A trigger-free event detection method for network security text

Abstract

The application discloses a network security text trigger-free event detection method, which comprises the following steps: data preprocessing, text semantic feature extraction, syntax feature extraction, syntax feature calculation and network security event detection. The application has the beneficial effects of solving the event detection task in the network security field, identifying the sentences containing the pre-defined network security event types without the help of trigger words, helping to understand the main content of the network threat related text, and providing the basic method and technical support for the subsequent information extraction task.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security event detection, and particularly relates to a network security text-oriented trigger-free event detection method. BACKGROUND

[0002] Currently, using multi-source data to identify unknown network attacks has become a hot research trend in the threat detection field. In recent years, numerous studies have focused on the in-depth analysis of network threat-related intelligence texts, which includes extracting attackers' tactics, techniques, and procedures (TTPs), network threat intelligence entity recognition, relationship extraction, knowledge graph construction, and event detection. How to effectively extract valuable information related to network threats from massive text data has become a hot issue of common concern in academia and industry.

[0003] Event detection is a key task in the field of natural language processing (NLP), aiming to determine whether a specific type of event is contained in the text, and is one of the sub-tasks of event extraction in the field of information extraction. Most existing event detection methods focus on event detection based on trigger words, but trigger word labeling is labor-intensive, and existing event detection methods lack the ability to extract features from network security professional domain texts. SUMMARY

[0004] To solve the above problems, the purpose of the present application is to provide a network security text-oriented trigger-free event detection method.

[0005] To achieve the above purpose, the network security text-oriented trigger-free event detection method provided by the present application comprises the following steps in sequence:

[0006] 1) S1 stage of data preprocessing: obtaining a sentence to be detected, then splicing the sentence with a network security event description sentence corresponding to each pre-defined type to form an instance text, and then marking the instance text according to whether the sentence contains the network security event of the pre-defined type to obtain a marked instance text;

[0007] 2) S2 stage of extracting text semantic features: taking the above marked instance text as the input of the EDWTS (SecureBERT-based trigger-free event detection) model, using the SecureBERT pre-training model in the EDWTS model to extract the text semantic features of the network security field in the instance text, and obtaining the word vector representation of the instance text;

[0008] 3) S3 stage of extracting syntax features: analyzing the syntax structure of each sentence in the above example text, obtaining the corresponding syntax dependency information, then generating the syntax dependency tree of the sentence and representing it with an adjacency matrix;

[0009] 4) S4 stage of calculating syntax features: according to the word vector representation obtained in step 2) and the adjacency matrix obtained in step 3), using a graph convolution network to obtain the final vector representation of the sentence of the example text;

[0010] 5) S5 stage of detecting network security events: inputting the final vector representation of the sentence obtained in step 4) into the binary classification event detector in the EDWTS model for detection to determine whether the example text contains a predefined type of network security event, thereby realizing event detection on network security text.

[0011] In step 1), the method of data preprocessing is as follows:

[0012] In order to convert the multi-label classification problem of the sentence into multiple binary classification problems, first obtain the sentence to be detected, denoted as:

[0013] S={s0,s1,...,s n}

[0014] Where S is the sentence to be detected, s 0：n is the word sequence of the sentence;

[0015] Then the sentence S is spliced with the network security event description sentence corresponding to each predefined type t to form an example text;

[0016] The network security event description sentence of the predefined type t is denoted as:

[0017]

[0018] Where E is the network security event description sentence of the predefined type t, is the word sequence of the network security event description sentence of the predefined type t;

[0019] The example text is denoted as:

[0020]

[0021] Where T is the example text, c i is a special symbol of the SecureBERT pre-training model in the EDWTS model, the beginning and end of the sentence are segmented using the special symbol [CLS], and the two sentences are segmented using the special symbol [SEP];

[0022] Then the instance text T is marked according to whether the sentence S contains the predefined type t of network security event; if the sentence S contains the predefined type t of network security event, the instance text is marked as 1, otherwise, it is marked as 0;

[0023] For example, assuming that there are 3 predefined types of network security events, represented by t1, t2 and t3 respectively, then the sentence S will generate corresponding three instance texts, and mark the instance texts as 1 or 0 according to whether the sentence S contains the predefined type t of network security event.

