Intrusion detection rule translation and generation method and system

Abstract

The invention discloses an intrusion detection rule translation and generation method and system. The method mainly comprises the steps of data preprocessing, data labeling, knowledge graph construction, knowledge graph feature extraction, T5 model training and the like. According to the method, data preprocessing and language conversion can be carried out on Chinese description, the Chinese description is converted into a knowledge graph related to an intrusion detection rule, rule forms such as a snort rule and a yaa rule can be analyzed, and the rule forms are mapped into the same knowledge graph; and extracting and integrating the features of the knowledge graphs by using a graph neural network, and training a T5 model in combination with a multi-task learning method, thereby further improving the precision and efficiency of rule translation and generation. The method supports generation of intrusion detection rules according to Chinese description, realizes conversion and translation of rules in different formats, and is suitable for various intrusion detection related systems.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a system and method for translating and generating intrusion detection rules. Background Art

[0002] (1) A relatively close patent: A method and device for generating SQL statements in Chinese natural language (CN202410076600). This patent provides a method for generating SQL statements in Chinese natural language: first, the text features of Chinese questions are obtained through a cross-language learning model; semantic role analysis is performed on the text of the Chinese questions to obtain semantic role embedding features; the text features, semantic role embedding features and database schema are spliced ​​to obtain splicing features; the splicing features are encoded by an encoder to obtain joint encoding features of the Chinese questions and database schemas, and finally the joint encoding features are decoded by a decoder to obtain the SQL statement corresponding to the Chinese questions.

[0003] (2) A relatively similar paper: Research on the intrusion detection rule generation method based on variant attacks on industrial control networks. This paper provides an intrusion detection rule generation method based on genetic algorithms; it deeply analyzes the Modbus TCP protocol and obtains the key field information of each layer of the protocol message from the network layer, transport layer, and application layer; it calculates the individual fitness value by defining four indicators (complete rule matching, incomplete rule matching, syntax checking, and attack variant characteristics) and optimizes the generated rule set; finally, based on the proposed rule generation method, it designs and implements an industrial control intrusion detection system, and demonstrates the effectiveness of the method through comparative experiments.

[0004] The shortcomings of the above technologies are:

[0005] (1)Poor versatility

[0006] Chinese natural language SQL generation method: mainly targets a specific language (Chinese) and a specific application scenario (SQL generation), and cannot be widely applied to other languages ​​or different types of rule generation.

[0007] Intrusion detection rule generation method based on variant attacks on industrial control networks: mainly targets specific protocols (such as Modbus TCP) and industrial control network environments, and has poor versatility.

[0008] (2) High time resource cost

[0009] Chinese natural language SQL generation method: The processes of semantic role analysis, cross-language learning, encoding and decoding are complex, time-consuming, and consume a lot of computing resources, and may not be suitable for real-time applications.

[0010] Intrusion detection rule generation method based on variant attacks on industrial control networks: Deep analysis of protocols and application of genetic algorithms for optimization require a lot of computing resources and time, and the performance of real-time detection is limited.

[0011] (3) High complexity

[0012] Chinese natural language SQL generation method: It involves multiple technologies, including semantic role analysis, cross-language learning models, encoding and decoding. The overall method is complex and difficult to develop and maintain.

[0013] Intrusion detection rule generation method based on variant attacks on industrial control networks: It requires in-depth analysis of the protocol and the design of multiple indicators for optimization. The overall process is complex and the algorithm implementation and optimization are difficult.

[0014] (4) Strong data dependence

[0015] Chinese natural language SQL generation method: It requires a large amount of labeled data, especially paired data of Chinese questions and corresponding SQL statements, and the cost of data acquisition and labeling is high.

[0016] Intrusion detection rule generation method based on variant attacks on industrial control networks: requires a large amount of network traffic data and labeled data for training and verification, and data acquisition is difficult.

[0017] (5) Accuracy and robustness issues

[0018] Chinese natural language SQL generation method: The generated SQL statements may not be accurate enough or meet the user's intentions, especially when processing complex queries, the model's robustness may be poor.

[0019] Intrusion detection rule generation method based on variant attacks on industrial control networks: The generated rules may not cover all variant attacks, and the robustness and accuracy of the rules may be limited. Summary of the invention

[0020] The present disclosure provides a method and system for rule translation and generation, which supports the generation of intrusion detection rules based on Chinese descriptions, and realizes the conversion and translation of rules in different formats, and is applicable to a variety of intrusion detection related systems. The method defines a labeling system that conforms to the intrusion detection rules in the field of network security, and can perform data preprocessing and language conversion on the Chinese descriptions, and convert them into a knowledge graph related to intrusion detection rules; and can parse rule forms such as snort rules, yara rules, etc., and map them to the same knowledge graph; and then use the graph neural network (GCNN) to extract the features of these knowledge graphs and integrate them, and combine the multi-task learning method to train the T5 (Text-To-Text Transfer Transformer) model to further improve the accuracy and efficiency of rule translation and generation.

