An explainability authorization method and device based on natural language processing

Abstract

The application discloses a kind of explainability authorization method and device based on natural language processing.The method is: 1) obtaining annotated vulnerability description and its corresponding CVSS vector as training data, optimizing pre-trained BERT model to obtain classifier;2) the text description of a target security vulnerability is input into the classifier, and the corresponding CVSS vector of the target security vulnerability is predicted;3) according to the predicted CVSS vector, the severity score of the target security vulnerability is calculated, and the user authorization level is adjusted according to the severity score;4) the input significance method based on gradient is used to analyze the vocabulary in the text description of the target security vulnerability, and the vocabulary that plays a key role in the CVSS vector corresponding to the target security vulnerability predicted by the classifier is obtained as key vocabulary;5) according to the adjusted user authorization level and the key vocabulary, the authorization adjustment explainability text corresponding to the target security vulnerability is generated.

Description

Technical Field

[0001] This invention belongs to the field of information security and artificial intelligence technology, and relates to a method and apparatus for improving the interpretability of authorization decisions in security systems by utilizing natural language processing technology. Background Technology

[0002] In the field of cybersecurity, authorization management is a critical component of ensuring information system security. Systems need to make accurate authorization decisions for different users' access requests to prevent unauthorized data access or potential security threats. The allocation of authorization levels typically relies on assessments of user identity, the requested resources, and the sensitivity of the operations. However, when faced with complex security vulnerabilities, how to dynamically adjust user authorization levels based on the severity of the vulnerability remains an important but not yet fully resolved problem.

[0003] The severity of vulnerabilities is typically assessed using a Common Vulnerability Scoring System (CVSS), which provides a numerical score for each identified security vulnerability, reflecting its potential harm. These scores are based on a range of metrics, such as access vector, access complexity, and scope of impact. However, traditional authorization systems are often disconnected from these dynamic vulnerability assessments and cannot effectively utilize these scores to adjust or restrict user permissions, potentially leading to over- or under-authorization issues.

[0004] With the development of Natural Language Processing (NLP) technology, especially the introduction of deep learning models such as BERT, we now have the opportunity to improve the accuracy and interpretability of vulnerability assessments by automating the parsing and understanding of vulnerability descriptions. Furthermore, by integrating vulnerability scoring results with authorization systems, more intelligent authorization decisions can be achieved. For example, the system can automatically adjust user access permissions to certain system resources based on the severity of the vulnerability, thereby preventing potential security threats.

[0005] However, existing NLP-based authorization methods rarely directly utilize vulnerability assessment results to adjust user authorization levels. Furthermore, these methods often lack transparency in explaining how vulnerability scores influence authorization decisions. Therefore, developing a novel, interpretable authorization method based on natural language processing—one that can accurately predict and interpret vulnerability severity scores and dynamically adjust user authorization levels based on these scores—is a pressing issue in current technology. Summary of the Invention

[0006] Based on the above technical background, the purpose of this invention is to provide an interpretable authorization method based on natural language processing, which aims to dynamically adjust the user's authorization level by using information extracted from the text description of security vulnerabilities, while providing high transparency and interpretability, in order to solve the problem that existing methods cannot use vulnerability assessment results to dynamically adjust the user's authorization level, and usually lack transparency in explaining how vulnerability scores affect authorization decisions.

[0007] The technical content of this invention includes:

[0008] An interpretable authorization method based on natural language processing includes the following steps:

[0009] 1) Obtain labeled vulnerability descriptions and their corresponding CVSS vectors as training data to fine-tune the pre-trained BERT model. Optimize the model using the cross-entropy loss function to obtain a classifier that can automatically extract CVSS vectors from text descriptions. This vector is then used to further assess the risk level of vulnerabilities, assisting in automated vulnerability management processes.

[0010] 2) Input the text description of the target security vulnerability into the trained BERT classifier. The model predicts and generates the complete CVSS vector corresponding to the vulnerability. This CVSS vector consists of multiple metrics (such as attack vector, attack complexity, etc.).

[0011] Each metric is predicted by a different BERT classifier, such as N (Normal), L (Low), and H (High).

[0012] Furthermore, several metrics for CVSS vectors include:

[0013] a) The Attack Complexity (AC) metric assesses the complexity of a vulnerability's susceptibility to attack.

[0014] b) The AV (Attack Vector) metric assesses the conditions required by the attacker, such as whether close contact, local access, or remote access is required.

[0015] c) The PR (Privileges Required) metric assesses the level of privileges required to actually exploit a vulnerability.

