Non-trigger word event detection method for network security text

Abstract

The invention discloses a non-trigger word event detection method for a network security text. The method comprises the steps of data preprocessing; extracting semantic features of the text; syntactic features are extracted; calculating syntactic features; and detecting a network security event and the like. The method has the advantages that related problems of event detection tasks in the field of network security are solved, statements containing predefined network security event types can be recognized without the help of trigger words, main contents of network threat related texts can be helped to be understood, and the network threat related event detection efficiency is improved. And a basic method and technical support can be provided for subsequent tasks such as information extraction.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security event detection, and in particular relates to a method for detecting trigger-free events for network security texts. Background Art

[0002] With the continuous evolution of the Internet environment, cyber attacks and criminal acts are increasing, posing severe security challenges to national security, social interests and personal privacy. Currently, using multi-source data to identify unknown cyber attacks has become a hot research trend in the field of threat detection. In recent years, many studies have focused on the in-depth analysis of intelligence texts related to cyber threats, including the extraction of attackers' tactics, techniques and procedures (TTPs), cyber threat intelligence entity recognition, relationship extraction, knowledge graph construction and event detection. How to effectively extract valuable information related to cyber threats from massive text data has become a hot issue of common concern in academia and industry.

[0003] Event detection is a key task in the field of natural language processing (NLP). It aims to determine whether a text contains a specific type of event. It is one of the subtasks of event extraction in the field of information extraction. Most existing event detection methods focus on event detection based on trigger words. However, the workload of trigger word tagging is large, and the existing event detection methods are insufficient in feature extraction capabilities for texts in the field of network security. Summary of the invention

[0004] In order to solve the above problems, the purpose of the present invention is to provide a method for detecting non-trigger word events in network security texts.

[0005] In order to achieve the above object, the method for detecting non-trigger word events in network security text provided by the present invention comprises the following steps performed in sequence:

[0006] 1) S1 stage of data preprocessing: obtaining a sentence to be detected, and then concatenating the sentence with a cybersecurity event description sentence corresponding to each predefined type to form an instance text, and then marking the instance text according to whether the sentence contains a cybersecurity event of the predefined type to obtain a marked instance text;

[0007] 2) S2 stage of extracting text semantic features: The above-mentioned marked instance text is used as the input of the EDWTS (SecureBERT-based trigger-free event detection) model, and the SecureBERT pre-trained model in the EDWTS model is used to extract the text semantic features in the network security field in the instance text, and obtain the word vector representation of the instance text;

[0008] 3) S3 stage of extracting syntactic features: Analyze the syntactic structure of each sentence in the above example text, obtain the corresponding syntactic dependency information, and then generate the syntactic dependency tree of the sentence and represent it with an adjacency matrix;

[0009] 4) S4 stage of calculating syntactic features: Based on the word vector representation obtained in step 2) and the adjacency matrix obtained in step 3), the final vector representation of the sentence of the instance text is obtained using a graph convolutional network;

[0010] 5) S5 stage of detecting network security events: The final vector representation of the sentence obtained in step 4) is input into the binary classification event detector in the EDWTS model for detection to determine whether the instance text contains a predefined type of network security event, thereby realizing event detection of network security text.

[0011] In step 1), the method for performing data preprocessing is as follows:

[0012] In order to transform the multi-label classification problem of sentences into multiple binary classification problems, we first obtain the sentences to be tested, which can be expressed as:

[0013] S = {s0, s1, ..., s n}

[0014] Among them, S is the sentence to be tested, s 0：n is the sequence of words of the sentence;

[0015] Then, the sentence S is concatenated with the network security incident description sentence corresponding to each predefined type t to form an instance text;

[0016] The network security event description statement of the predefined type t is expressed as:

[0017]

[0018] Where E is a network security event description statement of predefined type t, is a word sequence of a network security incident description sentence of predefined type t;

[0019] The example text is represented as:

[0020]

[0021] Where T is the instance text, c i It is a special symbol of the SecureBERT pre-trained model in the EDWTS model. The beginning and end of a sentence are separated by a special symbol [CLS], and two sentences are separated by a special symbol [SEP];

[0022] Then, the instance text T is marked according to whether the statement S contains the network security event of the predefined type t; if the statement S contains the network security event of the predefined type t, the instance text is marked as 1, otherwise it is marked as 0;

[0023] For example, assuming there are three predefined types of network security events, represented by t1, t2 and t3 respectively, then statement S will generate three corresponding instance texts, and the instance texts will be marked as 1 or 0 depending on whether statement S contains a network security event of the predefined type t.