[0021] The intrusion detection rule translation and generation method provided by the present disclosure comprises the following steps:

[0022] S1, data preprocessing, including: one or more of data cleaning, text standardization, word segmentation, stop word removal, and stem extraction;

[0023] S2, data annotation, including:

[0024] Semantic annotation: add semantic tags to keywords and terms in Chinese descriptions and rules;

[0025] Entity recognition: identifying and annotating entities in descriptions and rules;

[0026] Relation annotation: Annotate the relational structure in descriptions and rules;

[0027] Standardization of annotation formats;

[0028] S3, knowledge graph construction: Analyze and structure the Chinese descriptions and intrusion detection rules, integrate them into a unified knowledge graph, and build a knowledge graph containing rule features, attributes, and relationships;

[0029] S4, knowledge graph feature extraction: use graph convolutional network to extract features from rule knowledge graph;

[0030] S5, uses the T5 model for multi-task learning to simultaneously achieve the tasks of rule translation and rule generation.

[0031] Furthermore, the specific method of step S3 includes:

[0032] S31, defines the rule knowledge graph of intrusion detection, where:

[0033] Entities, including: protocol type, protocol variables, variable values, common attack attributes;

[0034] Entity attributes, including: Chinese definition, entity name, corresponding entity id, default port number used by the protocol, regular expression, value type, value variable offset;

[0035] The relationship between entities, including: protocol variables included in the protocol type, logical relationships between variables or variable values, conditional relationships between variables and values, and extended relationships between values ​​and attack attributes;

[0036] S32, constructing a rule knowledge graph, including the following steps:

[0037] (1) Parsing Chinese descriptions and rules

[0038] Parse the Chinese descriptions and rules, extract the entities, operations and relationships, and convert them into node and edge representations;

[0039] Entity extraction: identifying key entities in Chinese descriptions and rules;

[0040] Value extraction: extracting specific values ​​from descriptions and rules;

[0041] Relation extraction: identifying relation types in descriptions and rules;

[0042] (2) Mapping and integration

[0043] Map different types of rules to the unified data model of the knowledge graph to ensure unified representation and management of rules;

[0044] (3) Knowledge Graph Generation

[0045] Convert the extracted entities, values, and relations into nodes and edges of the knowledge graph, including:

[0046] Node creation: Create corresponding nodes for each extracted entity and value;

[0047] Edge creation: Create corresponding edges for each extracted relationship;

[0048] Semantic labeling: Synchronize the labels in the previous module to the attributes of the corresponding nodes in the generated knowledge graph.

[0049] Furthermore, the value of each entity defined in step S31 specifically includes:

[0050] Protocol type, which can be one or more of HTTP, TCP, and DNS.

[0051] Protocol variable, the value includes one or more of Url, Method, Payload, and Dns_Name;

[0052] Variable value, the value includes: string or numeric type;

[0053] Common attack attributes. The value includes one or more of Sqli, Xss, and Command.

[0054] Furthermore, the specific method of step S4 includes:

[0055] S41, taking the feature matrix and adjacency matrix constructed based on the knowledge graph generated in step S3 as input data;

[0056] S42, using graph convolutional network GCN to extract features from rule knowledge graph, wherein a two-layer GCN structure is used for feature extraction at different levels: the first layer is used to extract the relationship features between protocol variables and protocol variables, and the second layer is used to extract the relationship features between protocol variables and corresponding variable values;

[0057] S43, the regular knowledge graph features extracted by the two layers of GCN are input into the fully connected layer, and the high-dimensional features extracted from GCN are reduced in dimension and nonlinearly transformed to generate a feature representation Z that is more suitable for subsequent tasks:

[0058] Z = ReLU(H (2) ·W+b)

[0059] Among them, W is the weight matrix of the fully connected layer, H (2) is the output feature matrix of the second layer, and b is the bias vector of the fully connected layer;

[0060] S44, feature conversion: Use a simplified sequence-to-sequence Seq2Seq model to convert the feature vector processed by the fully connected layer into a text sequence suitable for T5 model training.