[0016] d) UI (User Interaction) metrics assess the level of user interaction required to carry out an attack.

[0017] e) The Scope (S) metric assesses the extent to which a vulnerability affects other systems or data.

[0018] f) The C (Confidentiality) metric assesses the potential impact of vulnerabilities on the disclosure of sensitive information.

[0019] g) I (Integrity) Measurement: The impact on integrity after a successful vulnerability exploit. Integrity refers to the credibility and authenticity of information.

[0020] h)A (Availability) measures the impact of a successfully exploited vulnerability on availability. This metric refers to the loss of availability of the affected component itself, such as network services (e.g., websites, databases, email).

[0021] 3) Calculate the severity score of the vulnerability from the predicted CVSS vector, and adjust the user's authorization level according to the severity score of the vulnerability to ensure that the predicted score is close to the actual score, and calculate the consistency between the output and the user's expected authorization intent.

[0022] The model uses CVSS scores from existing vulnerability databases (such as NVD) as the actual vulnerability scores. These scores are reviewed and verified by security experts and serve as the reference standard for the model. To ensure that the model's predicted CVSS severity scores are close to the actual scores, the model training phase uses a cross-entropy loss function for optimization, minimizing the difference between the predicted and actual scores and ensuring the model's accuracy.

[0023] Furthermore, the severity scoring method for vulnerabilities calculated using the CVSS vector is as follows: The Impact Sub-Score (ISS) and Exploitability Sub-Score (ESS) are calculated. The formula for the Impact Sub-Score (ESS) is: ISS = 1 - [(1-C) × (1-I) × (1-A)]; the formula for the Exploitability Sub-Score (ESS) is: ESS = 8.22 × AV × AC × PR × UI. Next, combining the ISS and ESS, the unadjusted base score (BaseScore) is calculated, which is the severity score of the vulnerability. If ISS ≤ 0.5: BaseScore = round up (min(ESS+ISS,10); if ISS>0.5: BaseScore=round up (min(1.08×(ESS+ISS,10)); where round up It is rounded up to the nearest tenth.

[0024] Furthermore, this invention establishes a mapping rule between vulnerability severity scores and user authorization levels. When the score exceeds 9.0, the privileges of advanced users are adjusted to read-only, and access permissions for ordinary users are frozen. When the score ranges from 7.0 to 8.9, the privileges of advanced users remain unchanged, but certain functions of ordinary users are restricted. The system analyzes historical data to determine the user's intended authorization intent and calculates the consistency between the adjusted authorization and the intended intent, using Euclidean distance as a measure of difference.

[0025] 4) Use gradient-based input saliency analysis to analyze the vocabulary in the vulnerability description file to determine which words play a key role in the model's generation of CVSS vectors. This improves the interpretability of the model's predictions and helps users better understand the model's decision-making process.

[0026] 5) Based on the processing results in step 3), namely the user authorization level adjusted according to the CVSS severity score, and combined with the keywords that affect the CVSS score identified in step 4), an interpretable authorization adjustment text for the target security vulnerability is generated. This text clearly explains the reasons for the authorization adjustment to the user, ensuring that the user understands the system's decision-making process.

[0027] This invention first proposes a gradient-based input saliency method for interpreting user authorization level adjustments, including:

[0028] For a given CVSS prediction (such as the CVSS vector generated in the previous steps), we can calculate the corresponding output value (i.e., the logit value) and determine the importance of each input token to that prediction. The logit value refers to the unnormalized score of each metric (such as attack vector AV, complexity AC, etc.) in the CVSS vector output by the classifier. By calculating the gradient of the logit value relative to the input text tokens (e.g., each word in the vulnerability description), we can evaluate the importance of each input token to the final prediction, thus providing an explanation for adjusting the user authorization level. Specifically, the smallest change in an input token with the highest gradient-based significance value will result in the largest change in the model output. We use the gradient × input method. First, we extract the embedding vector for each input word from the BERT model, generated through BERT's word embedding layer. Next, we calculate the gradient of each word embedding vector, which represents the sensitivity of the model output to that input word. Then, we multiply this gradient vector by the corresponding input embedding vector to obtain the importance score for each word. To further quantify these importance scores, we calculate the L2 norm of the product vector. Here, the L2 norm is not used to directly measure the feature importance of the input embedding vector itself, but rather to measure the overall sensitivity of the model output to the input vocabulary. More specifically, the importance of the token at position i in the input token is given by the following formula: X i X is the embedding vector of the i-th input token; 1:n It is the embedding vector of all input tokens; f c (X 1:n ) is the model's classification (N, L, H) for the predicted class c; The score is about X i The gradient of the vector; ∥·∥2 represents the L2 norm of the vector. A larger L2 norm means that the corresponding input token plays a larger role in the model's predictive decision.