[0024] In step 2), the method for extracting text semantic features is as follows:

[0025] The labeled instance text obtained in step 1) is input into the SecureBERT pre-trained model in the EDWTS model. The 12 hidden layers and 12 attention heads of the SecureBERT pre-trained model are used to extract the text semantic features in the field of network security. The hidden state vector of the last layer is used to represent each word in the sentence to obtain the word vector representation of the instance text. The formula is:

[0026] X=SecureBERT(T)

[0027] Where X = {x0, x1, ..., x n} is the word vector representation corresponding to the instance text; the word vector representation calculated by the above formula is a word vector set, x n is the word vector corresponding to each word.

[0028] In step 3), the method for extracting syntactic features is as follows:

[0029] First, the Stanford Core NLP toolkit is used to analyze the syntactic structure of each sentence in the example text, obtain the syntactic dependency information of the sentence, and then generate the syntactic dependency tree of the sentence; then, a directed edge is added from each node to itself, so as to convert the syntactic dependency tree of the sentence into a syntactic dependency graph, where each word in the sentence is a node and the syntactic relationship between words is an edge; then the syntactic dependency graph is represented as an adjacency matrix The nodes represent words, and the edges represent the dependencies between words. If there is an edge between nodes i and j, then the adjacency matrix A ij =1: Otherwise, the adjacency matrix Aij =0.

[0030] In step 4), the specific method of calculating the syntactic features is as follows:

[0031] I) Use the adjacency matrix of the syntactic dependency graph obtained in step 3) to define the propagation mechanism of the graph convolutional network. The calculation formula for each convolution operation of the graph convolutional network is:

[0032]

[0033] Among them, H (l) is the node feature matrix of the lth layer, H (l-1) The node feature matrix of the l-1th layer, It is the adjacency matrix A plus the adjacency matrix after the self-loop; is the adjacency matrix after adding self-loops The degree matrix, W (l) is the weight matrix of the lth layer, σ is the nonlinear activation function, and ReLU is used as the activation function here;

[0034] Use the word vector representation obtained in step 2) as the initial node feature of the graph convolutional network to initialize the node feature matrix H L ;

[0035] II) After propagating through the l-layer graph convolutional network, the final feature representation H of each node is obtained L , and then use the maximum pooling operation shown in the following formula to aggregate the final feature representations of all nodes, and select the maximum value from the final feature representation of each node to generate the final vector representation h of the instance text f , the calculation formula is:

[0036] h f =Maxpooling(H L )

[0037] Among them, Maxpooling is the maximum pooling operation.

[0038] In step 5), the specific method of detecting network security events is as follows:

[0039] I) The final vector representation of the sentence obtained in step 4) is h f Input the binary classification event detector in the EDWTS model, which classifies the instance text to determine whether each sentence contains a network security incident.

[0040] The binary event detector is a binary classifier composed of a fully connected neural network layer and a sigmoid activation function; the final vector representation of the input sentence is h fAfter passing through a fully connected neural network and a sigmoid activation function, the binary classifier will output a detection probability value for a network security event category, calculated as:

[0041] o=σ(U·h f )

[0042] Among them, U is a trainable weight matrix;

[0043] The above detection probability value is used to determine whether the instance text contains a predefined type of network security incident; for a given instance text, the EDWTS model will assign a label based on the detection probability value O , if the detection probability value o is less than 0.5, the label is 0, otherwise it is 1;

[0044]

[0045] Finally, a binary value of 1 or 0 is output, indicating whether the instance text contains a predefined type of cybersecurity incident.

[0046] The beneficial effects of the present invention are: it aims to solve the related problems of event detection tasks in the field of network security, and can identify sentences containing predefined network security event types without the help of trigger words, which can not only help understand the main content of network threat-related texts, but also provide basic methods and technical support for subsequent tasks such as information extraction. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flow chart of the method for detecting trigger-word-free events in network security text provided by the present invention.

[0048] Figure 2 This is a framework diagram of the trigger-free event detection model based on SecureBERT in the present invention.

[0049] Figure 3 This is a flowchart of the syntactic dependency analysis in the present invention. DETAILED DESCRIPTION

[0050] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but the following embodiments are by no means intended to limit the present invention in any way.