[0024] In step 2), the method for extracting text semantic features is as follows:

[0025] The instance text with labels obtained in step 1) is input into the SecureBERT pre-training model in the EDWTS model, and the text semantic features in the network security field are extracted by using 12 hidden layers and 12 attention heads of the SecureBERT pre-training model, and the hidden state vector of the last layer is taken to represent each word in the sentence, so as to obtain the word vector representation of the instance text, and the formula is:

[0026] X = SecureBERT(T)

[0027] Wherein, X = {x0, x1,..., x n} is the word vector representation corresponding to the instance text; the word vector representation calculated by the above formula is a word vector set, x n is the word vector corresponding to each word.

[0028] In step 3), the method for extracting syntax features is as follows:

[0029] First, the syntax structure of each sentence in the instance text is analyzed by using the StanfordCoreNLP tool package to obtain the syntax dependency information of the sentence, and then the syntax dependency tree of the sentence is generated; then a directed edge from itself is added to each node, so as to convert the syntax dependency tree of the sentence into a syntax dependency graph, and each word in the sentence is taken as a node, and the syntax relationship between the words is taken as an edge; then the syntax dependency graph is represented as an adjacency matrix Wherein, the node represents the word, and the edge represents the dependency relationship between the words, if there is an edge between nodes i and j, then the adjacency matrix A ij = 1: otherwise, the adjacency matrix A ij = 0.

[0030] In step 4), the specific method for calculating syntax features is as follows:

[0031] I) using the adjacency matrix of the syntax dependency graph obtained in step 3) to define the propagation mechanism of the graph convolution network, and the calculation formula of each layer convolution operation of the graph convolution network is:

[0032]

[0033] wherein H (l) is the node feature matrix of the lth layer, H (l-1) is the node feature matrix of the (l-1)th layer, is the adjacency matrix A plus the self-loop adjacency matrix; is the degree matrix of the adjacency matrix A plus the self-loop W (l) is the weight matrix of the lth layer, and σ is a nonlinear activation function, and ReLU is used as the activation function here;

[0034] The word vector representation obtained in step 2) is used as the initial node feature of the graph convolution network to initialize the node feature matrix H L ;

[0035] II) After passing through the l-layer graph convolution network, the final feature representation H L of each node is obtained, and then the final feature representation of all nodes is aggregated using the maximum pooling operation shown in the following formula, and the maximum value is selected from the final feature representation of each node to generate the sentence final vector representation h f of the instance text, and the calculation formula is:

[0036] h f =Maxpooling(H L )

[0037] wherein Maxpooling is the maximum pooling operation.

[0038] In step 5), the specific method for detecting network security events is as follows:

[0039] I) input the sentence final vector representation h f obtained in step 4) into the binary classification event detector in the EDWTS model, and classify the instance text by the binary classification event detector to determine whether each sentence contains a network security event;

[0040] The binary classification event detector is a binary classifier composed of a fully connected neural network layer and a sigmoid activation function; after inputting the sentence final vector representation h f , passing through the fully connected neural network and then through a sigmoid activation function, the binary classifier will output a detection probability value of a network security event category, and the calculation formula is:

[0041] o=σ(U·hf )

[0042] Where U is a trainable weight matrix;

[0043] The above detection probability value is used to determine whether the instance text contains a predefined type of cybersecurity event; for a given instance text, the EDWTS model will assign a label based on the detection probability value o. If the detection probability value o is less than 0.5, the label is 0; otherwise, it is 1.

[0044]

[0045] Finally, the output is a binary value of 1 or 0, indicating whether the instance text contains a predefined type of cybersecurity event.

[0046] The beneficial effects of this invention are: it aims to solve the problems related to event detection tasks in the field of network security, and can identify statements containing predefined network security event types without the aid of trigger words. This not only helps to understand the main content of network threat-related texts, but also provides basic methods and technical support for subsequent information extraction and other tasks. Attached Figure Description

[0047] Figure 1 The flowchart illustrates the method for detecting non-trigger word events in network security text provided by this invention.

[0048] Figure 2 This is a framework diagram of the triggerless word event detection model based on SecureBERT in this invention.

[0049] Figure 3 This is a flowchart of the syntactic dependency parsing process in this invention. Detailed Implementation

[0050] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but the following embodiments are by no means intended to limit the present invention.

