integrated to form a complete CVSS score vector;

[0045] 5) Calculate the impact sub-score (ISS) and exploitability sub-score (ESS), and finally calculate the severity score. The impact sub-score ESS calculation formula is: ISS = 1-[(1-C) × (1-I) × (1-A)]; the exploitability sub-score ESS calculation formula is: ESS = 8.22 × AV × AC × PR × UI; Next, combine ISS and ESS to calculate the unadjusted base score BaseScore. If ISS ≤ 0.5: BaseScore = round up (min(ESS+ISS,10); if ISS>0.5: BaseScore=round up (min(1.08×(ESS+ISS,10))where round up It is rounded up to the nearest tenth.

[0046] 6) Dynamically adjust user access rights to affected system resources based on the severity score of the vulnerability. A high risk score may result in restrictions on access rights, while a low risk score may not affect or slightly adjust permissions.

[0047] 7) Use the gradient-based input saliency method to point out which words have a significant impact on the vulnerability score and explain how these impacts affect the overall authorization decision. Then generate authorization adjustment explainable text corresponding to the target security vulnerability based on the adjusted user authorization level and key words.

[0048] Taking the NVD dataset as an example, this paper describes the specific implementation steps of an explainable authorization method based on natural language processing.

[0049] The NVD dataset includes CVE vulnerability data from 2018 to 2020, totaling 45,926 samples. The entire dataset is randomly split into training and test sets, each containing 22,963 CVE vulnerabilities.

[0050] The present invention is an explainable authorization method based on natural language processing. Aiming at the deficiencies of the prior art in dynamically adjusting the user authorization level by using vulnerability assessment results and the transparency problem in explaining how vulnerability scores affect authorization decisions, a strategy combining the precise extraction of key information from the text description of security vulnerabilities and the application of a gradient-based input saliency method is proposed to improve the responsiveness and accuracy of the authorization system, make the authorization decision process more transparent and easy to understand for users, and thus enhance users' trust and satisfaction with system decisions.

[0051] This example sets up specific experiments to verify the effectiveness of this method in detecting internal threats. The evaluation indicators selected are precision, recall, and F1 score, which are calculated in a weighted average manner to take into account the impact of class imbalance. In addition, the accuracy, that is, the proportion of correct predictions, as well as the mean square error (MSE) and mean absolute error (MAE), are also involved, which are used to measure the difference between the predicted CVSS severity score and the true score. MSE and MAE provide statistical measures of prediction accuracy, where MAE of 0 indicates that the predicted value is exactly the same as the true value. The model used in this example is BERT-small, a lightweight version of BERT, which contains 4 converter encoding layers (while the original BERTBase model has 12) and a hidden embedding size of 512 (while BERT Base is 768). Compared with the original BERT Base model, BERT-small has fewer parameters, lower computational cost, and faster training speed. The vulnerability description is segmented using a pre-trained BERT-small tokenizer. Padding and truncation are used to make the token sequence length 128.

[0052] The effectiveness of the proposed explainable authorization scheme was verified using the NVD dataset. Experimental results show that the scheme exhibits significant performance advantages in many aspects. First, by automatically analyzing vulnerability descriptions and generating CVSS vectors and severity scores, the present invention can quickly and accurately identify and evaluate newly disclosed security vulnerabilities and dynamically adjust user permissions. In addition, the gradient-based input saliency method we adopted further enhances the interpretability of the system by identifying and highlighting the input features that have the greatest impact on the model's prediction results, making it easier for end users to understand the model's decision-making process.