[0029] A natural language processing interpretability authorization device is proposed, the device comprising:

[0030] Data Preprocessing Module: This module is responsible for processing the user's CVE vulnerability record input data. By applying the BERT classifier, this module can automatically identify and extract key information from the vulnerability description, including determining the vulnerability's CVSS base vector and related severity score. This step is achieved through in-depth analysis of the natural language description of the CVE record, ensuring that the core metrics of the vulnerability are accurately captured from the text.

[0031] The severity metric scoring module processes the output from the data preprocessing module using multiple BERT classifiers. Each classifier is specifically responsible for generating a score for each metric in the vulnerability's CVSS vector (such as attack vector AV value, attack complexity AC value, etc.), generating scores for different basic evaluation metrics of the user vulnerability record.

[0032] The interpretable authorization module encodes the input vulnerability description text using the BERT model, generating a semantic feature vector. This vector captures the global semantic information of the text, containing key information related to the vulnerability severity. After generating the semantic feature vector, the system analyzes it using a gradient-based input saliency analysis method to identify the input words that have the greatest impact on the final CVSS score. Based on these analysis results, the system generates interpretive output (i.e., the words most relevant to the score), helping users understand how the model arrives at the vulnerability severity score and further supporting user decisions on adjusting authorization levels. The system dynamically adjusts user access permissions to affected system resources based on the overall CVSS score of the vulnerability: for high-risk scores (e.g., above 9.0), advanced users' access is adjusted to read-only, and ordinary users' permissions are frozen; for medium-risk scores (e.g., 7.0 to 8.9), advanced user permissions remain unchanged, but ordinary users' access to specific functions is restricted; for low-risk scores (e.g., below 7.0), the system may extend the permissions of ordinary users. Ultimately, the system calculates the consistency between its output (including explanatory output and permission adjustment suggestions) and the user's expected authorization intent. By analyzing the user's historical authorization decision data, it uses Euclidean distance or other appropriate methods to measure the consistency score between the two, ensuring that the system's decisions align with the user's expectations. Specifically, the system analyzes the user's historical authorization decision data, extracts relevant features (such as CVSS scores, user roles, and historical authorization behaviors), and uses machine learning algorithms (such as clustering or regression analysis) to build a model of the user's authorization behavior. In the current vulnerability scenario, the system predicts the user's expected authorization intent E based on these models, i.e., the authorization adjustment behavior the user would typically take in similar scenarios. This prediction is then compared with the system-generated output O. The Euclidean distance formula is used. Calculate the difference between the two and normalize the distance to This ensures the comparability of results across different dimensions and ranges. Then, the system calculates the consistency score S = 1 - D. norm The score (O,E) reflects the degree of consistency between the system's output and the user's expectations. A higher score indicates that the system's decisions are more consistent with the user's expectations, ensuring that the system's permission adjustment decisions match the user's actual needs.

[0033] A computer device, characterized in that it includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform any of the methods described above.

[0034] A storage medium storing a computer program, wherein the computer program is configured to execute any of the methods described above when run.

[0035] Compared to existing technologies, this invention provides an interpretable authorization method based on natural language processing (NLP). It aims to dynamically adjust user authorization levels using information extracted from security vulnerability text descriptions, while offering high transparency and interpretability. This invention addresses the shortcomings of existing technologies in dynamically adjusting user authorization levels using vulnerability assessment results and significantly improves the transparency of explaining how vulnerability scores influence authorization decisions. By accurately extracting and analyzing key information from vulnerability descriptions and utilizing advanced NLP techniques and gradient-based input saliency methods, this invention not only improves the responsiveness and accuracy of the authorization system but also makes the authorization decision-making process more transparent and understandable to users, thereby enhancing user trust and satisfaction with the system's decisions. This method effectively bridges the information gap between vulnerability identification and authorization decisions, providing a more refined and dynamic control approach for security management. Attached Figure Description

[0036] Figure 1 This is a model architecture diagram of the present invention.

[0037] Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation

[0038] To make the objectives, solutions, and advantages of this invention clearer, an experiment conducted on a real user behavior dataset is used as an example to further illustrate the invention in detail. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of the invention.