[0051] like Figure 1 As shown, the event detection method for network security text provided by the present invention includes the following steps performed in sequence:

[0052] 1) S1 stage of data preprocessing: obtaining a sentence to be detected, and then concatenating the sentence with a cybersecurity event description sentence corresponding to each predefined type to form an instance text, and then marking the instance text according to whether the sentence contains a cybersecurity event of the predefined type to obtain a marked instance text;

[0053] 2) S2 stage of extracting text semantic features: The above-mentioned marked instance text is used as the input of the EDWTS (SecureBERT-based trigger-free event detection) model, and the SecureBERT pre-trained model in the EDWTS model is used to extract the text semantic features in the network security field in the instance text, and obtain the word vector representation of the instance text;

[0054] 3) S3 stage of extracting syntactic features: Analyze the syntactic structure of each sentence in the above example text, obtain the corresponding syntactic dependency information, and then generate the syntactic dependency tree of the sentence and represent it with an adjacency matrix;

[0055] 4) S4 stage of calculating syntactic features: Based on the word vector representation obtained in step 2) and the adjacency matrix obtained in step 3), the final vector representation of the sentence of the instance text is obtained using a graph convolutional network;

[0056] 5) S5 stage of detecting network security events: The final vector representation of the sentence obtained in step 4) is input into the binary classification event detector in the EDWTS model for detection to determine whether the instance text contains a predefined type of network security event, thereby realizing event detection of network security text.

[0057] In step 1), the method for performing data preprocessing is as follows:

[0058] In order to transform the multi-label classification problem of sentences into multiple binary classification problems, we first obtain the sentences to be tested, which can be expressed as:

[0059] S = {s0, s1, ..., s n}

[0060] Among them, S is the sentence to be tested, s 0：n is the sequence of words of the sentence;

[0061] Then, the sentence S is concatenated with the network security incident description sentence corresponding to each predefined type t to form an instance text;

[0062] The network security event description statement of the predefined type t is expressed as:

[0063]

[0064] Where E is a network security event description statement of predefined type t, is a word sequence of a network security incident description sentence of predefined type t;

[0065] The example text is represented as:

[0066]

[0067] Where T is the instance text, c i It is a special symbol of the SecureBERT pre-trained model in the EDWTS model. The beginning and end of a sentence are separated by a special symbol [CLS], and two sentences are separated by a special symbol [SEP];

[0068] Then, the instance text T is marked according to whether the statement S contains the network security event of the predefined type t; if the statement S contains the network security event of the predefined type t, the instance text is marked as 1, otherwise it is marked as 0;

[0069] For example, assuming there are three predefined types of network security events, represented by t1, t2 and t3 respectively, then statement S will generate three corresponding instance texts, and the instance texts will be marked as 1 or 0 depending on whether statement S contains a network security event of the predefined type t.

[0070] In step 2), the method for extracting text semantic features is as follows:

[0071] Enter the instance text with tags obtained in step 1) into Figure 2 The SecureBERT pre-trained model in the EDWTS model shown in the figure uses the 12 hidden layers and 12 attention heads of the SecureBERT pre-trained model to extract text semantic features in the field of network security, and takes the hidden state vector of the last layer to represent each word in the sentence to obtain the word vector representation of the instance text. The formula is:

[0072] X=SecureBERT(T)

[0073] Where X = {x0, x1, ..., x n} is the word vector representation corresponding to the instance text; the word vector representation calculated by the above formula is a word vector set, x n is the word vector corresponding to each word.

[0074] In step 3), the method for extracting syntactic features is as follows:

[0075] like Figure 3As shown in the figure, the Stanford Core NLP toolkit is first used to analyze the syntactic structure of each sentence in the example text, obtain the syntactic dependency information of the sentence, and then generate the syntactic dependency tree of the sentence; then a directed edge is added from each node to itself, so as to convert the syntactic dependency tree of the sentence into a syntactic dependency graph, where each word in the sentence is a node and the syntactic relationship between words is an edge; then the syntactic dependency graph is represented as an adjacency matrix The nodes represent words, and the edges represent the dependencies between words. If there is an edge between nodes i and j, then the adjacency matrix A ij =1: Otherwise, the adjacency matrix A ij =0.