[0051] like Figure 1 As shown, the event detection method for network security text provided by the present invention includes the following steps performed in sequence:

[0052] 1) S1 stage for data preprocessing: Obtain the statement to be detected, then concatenate the statement with the network security event description statement corresponding to each predefined type to form an instance text, and then mark the instance text according to whether the statement contains the network security event of the predefined type to obtain the marked instance text;

[0053] 2) S2 stage of extracting text semantic features: taking the above instance text with labels as the input of the EDWTS (SecureBERT-based trigger-free event detection) model, using the SecureBERT pre-training model in the EDWTS model to extract the text semantic features of the network security field in the instance text, and obtaining the word vector representation of the instance text;

[0054] 3) S3 stage of extracting syntax features: analyzing the syntax structure of each sentence in the above instance text, obtaining the corresponding syntax dependency information, then generating the syntax dependency tree of the sentence and representing it by an adjacency matrix;

[0055] 4) S4 stage of calculating syntax features: according to the word vector representation obtained in step 2) and the adjacency matrix obtained in step 3), using a graph convolution network to obtain the final vector representation of the sentence of the instance text;

[0056] 5) S5 stage of detecting network security events: inputting the final vector representation of the sentence obtained in step 4) into the binary event detector in the EDWTS model for detection, to determine whether the instance text contains a predefined type of network security event, thereby realizing event detection on the network security text.

[0057] In step 1), the method of data preprocessing is as follows:

[0058] In order to convert the multi-label classification problem of the sentence into multiple binary classification problems, first, the sentence to be detected is obtained, denoted as:

[0059] S={s0,s1,...,s n}

[0060] Wherein, S is the sentence to be detected, s 0:n is the word sequence of the sentence;

[0061] Then, the sentence S is spliced with the network security event description sentence corresponding to each predefined type t to form an instance text;

[0062] The network security event description sentence of the predefined type t is denoted as:

[0063]

[0064] Wherein, e is the network security event description sentence of the predefined type t, is the word sequence of the network security event description sentence of the predefined type s;

[0065] The instance text is denoted as:

[0066]

[0067] wherein T is the instance text, c i is a special symbol of the SecureBERT pre-training model in the EDWTS model, the beginning and end of the sentence are segmented using the special symbol [CLS], and the two sentences are segmented using the special symbol [SEP];

[0068] Then, the instance text T is marked according to whether the sentence S contains the network security event of the predefined type t; if the sentence S contains the network security event of the predefined type t, the instance text is marked as 1, otherwise, it is marked as 0;

[0069] For example, assuming that there are 3 predefined types of network security events, denoted by t1, t2 and t3 respectively, then the sentence S will generate corresponding three instance texts, and mark the instance texts as 1 or 0 according to whether the sentence S contains the network security event of the predefined type t.

[0070] In step 2), the method for extracting text semantic features is as follows:

[0071] The instance text with labels obtained in step 1) is input into the SecureBERT pre-training model in the EDWTS model as shown in Figure 2 , and the text semantic features in the network security field are extracted by using the 12 hidden layers and 12 attention heads of the SecureBERT pre-training model, the hidden state vector of the last layer is taken to represent each word in the sentence, and the word vector representation of the instance text is obtained, and the formula is:

[0072] X = SecureBETR(T)

[0073] wherein X = {x0, x1,..., x n} is the word vector representation corresponding to the instance text; the word vector representation calculated by the above formula is a word vector set, x n is the word vector corresponding to each word.

[0074] In step 3), the method for extracting syntactic features is as follows:

[0075] As shown in Figure 3 , first, the syntactic structure of each sentence in the instance text is analyzed by using the StanfordCoreNLP tool package to obtain the syntactic dependency information of the sentence, and then the syntactic dependency tree of the sentence is generated; then a directed edge from itself is added to each node, so as to convert the syntactic dependency tree of the sentence into a syntactic dependency graph, each word in the sentence is taken as a node, and the syntactic relationship between the words is taken as an edge; then the syntactic dependency graph is represented as an adjacency matrix wherein the nodes represent words and the edges represent dependency relations between words, if there is an edge between nodes i, j, then the adjacency matrix A ij = 1: otherwise, the adjacency matrix A ij = 0.