[0039] This invention presents an interpretable authorization method based on natural language processing. Addressing the shortcomings of existing technologies in dynamically adjusting user authorization levels using vulnerability assessment results and in terms of transparency regarding how vulnerability scores influence authorization decisions, this invention proposes a strategy that combines precise extraction of key information from security vulnerability text descriptions with the application of a gradient-based input saliency method. This aims to improve the responsiveness and accuracy of the authorization system, making the authorization decision process more transparent and understandable to users, thereby enhancing user trust and satisfaction with the system's decisions. This method effectively bridges the information gap between vulnerability identification and authorization decisions, providing a more refined and dynamic control approach for security management.

[0040] like Figure 2 As shown, the implementation steps of this solution are as follows:

[0041] 1) The system first collects text descriptions related to vulnerabilities, which may come from public security databases or internal security reports. The text data undergoes preprocessing, including cleaning, standardization, and word segmentation, to adapt to the needs of the model input;

[0042] 2) Analyze the text using a pre-trained BERT model to extract information relevant to the CVSS scoring system, including the impact and exploitability of vulnerabilities. The model maps this information to basic CVSS vectors, such as access vectors and complexity.

[0043] 3) For each specific metric of the CVSS vector, such as access complexity (AC), access vector (AV), permission requirement (PR), etc., configure and train an independent BERT classifier. These classifiers are specifically designed to process the textual information associated with their respective metrics;

[0044] 4) Each classifier is individually tuned based on actual data and expected output accuracy to ensure high accuracy and reliability in prediction of specific metrics. The outputs of all classifiers are integrated to form a complete CVSS score vector.

[0045] 5) Calculate the Impact Sub-Score (ISS) and Exploitability Sub-Score (ESS) to ultimately calculate the severity score. The formula for calculating the Impact Sub-Score (ESS) is: ISS = 1 - [(1-C) × (1-I) × (1-A)]; the formula for calculating the Exploitability Sub-Score (ESS) is: ESS = 8.22 × AV × AC × PR × UI. Next, combining the ISS and ESS, calculate the unadjusted BaseScore. If ISS ≤ 0.5: BaseScore = round up (min(ESS+ISS,10); if ISS>0.5: BaseScore=round up (min(1.08×(ESS+ISS,10)) where round up It is rounded up to the nearest tenth.

[0046] 6) Dynamically adjust user access permissions to affected system resources based on the vulnerability severity score. A high-risk score may result in restricted access permissions, while a low-risk score may have no impact or only slightly adjust permissions.

[0047] 7) Use a gradient-based input saliency method to identify which words have a significant impact on vulnerability scores and explain how these impacts affect the overall authorization decision. Then, generate authorization adjustment interpretability text corresponding to the target security vulnerability based on the adjusted user authorization level and keywords.

[0048] Taking the NVD dataset as an example, this paper describes the specific implementation steps of an interpretability authorization method based on natural language processing.

[0049] The NVD dataset contains CVE vulnerability data from 2018 to 2020, totaling 45,926 samples. The entire dataset is randomly split into a training set and a test set, each containing 22,963 CVE vulnerabilities.

[0050] This invention presents an interpretable authorization method based on natural language processing. Addressing the shortcomings of existing technologies in dynamically adjusting user authorization levels using vulnerability assessment results and in terms of transparency regarding how vulnerability scores influence authorization decisions, this invention proposes a strategy that combines precise extraction of key information from security vulnerability text descriptions with the application of a gradient-based input saliency method. The aim is to improve the responsiveness and accuracy of the authorization system, making the authorization decision-making process more transparent and understandable to users, thereby enhancing user trust and satisfaction with the system's decisions.

[0051] This embodiment sets up specific experiments to verify the effectiveness of the proposed method in detecting insider threats. The selected evaluation metrics include precision, recall, and F1 score, all calculated using weighted averages to account for the impact of class imbalance. In addition, accuracy (the proportion of correctly predicted values), mean squared error (MSE), and mean absolute error (MAE) are also considered, which measure the difference between the predicted CVSS severity score and the true score. MSE and MAE provide statistical measures of prediction accuracy, where an MAE of 0 indicates that the predicted value is completely consistent with the true value. The model used in this example is BERT-small, a lightweight version of BERT, which contains 4 transformer encoding layers (compared to 12 in the original BERTBase model) and a hidden embedding size of 512 (compared to 768 in BERTBase). Compared to the original BERTBase model, BERT-small has fewer parameters, lower computational cost, and faster training speed. Vulnerability descriptions are segmented using a pre-trained BERT-small tokenizer. Padding and truncation are used to ensure that the token sequence length is 128.