[0061] Furthermore, the feature extraction process of each layer of GCN in step S42 includes:

[0062] In the first GCN hidden layer, the initial feature matrix X and adjacency matrix A of the node are input into GCN, and feature extraction is performed through the convolution operation of GCN. At the same time, the edge weight matrix W and edge type matrix T are introduced, both of size N×N, which are used to give different types of edges different weights and encoding information during the convolution process, and finally obtain the node feature matrix H (1) , the specific formula is as follows:

[0063] D ii =∑ j A ij

[0064]

[0065] Where: D is the degree matrix, is the normalized adjacency matrix, W (0) is the weight matrix of the first layer, σ is the activation function, and T is the edge type matrix;

[0066] In the second GCN hidden layer, the specific formula is as follows:

[0067]

[0068] Where: W (1) is the weight matrix of the first layer, H (1) is the output feature matrix of the first layer, σ is the activation function, and T is the edge type matrix.

[0069] Furthermore, in step S44, the simplified sequence-to-sequence Seq2Seq model consists of a direct decoder part, and the specific formula is as follows:

[0070] y t =Decoder(Z i ,y t-1 )

[0071] Among them: Z is the feature output after the previous step through the GCN hidden layer and the fully connected layer, y t-1 is the output of the decoder at time step t-1; y t is the output of the decoder at time step t;

[0072] During training, the Seq2Seq model optimizes parameters by maximizing the likelihood function of the training data. Assuming that the training data contains the input sequence, the loss function is:

[0073]

[0074] Where: L is the total loss, T is the length of the output sequence, y t-1 is the output of the decoder at time step t-1; y t is the output of the decoder at time step t and Z is the input vector.

[0075] Furthermore, the step S5 specifically includes:

[0076] S51, data preparation: by applying appropriate prefix identifiers, different task types are divided, so as to integrate and segment the overall data set of the system;

[0077] S52, model training: Use the feature vector of the input data with prefix to train the T5 model. The training objectives include two tasks: rule generation and rule translation. The loss function formula is as follows:

[0078]

[0079] where yi is the true target output, is the predicted output of the model;

[0080] S53, Model Application: Apply the trained T5 model to real input data to generate and translate intrusion detection rules.

[0081] The translation and generation system of intrusion detection rules using the above method mainly includes: data preprocessing module, data annotation module, knowledge graph construction module, knowledge graph feature extraction module, T5 model training module, among which:

[0082] Data preprocessing module, including: one or more of data cleaning, text standardization, word segmentation, stop word removal, and stem extraction submodules;

[0083] Data annotation module, including the following submodules: semantic annotation, entity recognition, relationship annotation, and annotation format standardization;

[0084] The knowledge graph construction module is used to analyze and structure Chinese descriptions and intrusion detection rules, integrate them into a unified knowledge graph, and construct a knowledge graph containing rule features, attributes, and relationships;

[0085] The knowledge graph feature extraction module is used to extract features from the rule knowledge graph using a graph convolutional network;

[0086] The T5 model training module is used to perform multi-task learning using the T5 model to simultaneously achieve the tasks of rule translation and rule generation.

[0087] Compared with the prior art, the beneficial effects of the present invention are:

[0088] 1) By introducing the annotation system when constructing the knowledge graph, the system's ability to understand the semantics and structure of rules is further enhanced, making the translation and generation process of rules in the intrusion detection field more accurate and reliable, and improving the system's intelligent processing level and application scope.

[0089] 2) Convert Chinese descriptions and various rules into a unified knowledge graph and use graph neural networks to extract features, making the overall method simpler and more intuitive. Compared with the multi-technical interweaving and algorithmic complexity of existing methods, it reduces the difficulty of development and maintenance and improves overall efficiency.

[0090] 3) Integrating the information of the knowledge graph into model training can capture the associations and semantic relationships between rules and provide richer contextual information than simple text input; it can provide additional semantic and structural information to improve the model's understanding and accuracy of rule generation and conversion.

[0091] 4) This method uses graph embedding to extract knowledge graph features and generate useful node embedding and graph structure information. This feature representation is usually richer and more accurate than pure text features. The knowledge graph features are converted into feature vectors that can be input into the T5 model using the sequence model.

[0092] 4) This method uses the T5 model as the core, unifies the processing framework of different languages ​​and different types of rules, and has a wider applicability. Compared with specific languages ​​or application scenarios, it can handle multiple languages ​​and rule formats, thereby improving the versatility and flexibility of the system.

[0093] 5) By utilizing the pre-training capability of the T5 model, the reliance on large amounts of labeled data is reduced. The system can be trained with a small amount of labeled data, and the generalization capability of the model is improved through multi-task learning, which reduces the cost of data acquisition and labeling. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present disclosure.