[0076] In step 4), the specific method of calculating the syntactic features is as follows:

[0077] I) using the adjacency matrix of the syntactic dependency graph obtained in step 3) to define the propagation mechanism of the graph convolution network, the calculation formula of each layer convolution operation of the graph convolution network is:

[0078]

[0079] wherein H (l) is the node feature matrix of the lth layer, H (l-1) is the node feature matrix of the (l-1)th layer, is the adjacency matrix A after adding the self-loop; is the degree matrix of the adjacency matrix A after adding the self-loop, W (l) is the weight matrix of the lth layer, and σ is a nonlinear activation function, and ReLU is used as the activation function here;

[0080] The word vector representation obtained in step 2) is used as the initial node feature of the graph convolution network to initialize the node feature matrix H (l) ;

[0081] II) After passing through the l-layer graph convolution network, the final feature representation H L of each node is obtained, and then the final feature representation of all nodes is aggregated using the maximum pooling operation shown in the following formula, and the maximum value is selected from the final feature representation of each node to generate the sentence final vector representation h f of the instance text, and the calculation formula is:

[0082] h f = Maxpooling(H L )

[0083] wherein Maxpooling is the maximum pooling operation.

[0084] In step 5), the specific method of detecting network security events is as follows:

[0085] I) inputting the sentence final vector representation h f obtained in step 4) into the binary classification event detector in the EDWTS model, and classifying the instance text by the binary classification event detector to determine whether each sentence contains a network security event;

[0086] The binary classifier is composed of a fully connected neural network layer and a sigmoid activation function; the input sentence final vector representation h f After that, the binary classifier will output a network security event category detection probability value through a sigmoid activation function after a fully connected neural network, and the calculation formula is:

[0087] o = σ(U·h f )

[0088] Where U is a trainable weight matrix;

[0089] The above detection probability value is used to determine whether the instance text contains a predefined type of network security event; for a given instance text, the EDWTS model will assign a label according to the detection probability value o If the detection probability value o is less than 0.5, the label is 0, otherwise it is 1;

[0090]

[0091] Finally, a binary value of 1 or 0 is output, indicating whether the instance text contains a predefined type of network security event.

[0092] In addition, in the network security event detection task, the splicing of each sentence with the description sentence of the predefined type of network security event will generate a large number of non-positive example samples, resulting in a serious class imbalance problem. The EDWTS model introduces the focal loss (Focal Loss) function for model optimization to improve the model learning effect. The Focal Loss function is a variant of the binary cross-entropy loss function, which changes the relative frequency of positive and negative samples and reduces the contribution weight of simple samples to solve the class imbalance problem in the binary cross-entropy loss function, to improve the ability to learn complex samples. The Focal Loss calculation formula is

[0093] Loss Focal = -α(1-P(y|x)) γ ln(P(y|x))

[0094] Where α∈[0, 1] is a balance factor used to balance the number of positive and negative samples; γ is a modulation coefficient used to reduce the loss of non-positive example samples (simple samples) so that the model pays more attention to positive example labels (difficult samples); P(y|x) is the probability that the label of sentence x is y. For example, when the modulation coefficient γ = 2, for simple samples with a confidence of 0.9 and difficult samples with a confidence of 0.5, the weight ratio changes from 1:5 in cross-entropy to 1:25, effectively enhancing the influence of difficult samples. Focal Loss can weaken the dominant role of simple samples in gradient update direction, avoiding the network from learning a large amount of useless information.

Claims

1. A method for triggerless event detection for network security text, the method comprising: The network security text-oriented trigger-free event detection method comprises the following steps in sequence: 1) S1 stage of data preprocessing: obtaining a sentence to be detected, then splicing the sentence with a network security event description sentence corresponding to each predefined type to form an instance text, and then marking the instance text according to whether the sentence contains the network security event of the predefined type, to obtain a marked instance text; 2) S2 stage of extracting text semantic features: taking the above marked instance text as the input of the EDWTS model, using the SecureBERT pre-training model in the EDWTS model to extract the text semantic features in the network security field in the instance text, and obtaining the word vector representation of the instance text; 3) S3 stage of extracting syntax features: analyzing the syntax structure of each sentence in the above instance text to obtain the corresponding syntax dependency information, and then generating the syntax dependency tree of the sentence and representing it by an adjacency matrix; 4) S4 stage of calculating syntax features: using the graph convolution network to obtain the final vector representation of the sentence of the instance text according to the word vector representation obtained in step 2) and the adjacency matrix obtained in step 3); 5) S5 stage of detecting network security events: inputting the final vector representation of the sentence obtained in step 4) into the binary event detector in the EDWTS model for detection to determine whether the instance text contains the network security event of the predefined type, so as to realize the event detection of the network security text; In step 4), the specific method of calculating syntax features is as follows: Ⅰ) using the adjacency matrix of the syntax dependency graph obtained in step 3) to define the propagation mechanism of the graph convolution network; initializing the node feature matrix H with the word vector representations obtained in step 2) as initial node features of the graph convolutional network (l) ; II) After propagating through the l-layer graph convolutional network, the final feature representation H of each node is obtained (l) Then, the final feature representation of all nodes is aggregated using the max-pooling operation, and the maximum value is selected from the final feature representation of each node to generate the sentence final vector representation h of the instance text f .