[0052] The effectiveness of the proposed interpretable authorization scheme was verified using the NVD dataset. Experimental results show that the scheme exhibits significant performance advantages in several aspects. First, by automatically analyzing vulnerability descriptions and generating CVSS vectors and severity scores, this invention can quickly and accurately identify and assess newly disclosed security vulnerabilities and dynamically adjust user permissions. Furthermore, our gradient-based input saliency method further enhances the interpretability of the system. By identifying and highlighting the input features that have the greatest impact on the model's prediction results, end users can more easily understand the model's decision-making process.

[0053] The above description is one embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An interpretable authorization method based on natural language processing, comprising the following steps: 1) Obtain labeled vulnerability descriptions and their corresponding CVSS vectors as training data, optimize the pre-trained BERT model, and obtain a classifier that can automatically extract CVSS vectors from security vulnerability text descriptions. 2) Input the text description of a target security vulnerability into the classifier to predict the CVSS vector corresponding to the target security vulnerability; 3) Calculate the severity score of the target security vulnerability based on the predicted CVSS vector, and adjust the user's authorization level according to the severity score; 4) Use the gradient-based input saliency method to analyze the words in the text description of the target security vulnerability, and obtain the words that play a key role in the CVSS vector corresponding to the target security vulnerability predicted by the classifier as keywords. 5) Generate an interpretable authorization adjustment text corresponding to the target security vulnerability based on the adjusted user authorization level and the keywords.

2. The method according to claim 1, characterized in that, The CVSS vector includes the following metrics: AC (complexity of vulnerability assessment), AV (conditions required for an attacker to exploit the vulnerability), PR (privilege level required for actual exploitation), UI (user interaction level required for attack implementation), S (scope of vulnerability assessment), C (potential impact of vulnerability on sensitive information disclosure), I (impact on integrity after successful exploitation), and A (availability of components after vulnerability attack).

3. The method according to claim 1, characterized in that, Based on the historical data of users at each level, the expected authorization intent E of the corresponding level of users is analyzed, and it is compared with the adjusted user authorization level O of the corresponding level of users to obtain the degree of consistency between the adjusted user authorization level O and the expected authorization intent E. The degree of consistency is written into the authorization adjustment interpretability text.

4. The method according to claim 3, characterized in that, Using the Euclidean distance formula Calculate the difference D(O,E) between the adjusted user authorization level O and the expected authorization intent E, and normalize this difference D(O,E) to... Then calculate the consistency score S = 1 - D norm (O, E) represents the degree of consistency; the higher the consistency score S, the more consistent the adjusted user authorization level O is with the expected authorization intent E.

5. The method according to claim 1, characterized in that, The gradient-based input saliency method analyzes the words in the text description of the target security vulnerability to obtain the keywords. The method is as follows: extract the word embedding vectors obtained after inputting the text description of the target security vulnerability into the classifier, calculate the gradient vector of each word embedding vector, and multiply the gradient vector of each word with the word embedding vector of the word to obtain the importance score of the corresponding word. Calculate the L2 norm of the importance score of the word. If the L2 norm is greater than a set threshold, the corresponding word is determined to be a key word in the CVSS vector corresponding to the target security vulnerability predicted by the classifier, and it is used as a keyword.

6. The method according to claim 1, characterized in that, The method for adjusting user authorization levels based on the severity score is as follows: if the severity score of the target security vulnerability exceeds 9.0, the privileges of advanced users are adjusted to read-only, and the access privileges of ordinary users are frozen; if the severity score of the target security vulnerability is between 7.0 and 8.9, the privileges of advanced users remain unchanged, but some settings functions of ordinary users are restricted.

7. An interpretable authorization device based on natural language processing, characterized in that, It includes a data preprocessing module, a severity measurement and scoring module, and an interpretability authorization module; The data preprocessing module is used to obtain labeled vulnerability descriptions and their corresponding CVSS vectors as training data, optimize the pre-trained BERT model, and obtain a classifier that can automatically extract CVSS vectors from security vulnerability text descriptions. Then, the text description of a target security vulnerability is input into the classifier to predict the CVSS vector corresponding to the target security vulnerability; The severity measurement and scoring module is used to calculate the severity score of the target security vulnerability based on the predicted CVSS vector, and adjust the user's authorization level based on the severity score. The interpretability authorization module is used to analyze the vocabulary in the text description of the target security vulnerability using a gradient-based input saliency method, and obtain the key words in the CVSS vector corresponding to the target security vulnerability predicted by the classifier as keywords; then, based on the adjusted user authorization level and the keywords, it generates the authorization adjustment interpretability text corresponding to the target security vulnerability.

8. A server, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing each step of the method of any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images