[0095] Figure 1 is an overall flow chart of an exemplary embodiment according to the present disclosure;

[0096] Figure 2 is a rule knowledge graph structure diagram according to an exemplary embodiment of the present disclosure;

[0097] Figure 3 The present invention is a flowchart of rule knowledge graph feature extraction according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0098] The preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0099] The present disclosure provides a method and system for translating and generating intrusion detection rules based on a knowledge graph, which can generate rules in a specific format according to Chinese descriptions and can realize mutual conversion of different rule forms.

[0100] The main points of the plan include:

[0101] 1. The key point of knowledge graph construction based on intrusion detection rules is that it can customize the rule knowledge graph based on the expert experience of intrusion detection, including:

[0102] 1) Analyze the key expressions in the rules based on expert experience, obtain the nodes such as protocol variables and protocol variable values, the corresponding attributes, and extract the logical relationships, conditional relationships and other relationships between the nodes as the edges of the knowledge graph.

[0103] 2) For common attack patterns (such as SQL injection), the Chinese description is usually broad (such as "SQL injection"), and the description of the same attack may be different between different rules. This system unifies these descriptions and extracts the corresponding rule attribute nodes. For common attack forms, such as SQL injection, the Chinese description of attacks is often broad, such as "SQL injection", and different rules may have different description forms. This system unifies this situation and extracts the rule attribute nodes.

[0104] 2. Feature extraction of knowledge graphs through graph convolutional networks (GCNs), the key points of which include:

[0105] 1) Encode node attributes and edge relationships into vectors to capture the complex structure and semantic information in the graph. In particular, the encoding of edge weights and edge types enables GCN to better handle different types of relationships.

[0106] 2) A two-layer GCN structure is adopted, in which the first layer focuses on extracting the relationship features between protocol variables, and the second layer focuses on the relationship features between protocol variables and their variable values. This can deeply mine information at different levels, thereby improving the accuracy of feature extraction.

[0107] 3) During the feature extraction process, the feature representations of each layer are fused for subsequent processing and modeling.

[0108] In an exemplary embodiment, the overall process is as shown in the attached Figure 1 As shown, the following steps are included:

[0109] 1. Data preprocessing

[0110] This method includes data cleaning, text standardization, word segmentation, stop word removal, stem extraction and other steps, and is optimized specifically for the characteristics of Chinese descriptions and intrusion detection rules. It includes the following steps:

[0111] (1) Data cleaning: Perform data cleaning on Chinese descriptions and intrusion detection rules to remove or correct noise, null values, duplicate values, and outliers in the data. For example, process spelling errors, extra spaces, and special characters in the description to ensure data quality and consistency.

[0112] (2) Text standardization: Standardize Chinese descriptions and rules, including converting full-width characters to half-width characters, traditional Chinese to simplified Chinese, and capital letters to lowercase letters, etc. Ensure the consistency of data in format and style for subsequent processing.

[0113] (3) Word segmentation: Use natural language processing techniques to perform word segmentation on Chinese descriptions, dividing continuous text into independent words or phrases. For example, use Chinese word segmentation tools such as jieba and THULAC to extract key terms and phrases in the description.

[0114] At the same time, parse and decompose the key parts in the rules for subsequent feature extraction and mapping.

[0115] (4) Stop word removal: In the Chinese description after word segmentation, remove common meaningless words (such as "de", "le", "zai", etc.) and common stop words to reduce the interference of irrelevant information on model training. For the rule part, remove comments and irrelevant content to ensure that the extracted features are more representative and effective.

[0116] (5) Stem extraction: Perform stem extraction to normalize different forms of the same word (such as different tenses of verbs, singular and plural forms of nouns) to the stem. For example, normalize "baohan" and "baohan le" to "baohan" to improve the unity of features and the generalization ability of the model. For the rule part, perform standardization and normalization processing to ensure the consistency of different rules in structure and content.

[0117] 2. Data annotation

[0118] This method includes steps such as semantic annotation, entity recognition, relationship annotation, and key feature annotation of Chinese descriptions and intrusion detection rules to ensure that the data has high-quality semantic information during the construction of the knowledge graph and model training.

[0119] (1) Semantic annotation: Add semantic tags to keywords and terms in Chinese descriptions and rules to ensure that the system can understand and process the meanings of different descriptions and rules.

[0120] (2) Entity recognition: Identify and annotate entities in descriptions and rules, such as URLs, IP addresses, port numbers, file names, etc. Ensure that each entity has a clear representation in the knowledge graph.

[0121] (3) Relationship annotation: Annotate the relationships in descriptions and rules, such as inclusion relationships and logical relationships between entities. Ensure that the knowledge graph can accurately reflect the relationship structure in descriptions and rules.