[0076] In step 4), the specific method of calculating the syntactic features is as follows:

[0077] I) Use the adjacency matrix of the syntactic dependency graph obtained in step 3) to define the propagation mechanism of the graph convolutional network. The calculation formula for each convolution operation of the graph convolutional network is:

[0078]

[0079] Among them, H (l) is the node feature matrix of the lth layer, H (l-1) The node feature matrix of the l-1th layer, It is the adjacency matrix A plus the adjacency matrix after the self-loop; is the adjacency matrix after adding self-loops The degree matrix, W (l) is the weight matrix of the lth layer, σ is the nonlinear activation function, and ReLU is used as the activation function here;

[0080] Use the word vector representation obtained in step 2) as the initial node feature of the graph convolutional network to initialize the node feature matrix H (l) ;

[0081] II) After propagating through the l-layer graph convolutional network, the final feature representation H of each node is obtained L , and then use the maximum pooling operation shown in the following formula to aggregate the final feature representations of all nodes, and select the maximum value from the final feature representation of each node to generate the final vector representation h of the instance text f , the calculation formula is:

[0082] h f =Maxpooling(H L )

[0083] Among them, Maxpooling is the maximum pooling operation.

[0084] In step 5), the specific method of detecting network security events is as follows:

[0085] I) The final vector representation of the sentence obtained in step 4) is h f Input the binary classification event detector in the EDWTS model, which classifies the instance text to determine whether each sentence contains a network security incident.

[0086] The binary event detector is a binary classifier composed of a fully connected neural network layer and a sigmoid activation function; the final vector representation of the input sentence is h f After passing through a fully connected neural network and a sigmoid activation function, the binary classifier will output a detection probability value for a network security event category, calculated as:

[0087] o=σ(U·h f )

[0088] Among them, U is a trainable weight matrix;

[0089] The above detection probability value is used to determine whether the instance text contains a predefined type of network security incident; for a given instance text, the EDWTS model will assign a label based on the detection probability value o , if the detection probability value o is less than 0.5, the label is 0, otherwise it is 1;

[0090]

[0091] Finally, a binary value of 1 or 0 is output, indicating whether the instance text contains a predefined type of cybersecurity incident.

[0092] In addition, in the network security incident detection task, the concatenation of each sentence with the predefined type of network security incident description sentence will generate a large number of non-positive samples, leading to serious class imbalance problems. The EDWTS model introduces the focal loss function for model optimization to improve the model learning effect. The Focal Loss function is a variant of the binary cross entropy loss function. It solves the class imbalance problem in the binary cross entropy loss function by changing the relative frequency of positive and negative samples and reducing the contribution weight of simple samples to improve the ability to learn complex samples. The Focal Loss calculation formula is:

[0093] Loss Focal = -α(1-P(y|x)) γ ln(P(y|x))

[0094] Among them, α∈[0,1] is a balancing factor used to balance the number of positive and negative samples; γ is a modulation coefficient used to reduce the loss of non-positive samples (simple samples) so that the model pays more attention to positive labels (difficult samples); P(y|x) is the probability that the label of sentence x is y. For example, when the modulation coefficient γ=2, the weight ratio of simple samples with a confidence of 0.9 and difficult samples with a confidence of 0.5 changes from 1∶5 in the cross entropy to 1∶25, which effectively enhances the influence of difficult samples. FocalLoss can weaken the dominant role of simple samples in the direction of gradient update and prevent the network from learning a lot of useless information.

Claims

1. A method for detecting non-trigger word events in network security text, characterized by: The method for detecting non-trigger word events for network security texts comprises the following steps performed in sequence: 1) S1 stage of data preprocessing: obtaining a sentence to be detected, and then concatenating the sentence with a cybersecurity event description sentence corresponding to each predefined type to form an instance text, and then marking the instance text according to whether the sentence contains a cybersecurity event of the predefined type to obtain a marked instance text; 2) S2 stage of extracting text semantic features: The above-mentioned labeled instance text is used as the input of the EDWTS model, and the SecureBERT pre-trained model in the EDWTS model is used to extract the text semantic features in the field of network security in the instance text, and obtain the word vector representation of the instance text; 3) S3 stage of extracting syntactic features: Analyze the syntactic structure of each sentence in the above example text, obtain the corresponding syntactic dependency information, and then generate the syntactic dependency tree of the sentence and represent it with an adjacency matrix; 4) S4 stage of calculating syntactic features: Based on the word vector representation obtained in step 2) and the adjacency matrix obtained in step 3), the final vector representation of the sentence of the instance text is obtained using a graph convolutional network; 5) S5 stage of detecting network security events: The final vector representation of the sentence obtained in step 4) is input into the binary classification event detector in the EDWTS model for detection to determine whether the instance text contains a predefined type of network security event, thereby realizing event detection of network security text.

