Threat intelligence entity relationship identification method and system

Abstract

The present invention provides a threat intelligence entity relationship identification method and system, which relates to the field of computer and information security technology. The specific implementation scheme is: obtaining the atomic features of an entity pair consisting of a first entity and a second entity in a target text; combining the atomic features of the entity pair to obtain an atomic feature combination of the entity pair; using each preset entity relationship type as a relationship node, and using the atomic feature combination of the entity pair as the neighbor node of the relationship node, to construct an atomic feature combination relationship graph of the entity pair; based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair, respectively update each relationship node in the atomic feature combination relationship graph of the entity pair; based on each updated relationship node in the atomic feature combination relationship graph of the entity pair, determine the entity relationship type of the entity pair. The present invention can improve the recognition accuracy of entity relationships.

Description

Technical Field

[0001] The present invention relates to the field of computer and information security technology, and in particular to a threat intelligence entity relationship identification method and system. Background Art

[0002] In the network environment of various industries, while network technology is becoming more convenient, a large number of online businesses and information involving units, enterprises and individuals are facing various security threats such as hacker group intrusion and Trojan horse propagation. These network attacks are of various types and change rapidly, so a large amount of human and material resources are required to keep track of security threats at any time.

[0003] At present, online information platforms tend to develop in a diversified way, so that more information resources are released through the Internet, such as public accounts, forums, official websites, blogs, third-party intelligence providers, and internal security systems. In order to better improve network security, we should pay attention to new security vulnerabilities, vulnerability reports, attack patterns and other threat intelligence, and identify the latest security vulnerabilities, attack behaviors, detection reports and other threat intelligence from the text information released by various platforms. Therefore, the identification of threat intelligence entities and entity relationships is an important research topic.

[0004] However, efficient analysis and identification of entities and relationships in massive text data is a major challenge in extracting threat intelligence. It is difficult to achieve real-time updates of huge data by relying on manual processing and evaluation. In addition, unstructured text data has differences, making it difficult to extract entity and relationship information. Summary of the invention

[0005] The present invention provides a threat intelligence entity relationship identification method, device, system and storage medium, which can solve at least one of the above technical problems.

[0006] According to one aspect of the present invention, a method for identifying threat intelligence entity relationships is provided, comprising:

[0007] Acquire atomic features of an entity pair consisting of a first entity and a second entity in a target text, wherein the atomic features include left word parts of speech, right word parts of speech and position information of the first entity and the second entity in the target text, entity types of the first entity and the second entity, and relative position and similarity between the first entity and the second entity;

[0008] Combining the atomic features of the entity pair to obtain an atomic feature combination of the entity pair;

[0009] Taking each preset entity relationship type as a relationship node and taking the atomic feature combination of the entity pair as a neighbor node of the relationship node, constructing an atomic feature combination relationship graph of the entity pair;

[0010] Based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair, respectively updating each relationship node in the atomic feature combination relationship graph of the entity pair;

[0011] Based on each updated relationship node in the atomic feature combination relationship graph of the entity pair, the entity relationship type of the entity pair is determined.

[0012] According to another aspect of the present invention, a threat intelligence entity relationship identification device is provided, comprising:

[0013] an atomic feature acquisition module, used to acquire atomic features of an entity pair consisting of a first entity and a second entity in a target text, wherein the atomic features include the left word part of speech, the right word part of speech and position information of the first entity and the second entity in the target text, the entity types of the first entity and the second entity, and the relative position and similarity between the first entity and the second entity;

[0014] A feature combination module, used for combining the atomic features of the entity pair to obtain an atomic feature combination of the entity pair;

[0015] A relationship graph construction module, used to construct an atomic feature combination relationship graph of the entity pairs using preset entity relationship types as relationship nodes and atomic feature combinations of the entity pairs as neighbor nodes of the relationship nodes;

[0016] A relationship graph updating module, used for updating each relationship node in the atomic feature combination relationship graph of the entity pair based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair;

[0017] The entity relationship determination module is used to determine the entity relationship type of the entity pair based on the updated relationship nodes in the atomic feature combination relationship graph of the entity pair.

[0018] According to another aspect of the present invention, there is provided an electronic device, comprising:

[0019] at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any threat intelligence entity relationship identification method in the embodiments of the present invention.

[0022] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any threat intelligence entity relationship identification method according to the embodiments of the present invention.

[0023] By adopting the technical solution of the present invention, the atomic features of the entity pairs of the target text are combined to obtain the atomic feature combination of the entity pairs, wherein the atomic features include the word part of speech on the left side, the word part of speech on the right side, and the position information of the first entity and the second entity in the target text, the entity type of the first entity and the second entity, and the relative position information and similarity between the first entity and the second entity. In this way, a multidimensional atomic feature combination of the entity pairs can be combined. With each preset entity relationship type as a relationship node, and the atomic feature combination of the entity pair as the neighbor node of the relationship node, an atomic feature combination relationship graph of the entity pair is constructed; based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair, each relationship node in the atomic feature combination relationship graph of the entity pair is updated respectively. In this way, the multidimensional atomic feature combination and the entity relationship type can be constructed into an atomic feature combination relationship graph. In this way, since each relationship node in the updated atomic feature combination relationship graph can reflect the feature relationship of the multidimensional atomic feature combination, the entity relationship of the entity pairs in the target text can be accurately identified based on the feature relationship reflected by these relationship nodes.

[0024] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to better understand the present invention and do not constitute a limitation of the present invention.