[0122] (4) Standardized annotation format: Ensure that all annotations follow a unified format and specification to facilitate subsequent processing and conversion. Use standard formats such as XML or JSON for annotation to facilitate parsing and processing.

[0123] 3. Knowledge Graph Construction

[0124] This method analyzes and structures Chinese descriptions and intrusion detection rules (such as Snort, YARA, etc.), integrates them into a unified knowledge graph, and finally constructs a knowledge graph containing rule features, attributes and relationships. The knowledge graph provides structured information of the rules and enhances the system's ability to understand and process the rules.

[0125] In this embodiment, a rule knowledge graph for intrusion detection is predefined as follows:

[0126] RuleGraph=

[0127] {Protocol_Types,Protocol_variables,Attack_Attributes,Value_variables}

[0128] As attached Figure 2 The rule knowledge graph structure diagram shown lists all entities of the rule knowledge graph, all attributes of related entities, and the relationships between entities.

[0129] Table 5-1 lists the definitions of all entities, covering the common components commonly found in intrusion detection rules:

[0130] Table 5-1 Injection attack knowledge graph entity list

[0131] Entity Name definition Value Protocol_Types Protocol Type HTTP, TCP, DNS... Protocol_variables Protocol variables Url, Method, Payload, Dns_Name…… Value_variables Variable Value String, numeric type Attack_Attributes Common attack attributes Sqli, Xss, Command...

[0132] Table 5-2 lists the definitions of relevant attributes of some entities, which are mainly used to better describe and use these nodes:

[0133] Table 5-2 List of entity attributes of injection attack knowledge graph

[0134]

[0135] Table 5-3 lists the definitions of relationships between entities:

[0136] Table 5-3 List of relationships between entities in the injection attack knowledge graph

[0137]

[0138]

[0139] The following will introduce in detail how to construct the rule knowledge graph in this embodiment based on the above content:

[0140] (1) Parsing Chinese descriptions and rules

[0141] Parse the Chinese descriptions and rules, extract the entities, operations and relationships, and convert them into node and edge representations.

[0142] Entity extraction: Identify key entities in Chinese descriptions and rules. For example, for the Chinese description "URL contains the letters 'a' or 'b'", extract the entities "URL" and "letters".

[0143] Value extraction: Extract specific values ​​from descriptions and rules. For example, extract the characters "a" and "b".

[0144] Relationship extraction: Identify the relationship types in descriptions and rules. For example, identify the "contains" relationship and the "or" logical relationship.

[0145] (2) Mapping and integration

[0146] Different types of rules (such as Snort rules, YARA rules, etc.) are uniformly mapped to the unified data model of the knowledge graph to ensure unified representation and management of the rules.

[0147] Rule mapping: Through structured knowledge graph representation, unified mapping and management of different rule types can be achieved, improving the versatility and flexibility of rule processing.

[0148] (3) Knowledge Graph Generation

[0149] Convert the extracted entities, values, and relations into nodes and edges of the knowledge graph.

[0150] Node creation: Create corresponding nodes for each extracted entity and value. For example, create "URL", "Letter", "a", and "b" nodes.

[0151] Edge creation: Create corresponding edges for each extracted relationship. For example, create a "contains" relationship edge between "URL" and "a".

[0152] Semantic labeling: Synchronize the labels in the previous module to the attributes of the corresponding nodes in the generated knowledge graph.

[0153] In this embodiment, a Chinese description and two corresponding rules are output in the knowledge graph through an example, as shown below:

[0154]

[0155]

[0156]

[0157] In this way, the information in the Chinese description and the two rules (Suricata and Yara) is converted into a structured knowledge graph instance.

[0158] 4. Knowledge graph feature extraction

[0159] like Figure 3 In this embodiment, a graph convolutional network (GCN) is used to extract features from the rule knowledge graph. As a deep learning model, GCN shows significant advantages in processing graph structure data. Since the rule knowledge graph is less complex than other complex network structures, the resource requirements of using GCN are relatively low, and it can more effectively capture global information and complex dependencies between nodes, and can effectively utilize the connection relationship and global topology information between nodes, which helps to accurately capture the complex dependencies and hierarchical features in the rule knowledge graph. Compared with traditional graph embedding methods, GCN can gradually aggregate the information of neighboring nodes through multi-layer convolution operations, thereby improving the representation ability of node representation and the prediction performance of the model. This ability enables GCN to perform well in processing large-scale and complex rule knowledge graphs, and provides a solid theoretical and practical foundation for rule translation, generation and other advanced tasks. This step is mainly divided into two parts: GCN model feature extraction and feature conversion, and these two parts will be mainly introduced in detail below.