[0053] The above description is an embodiment of the present invention and is not intended to limit the present invention. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for interpretable authorization based on natural language processing, comprising the following steps: 1) Obtain the annotated vulnerability descriptions and their corresponding CVSS vectors as training data, optimize the pre-trained BERT model, and obtain a classifier that can automatically extract CVSS vectors from security vulnerability text descriptions; 2) Inputting a text description of a target security vulnerability into the classifier to predict a CVSS vector corresponding to the target security vulnerability; 3) calculating the severity score of the target security vulnerability according to the predicted CVSS vector, and adjusting the user authorization level according to the severity score; 4) using a gradient-based input saliency method to analyze the words in the text description of the target security vulnerability, and obtaining the words that play a key role in the CVSS vector corresponding to the target security vulnerability predicted by the classifier as key words; 5) Generate an authorization adjustment interpretable text corresponding to the target security vulnerability according to the adjusted user authorization level and the key words.

2. The method according to claim 1, characterized in that The CVSS vectors include an indicator AC for evaluating the complexity of the vulnerability, an indicator AV for evaluating the conditions required for an attacker to exploit the vulnerability, an indicator PR for evaluating the permission level required to actually exploit the vulnerability, an indicator UI for evaluating the user interaction level required to implement the attack, an indicator S for evaluating the impact scope of the vulnerability, an indicator C for evaluating the potential impact of the vulnerability on leaking sensitive information, an indicator I for measuring the impact on integrity after successfully exploiting the vulnerability, and an indicator A for measuring the availability of the component after the vulnerability attack.

3. The method according to claim 1, characterized in that Based on the historical data of users of each level, the expected authorization intention E of the user of the corresponding level is analyzed, and it is compared with the adjusted user authorization level O of the user of the corresponding level to obtain the consistency degree between the adjusted user authorization level O and the expected authorization intention E, and the consistency degree is written into the authorization adjustment interpretable text.

4. The method according to claim 3, characterized in that Using the Euclidean distance formula Calculate the difference D(O,E) between the adjusted user authorization level O and the expected authorization intention E, and normalize the difference D(O,E) to Then calculate the consistency score S = 1-D norm (O, E) is used as the consistency degree; the higher the consistency score S is, the more consistent the adjusted user authorization level O is with the expected authorization intention E.

5. The method according to claim 1, characterized in that The method of obtaining the key words by analyzing the words in the text description of the target security vulnerability based on the gradient input saliency method is as follows: extracting the embedding vectors of each word obtained after the text description of the target security vulnerability is input into the classifier, and calculating the gradient vector of each word embedding vector; multiplying the gradient vector of each word by the word embedding vector of the word to obtain the importance score of the corresponding word; The L2 norm of the importance score of the word is calculated. If the L2 norm is greater than a set threshold, the corresponding word is determined to be a word that plays a key role in the CVSS vector corresponding to the target security vulnerability predicted by the classifier, and is used as a key word.

6. The method according to claim 1, characterized in that The method for adjusting the user authorization level according to the severity score is: if the severity score of the target security vulnerability exceeds 9.0, the permissions of the advanced user are adjusted to read-only, and the access permissions of ordinary users are frozen; if the severity score of the target security vulnerability ranges from 7.0 to 8.9, the permissions of the advanced user are maintained unchanged, but certain setting functions of ordinary users are restricted.

7. An interpretable authorization device based on natural language processing, characterized in that: It includes data preprocessing module, severity metric scoring module and explainability authorization module; The data preprocessing module is used to obtain the annotated vulnerability description and its corresponding CVSS vector as training data, optimize the pre-trained BERT model, and obtain a classifier that can automatically extract the CVSS vector from the security vulnerability text description; Then, a text description of a target security vulnerability is input into the classifier to predict a CVSS vector corresponding to the target security vulnerability; The severity metric scoring module is used to calculate the severity score of the target security vulnerability according to the predicted CVSS vector, and adjust the user authorization level according to the severity score; The explainable authorization module is used to analyze the words in the text description of the target security vulnerability using a gradient-based input saliency method, obtain the words that play a key role in the CVSS vector corresponding to the target security vulnerability predicted by the classifier as key words; and then generate the authorization-adjusted explainable text corresponding to the target security vulnerability according to the adjusted user authorization level and the key words.

8. A server, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing each step in the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images