2. The network security text oriented triggerless event detection method of claim 1, wherein: In step 1), the method of data preprocessing is as follows: First, obtain the sentence to be detected, denoted as: S = {s0, s1,..., s n} wherein S is a sentence to be detected, s 0：n is a word sequence of the sentence; Then splice the sentence S with a network security event description sentence corresponding to each predefined type t to form an instance text T; The network security event description sentence of the predefined type t is denoted as: wherein E is a network security event description sentence of a predefined type t, is a sequence of words of a network security event description sentence of a predefined type t; The instance text is denoted as: Wherein, T is an instance text, c i is a special symbol of the SecureBERT pre-training model in the EDWTS model, the beginning and end of the sentence are segmented using the special symbol [CLS], and the two sentences are segmented using the special symbol [SEP]; Then mark the instance text T according to whether the sentence S contains the network security event of the predefined type t; if the sentence S contains the network security event of the predefined type t, mark the instance text as 1, otherwise mark it as 0.

3. The cyber-security text oriented triggerless event detection method of claim 1, wherein: In step 2), the method of extracting text semantic features is as follows: Input the marked instance text obtained in step 1) into the SecureBERT pre-training model in the EDWTS model, use the 12 hidden layers and 12 attention heads of the SecureBERT pre-training model to extract the text semantic features in the network security field, take the hidden state vector of the last layer to represent each word in the sentence, obtain the word vector representation of the instance text, and the formula is: X = SecureBERT(T) where X = {x0, x1,...., x n} is the word vector representation of the example text; the word vector representation calculated by the above formula is a word vector set, x n is the word vector corresponding to each word.

4. The cyber-security text oriented triggerless event detection method of claim 1, wherein: In step 3), the method of extracting syntax features is as follows: First, analyze the syntax structure of each sentence in the instance text using the StanfordCoreNLP tool package to obtain the syntax dependency information of the sentence, and then generate the syntax dependency tree of the sentence; Then a directed edge from each node to itself is added, so that the syntax dependency tree of the sentence is converted into a syntax dependency graph, each word in the sentence is a node, and the syntax relationship between the words is an edge; The syntactic dependency graph is represented as an adjacency matrix where nodes represent words and edges represent dependency relations between words. If there is an edge between nodes i, j, then the adjacency matrix A ij = 1: otherwise, the adjacency matrix A ij = 0.

5. The cyber-security text oriented triggerless event detection method of claim 1, wherein: In step 4), the calculation formula of each layer of convolution operation of the graph convolution network is as follows: where H (l) is the node feature matrix of the lth layer, H (l-1) is the node feature matrix of the (l-1)th layer, is the adjacency matrix A plus self-loops; is the adjacency matrix A plus self-loops is the degree matrix of the adjacency matrix A plus self-loops, W (l-1) is the weight matrix of the (l-1)th layer, and σ is a nonlinear activation function, where ReLU is used as the activation function. The calculation formula of the max-pooling operation is as follows: h f = Maxpooling(H L ) Wherein, Maxpooling is the max-pooling operation.

6. The cyber-security text oriented triggerless event detection method of claim 1, wherein: In step 5), the specific method for detecting the network security event is as follows: I) finalizing the sentence vector representation h obtained from step 4) f inputting the binary event detector in the EDWTS model, classifying the instance text by the binary event detector to determine whether each sentence contains a cyber security event; The binary classifier of the binary classification event detector is composed of a fully connected neural network layer and a sigmoid activation function; the input sentence final vector representation h f After that, the binary classifier outputs a network security event category detection probability value after passing through a fully connected neural network and a sigmoid activation function, and the calculation formula is: o = σ(U · h f ) Wherein, U is a trainable weight matrix. using the detection probability value to determine whether the instance text contains a predefined type of network security event; for a given instance text, the EDWTS model will assign a label according to the detection probability value o if the detection probability value o is less than 0.5, the label is 0, otherwise 1; Finally, a binary value of 1 or 0 is output, indicating whether the instance text contains a predefined type of network security event.

Images