[0160] (1) GCN model extracts regular knowledge graph features

[0161] 1) Data input

[0162] The data input of this module comes from the knowledge graph generated by the previous module, including the nodes and their attributes in the rule knowledge graph, and the edges of the association relationships between them. For a knowledge graph with N nodes (due to the characteristics of the rule knowledge graph, the node range is approximately 2-50), an initial feature vector d is generated for each node. These vectors can be initialized based on various attributes of the node (such as the type of node, the text description of the node, etc.), and these initial feature vectors form an N×d feature matrix X. Next, an adjacency matrix A is constructed to represent the connection relationship between nodes. The adjacency matrix A is an N×N matrix, where A_ij=1 indicates that there is an edge between node i and node j, and A_ij=0 indicates that there is no edge between node i and node j.

[0163] 2) Two GCN hidden layers

[0164] In this embodiment, a graph convolutional network (GCN) is used to extract features from the rule knowledge graph. Preferably, the model adopts a two-layer GCN structure, which focuses on feature extraction at different levels. The first layer mainly extracts the relationship features between protocol variables and protocol variables, and the second layer extracts the relationship features between protocol variables and corresponding variable values. The purpose of this design is to make full use of the hierarchical structure of the rule knowledge graph to ensure that the model can more comprehensively capture feature information at different levels.

[0165] In the first GCN hidden layer, the initial feature matrix X and adjacency matrix A of the node are input into GCN, and feature extraction is performed through the convolution operation of GCN. At the same time, the edge weight matrix W and edge type matrix T are introduced, both of size N×N, which are used to give different types of edges different weights and encoding information during the convolution process, and finally obtain the node feature matrix H (1) Since the goal of the first layer of GCN is to focus on extracting the relationship features between protocol variables, the weights of the edges between protocol variables in the adjacency matrix A are increased to a certain extent, and the corresponding edge weight matrix W and edge type matrix T are also increased synchronously. The specific formula is as follows:

[0166] D ii =∑ j A ij

[0167]

[0168] Where: D is the degree matrix, is the normalized adjacency matrix, W (0) is the weight matrix of the first layer, σ is the activation function, the ReLU function is used here, and T is the edge type matrix.

[0169] In the second GCN hidden layer, since we need to focus on the relationship characteristics between the protocol variables and the corresponding variable values, the weights of the edges between the protocol variables and the protocol variable values ​​in the adjacency matrix A are increased to a certain extent, and the corresponding edge weight matrix W and edge type matrix T are also increased synchronously. The specific formula is as follows:

[0170]

[0171] Where: W (1) is the weight matrix of the first layer, H (1) is the output feature matrix of the first layer, σ is the activation function, the ReLU function is used here, and T is the edge type matrix.

[0172] 3) Fully connected layer

[0173] After the two layers of GCN extract regular knowledge graph features, these features are input into the fully connected layer for further processing. The main purpose of the fully connected layer is to reduce the dimension and perform nonlinear transformation on the high-dimensional features extracted from GCN, so as to generate a feature representation Z that is more suitable for subsequent tasks.

[0174] Z = ReLU(H (2) ·W+b)

[0175] Where: W is the weight matrix of the fully connected layer, H (2) is the output feature matrix of the first layer, and b is the bias vector of the fully connected layer.

[0176] (2) Feature conversion

[0177] After the fully connected layer processes the feature vectors, a simplified sequence-to-sequence (Seq2Seq) model is used to convert these feature vectors into text sequences suitable for T5 model training. This step is very important for converting the feature vector representation into a readable text description so that the features can be used by subsequent models for generation or translation tasks. The simplified Seq2Seq model consists of a direct decoder part, and the specific formula is as follows:

[0178] y t =Decoder(Z i ,y t-1 )

[0179] Among them: Z is the feature output after the previous step through the GCN hidden layer and the fully connected layer, y t-1 is the output of the decoder at time step t-1; y t is the output of the decoder at time step t.

[0180] During training, the Seq2Seq model optimizes parameters by maximizing the likelihood function of the training data. Assume that the training data contains the input sequence:

[0181]

[0182] Where: L is the total loss, T is the length of the output sequence, y t-1 is the output of the decoder at time step t-1; y t is the output of the decoder at time step t and Z is the input vector.

[0183] 5.T5 model training

[0184] In this embodiment, the T5 model is used for multi-task learning to simultaneously achieve the tasks of rule translation and rule generation. Multi-task learning can not only effectively reduce the complexity of model training, but also improve the overall performance of the model by sharing information between different tasks.