2. The method for detecting non-trigger word events in network security text according to claim 1, characterized in that: In step 1), the method for performing data preprocessing is as follows: First, get the statement to be tested, expressed as: S={s0,s1,...,s n } Among them, S is the sentence to be tested, s 0：n is the sequence of words of the sentence; Then, the sentence S is concatenated with the network security incident description sentence corresponding to each predefined type t to form an instance text; The network security event description statement of the predefined type t is expressed as: Where E is a network security event description statement of predefined type t, is a word sequence of a network security incident description sentence of predefined type t; The example text is represented as: Where T is the instance text, c i It is a special symbol of the SecureBERT pre-trained model in the EDWTS model. The beginning and end of a sentence are separated by a special symbol [CLS], and two sentences are separated by a special symbol [SEP]; Then, the instance text T is marked according to whether the statement S contains the network security event of the predefined type t; if the statement S contains the network security event of the predefined type t, the instance text is marked as 1, otherwise it is marked as 0.

3. The method for detecting non-trigger word events in network security text according to claim 1, characterized in that: In step 2), the method for extracting text semantic features is as follows: The labeled instance text obtained in step 1) is input into the SecureBERT pre-trained model in the EDWTS model. The 12 hidden layers and 12 attention heads of the SecureBERT pre-trained model are used to extract the text semantic features in the field of network security. The hidden state vector of the last layer is used to represent each word in the sentence to obtain the word vector representation of the instance text. The formula is: X=SecureBERT(T) Where X = {x0, x1, ..., x n } is the word vector representation corresponding to the instance text; the word vector representation calculated by the above formula is a word vector set, x n is the word vector corresponding to each word.

4. The method for detecting non-trigger word events in network security text according to claim 1, characterized in that: In step 3), the method for extracting syntactic features is as follows: First, the StanfordCoreNLP toolkit is used to analyze the syntactic structure of each sentence in the example text, obtain the syntactic dependency information of the sentence, and then generate the syntactic dependency tree of the sentence; Then, a directed edge is added from each node to itself, so as to convert the syntactic dependency tree of the sentence into a syntactic dependency graph, where each word in the sentence is a node and the syntactic relationship between words is an edge. The syntactic dependency graph is then represented as an adjacency matrix The nodes represent words, and the edges represent the dependencies between words. If there is an edge between nodes i and j, then the adjacency matrix A ij =1: Otherwise, the adjacency matrix A ij =0.

5. The method for detecting non-trigger word events in network security text according to claim 1, characterized in that: In step 4), the specific method of calculating the syntactic features is as follows: Ⅰ) Use the adjacency matrix of the syntactic dependency graph obtained in step 3) to define the propagation mechanism of the graph convolutional network. The calculation formula for each convolution operation of the graph convolutional network is: Among them, H (l) is the node feature matrix of the lth layer, H (l-1) The node feature matrix of the l-1th layer, It is the adjacency matrix A plus the adjacency matrix after the self-loop; is the adjacency matrix after adding self-loops The degree matrix, W (l) is the weight matrix of the lth layer, σ is the nonlinear activation function, and ReLU is used as the activation function here; Use the word vector representation obtained in step 2) as the initial node feature of the graph convolutional network to initialize the node feature matrix H (l) ; II) After propagating through the l-layer graph convolutional network, the final feature representation H of each node is obtained (l) , and then use the maximum pooling operation shown in the following formula to aggregate the final feature representations of all nodes, and select the maximum value from the final feature representation of each node to generate the final vector representation h of the instance text f , the calculation formula is: h f =Maxpooling(H L ) Among them, Maxpooling is the maximum pooling operation.

6. The method for detecting non-trigger word events in network security text according to claim 1, characterized in that: In step 5), the specific method of detecting network security events is as follows: Ⅰ) The final vector representation of the sentence obtained in step 4) is h f Input the binary classification event detector in the EDWTS model, which classifies the instance text to determine whether each sentence contains a network security incident. The binary event detector is a binary classifier composed of a fully connected neural network layer and a sigmoid activation function; the final vector representation of the input sentence is h f After passing through a fully connected neural network and a sigmoid activation function, the binary classifier will output a detection probability value for a network security event category, calculated as: o=σ(U·h f ) Among them, U is a trainable weight matrix; The above detection probability value is used to determine whether the instance text contains a predefined type of network security incident; for a given instance text, the EDWTS model will assign a label based on the detection probability value o If the detection probability value o is less than 0.5, the label is 0, otherwise it is 1; Finally, a binary value of 1 or 0 is output, indicating whether the instance text contains a predefined type of cybersecurity incident.

Images