[0185] (1) Data preparation

[0186] At present, the overall data set of the system is Chinese and its corresponding two rules. In order to achieve the key effect of multi-task learning, it is necessary to integrate and segment the data set, and divide different task types through appropriate prefix identifiers. The following table defines four tasks and their prefix identifiers:

[0187] Task Name Prefix ID Translation of Suricata rules to Yara rules translate:S2Y Translation of Yara rules to Suricata rules translate:Y2S Chinese description to Suricata rule generation Generate:C2S Chinese description to Yara rule generation Generate:C2YS

[0188] (2) Model training

[0189] The T5 model is trained using the feature vector of the input data with prefixes. The model optimizes the task-specific loss function during training to minimize the gap between the predicted output and the true target. The training objectives include two tasks: rule generation and rule translation. The loss function formula is as follows:

[0190]

[0191] where y i is the true target output, is the predicted output of the model.

[0192] (3) Model application

[0193] After completing the model training, the actual application of rule translation and rule generation tasks will be carried out. The main task of the model application phase is to apply the trained T5 model to real input data to generate and translate intrusion detection rules.

[0194] Correspondingly, the translation and generation system of intrusion detection rules using the above method includes: a data preprocessing module, a data annotation module, a knowledge graph construction module, a knowledge graph feature extraction module, and a T5 model training module (rule translation module, rule generation module).

[0195] Compared with the prior art, the beneficial effects of the present invention are:

[0196] By using a knowledge graph construction method specifically for intrusion detection rules, domain knowledge (such as protocol variables, attack patterns, etc.) is integrated into the model, thereby improving the model's performance in rule generation and translation tasks. The construction of the knowledge graph here does not depend on specific rules or protocols. The same construction and training method can be used for other rules, making the system applicable to various network security scenarios. The training and application of the model can cover a wide range of rules and protocol types, improving versatility.

[0197] By using graph embedding, knowledge graph features are extracted to generate useful node embedding and graph structure information. This feature representation is usually richer and more accurate than pure text features. Through feature extraction of the GCN model, useful graph embedding features can be extracted in a shorter time, reducing the time cost of deep parsing and complex calculations. The feature extraction process has been optimized and consumes less computing resources. In addition, the multi-task learning framework of the T5 model enables the model to share knowledge when processing multiple tasks, avoiding the high cost of training each task separately. Parallel computing can be fully utilized during training, further reducing time resource costs.

[0198] The above technical scheme is only an exemplary embodiment of the present invention. For those skilled in the art, it is easy to make various types of improvements or modifications based on the application methods and principles disclosed in the present invention, and it is not limited to the method described in the above specific embodiment of the present invention. Therefore, the method described above is only preferred and does not have a restrictive meaning.

Claims

1. A method for translating and generating intrusion detection rules, comprising the following steps: S1, data preprocessing, including: one or more of data cleaning, text standardization, word segmentation, stop word removal, and stem extraction; S2, data annotation, including: Semantic annotation: add semantic tags to keywords and terms in Chinese descriptions and rules; Entity recognition: identifying and annotating entities in descriptions and rules; Relation annotation: Annotate the relational structure in descriptions and rules; Standardization of annotation formats; S3, knowledge graph construction: Analyze and structure the Chinese descriptions and intrusion detection rules, integrate them into a unified knowledge graph, and build a knowledge graph containing rule features, attributes, and relationships; S4, knowledge graph feature extraction: use graph convolutional network to extract features from rule knowledge graph; S5, uses the T5 model for multi-task learning to simultaneously achieve the tasks of rule translation and rule generation.

2. The method according to claim 1, characterized in that The specific method of step S3 includes: S31, defines the rule knowledge graph of intrusion detection, where: Entities, including: protocol type, protocol variables, variable values, common attack attributes; Entity attributes, including: Chinese definition, entity name, corresponding entity id, default port number used by the protocol, regular expression, value type, value variable offset; The relationship between entities, including: protocol variables included in the protocol type, logical relationships between variables or variable values, conditional relationships between variables and values, and extended relationships between values ​​and attack attributes; S32, constructing a rule knowledge graph, including the following steps: (1) Parsing Chinese descriptions and rules Parse the Chinese descriptions and rules, extract the entities, operations and relationships, and convert them into node and edge representations; Entity extraction: identifying key entities in Chinese descriptions and rules; Value extraction: extracting specific values ​​from descriptions and rules; Relation extraction: identifying relation types in descriptions and rules; (2) Mapping and integration Map different types of rules to the unified data model of the knowledge graph to ensure unified representation and management of rules; (3) Knowledge Graph Generation Convert the extracted entities, values, and relations into nodes and edges of the knowledge graph, including: Node creation: Create corresponding nodes for each extracted entity and value; Edge creation: Create corresponding edges for each extracted relationship; Semantic labeling: Synchronize the labels in the previous module to the attributes of the corresponding nodes in the generated knowledge graph.

3. The method according to claim 2, characterized in that The value of each entity defined in step S31 specifically includes: Protocol type, which can be one or more of HTTP, TCP, and DNS. Protocol variable, the value includes one or more of Url, Method, Payload, and Dns_Name; Variable value, the value includes: string or numeric type; Common attack attributes. The value includes one or more of Sqli, Xss, and Command.

4. The method according to claim 2 or 3, characterized in that: The specific method of step S4 includes: S41, taking the feature matrix and adjacency matrix constructed based on the knowledge graph generated in step S3 as input data; S42, using graph convolutional network GCN to extract features from rule knowledge graph, wherein a two-layer GCN structure is used for feature extraction at different levels: the first layer is used to extract the relationship features between protocol variables and protocol variables, and the second layer is used to extract the relationship features between protocol variables and corresponding variable values; S43, the regular knowledge graph features extracted by the two layers of GCN are input into the fully connected layer, and the high-dimensional features extracted from GCN are reduced in dimension and nonlinearly transformed to generate a feature representation Z that is more suitable for subsequent tasks: Z=ReLU(H ⑵ ·W+b) Among them, W is the weight matrix of the fully connected layer, H( 2 ) is the output feature matrix of the second layer, and b is the bias vector of the fully connected layer; S44, feature conversion: Use a simplified sequence-to-sequence Seq2Seq model to convert the feature vector processed by the fully connected layer into a text sequence suitable for T5 model training.

5. The method according to claim 4, characterized in that The feature extraction process of each layer of GCN in step S42 includes: In the first GCN hidden layer, the initial feature matrix X and adjacency matrix A of the node are input into GCN, and feature extraction is performed through the convolution operation of GCN. At the same time, the edge weight matrix W and edge type matrix T are introduced, both of size N×N, which are used to give different types of edges different weights and encoding information during the convolution process, and finally obtain the node feature matrix H( 1 ), the specific formula is as follows: D ii =S j A ij Where: D is the degree matrix, is the normalized adjacency matrix, W (0) is the weight matrix of the first layer, σ is the activation function, and T is the edge type matrix; In the second GCN hidden layer, the specific formula is as follows: Where: W(1) is the weight matrix of the first layer, H(1) is the output feature matrix of the first layer, σ is the activation function, and T is the edge type matrix.

6. The method according to claim 4, characterized in that In step S44, the simplified Seq2Seq model consists of a direct decoder part, and the specific formula is as follows: and t =Decoder(Z i ,and t-1 ) Among them: Z is the feature output after the previous step through the GCN hidden layer and the fully connected layer, y t-1 is the output of the decoder at time step t-1; y t is the output of the decoder at time step t; During training, the Seq2Seq model optimizes parameters by maximizing the likelihood function of the training data. Assuming that the training data contains the input sequence, the loss function is: Where: L is the total loss, T is the length of the output sequence, y t-1 is the output of the decoder at time step t-1; y t is the output of the decoder at time step t and Z is the input vector.

7. The method according to claim 1, characterized in that The step S5 specifically includes: S51, data preparation: by applying appropriate prefix identifiers, different task types are divided, so as to integrate and segment the overall data set of the system; S52, model training: Use the feature vector of the input data with prefix to train the T5 model. The training objectives include two tasks: rule generation and rule translation. The loss function formula is as follows: where y i is the true target output, is the predicted output of the model; S53, Model Application: Apply the trained T5 model to real input data to generate and translate intrusion detection rules.

8. A system for translating and generating intrusion detection rules according to any one of the methods of claims 1 to 7, characterized in that: include: Data preprocessing module, data annotation module, knowledge graph construction module, knowledge graph feature extraction module, T5 model training module, The data preprocessing module includes: one or more of data cleaning, text standardization, word segmentation, stop word removal, and stem extraction submodules; The data annotation module includes the following submodules: semantic annotation, entity recognition, relationship annotation, and annotation format standardization processing; The knowledge graph construction module is used to analyze and structure the Chinese descriptions and intrusion detection rules, integrate them into a unified knowledge graph, and construct a knowledge graph containing rule features, attributes, and relationships; The knowledge graph feature extraction module is used to extract features from the rule knowledge graph using a graph convolutional network; The T5 model training module is used to perform multi-task learning using the T5 model to simultaneously achieve the tasks of rule translation and rule generation.

Images