[0026] Figure 1 is a flow chart of a method for identifying threat intelligence entity relationships according to an embodiment of the present invention;

[0027] Figure 2 It is a structural block diagram of a threat intelligence entity relationship identification device according to an embodiment of the present invention;

[0028] Figure 3 The block diagram is a block diagram of an electronic device for implementing the method according to the embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be appreciated by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present invention. Similarly, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0030] Figure 1 It is a flowchart of a method for identifying threat intelligence entity relationships according to an embodiment of the present invention.

[0031] like Figure 1 As shown, the threat intelligence entity relationship identification method may include:

[0032] S110, obtaining atomic features of an entity pair consisting of a first entity and a second entity in a target text, wherein the atomic features include left word parts of speech, right word parts of speech and position information of the first entity and the second entity in the target text, entity types of the first entity and the second entity, and relative position and similarity between the first entity and the second entity;

[0033] S120, combining the atomic features of the entity pair to obtain an atomic feature combination of the entity pair;

[0034] S130, using each preset entity relationship type as a relationship node, and using the atomic feature combination of the entity pair as a neighbor node of the relationship node, to construct an atomic feature combination relationship graph of the entity pair;

[0035] S140, based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair, respectively update each relationship node in the atomic feature combination relationship graph of the entity pair;

[0036] S150, determining the entity relationship type of the entity pair based on each updated relationship node in the atomic feature combination relationship graph of the entity pair.

[0037] It can be understood that the target text includes multiple entities. By combining any two entities among the multiple entities, multiple entity pairs can be obtained. For any entity pair, the above steps S110 to S150 can be performed.

[0038] For example, the target text may be an article or short text published on a social networking site, a forum, an official website, a blog, a third-party intelligence provider, an internal security system, or the like.

[0039] For example, an entity may be a word, a phrase, or a short word in the target text.

[0040] Exemplarily, the first entity and the second entity are any two different entities in the target text.

[0041] Exemplarily, the atomic features of an entity pair may include multiple ones, for example, the left word part of speech of the first entity is an atomic feature. Therefore, the atomic features of an entity pair include at least the following: the left word part of speech of the first entity in the target text, the right word part of speech of the first entity in the target text, the position information of the first entity in the target text, the entity type of the first entity, the left word part of speech of the second entity in the target text, the right word part of speech of the second entity in the target text, the position information of the second entity in the target text, the entity type of the second entity, the relative position information between the first entity and the second entity, and the similarity between the first entity and the second entity.

[0042] Illustratively, in the above step S120, more than two features among the multiple atomic features of the entity pair may be combined to obtain multiple atomic feature combinations, and each atomic feature combination may be composed of any two or more different atomic features in the entity pair.

[0043] For example, in the above step S120, multiple atomic features of the entity pair may be combined in pairs to obtain multiple atomic feature combinations, each of which is composed of any two different atomic features in the entity pair.

[0044] For example, taking the above embodiment applied to the scenario of identifying threat intelligence entity types as an example, the entity types may include 9, and the entity types are represented as .

[0045] ;

[0046] in, Indicates the target of attack. Indicates the attacker, Indicates attack tactics. Indicates the device, Indicates security vulnerability information. Indicates the platform, Indicates a report or announcement, Representing researchers and Indicates software.

[0047] Among them, attack target is used to describe government, university, medical, enterprise, scientific research institution, software and operating system, etc. Attacker is used to describe hacker organization, malicious intruder, etc. Attack tactics are used to describe the way attackers use to destroy targets. Device refers to the device used by attackers or attacked. Security vulnerability information is used to describe existing vulnerabilities and 0-day vulnerabilities, vulnerability numbers, vulnerability levels, etc. Platform is used to describe the official platform for analysis and evaluation of vulnerabilities and component vulnerabilities. Report or announcement is used to describe submitted detection reports, announcements or security incidents, etc. Researcher is used to describe personnel and teams such as scientific research, red and blue teams, security testing, and R&D. Software is used to describe existing software or unknown software.

[0048] Exemplarily, according to the above exemplary 9 threat intelligence entity types, the entity relationship types are predefined for different types of entity data. In this exemplary embodiment, a total of 7 entity relationship types are predefined. To characterize these 7 entity relationship types.

[0049] ;

[0050] in, Indicates the use of Indicates repair, Indicates monitoring, Indicates release, Indicates influence, Indicates attack, Indicates inclusion. Entity and entities The entity relationship between .in, , used to represent entities and entities The entity relationship type between entities and entities The entity type comes from .

[0051] For the usage entity relationship type, it is used to describe the security tools, attack tactics, equipment, software, etc. used by attackers or researchers.

[0052] For the repair entity relationship type, it is used to describe researchers fixing software vulnerabilities, researchers' repair work after attackers' attacks, etc.

[0053] For the monitoring entity relationship type, it is used to describe the security vulnerability information of the researchers' monitoring equipment, software, platform, attack targets, etc., and whether the researchers monitor the software for attackers and attack tactics.

[0054] For the release entity relationship type, it is used to describe researchers publishing reports or announcements, platforms publishing security vulnerability information, etc.

[0055] For the impact entity relationship type, it is used to describe the repair measures taken by researchers to reduce the impact of vulnerabilities and attacks and the impact of attackers on attack targets, software, devices, etc.

[0056] For the attack entity relationship type, it is used to describe the attacker, such as attack software, equipment, and attack target.

[0057] The inclusion entity relationship type is used to describe the inclusion relationship between threat intelligence entities, such as attack targets containing software and devices, software containing attack targets, and platforms containing security vulnerability information and reports or announcements.

[0058] It can be understood that the atomic feature combination relationship diagram constructed in step S130 is an initial relationship diagram, and then the initial relationship diagram is updated in step S140 to obtain a final relationship diagram.

[0059] For example, a graph attention network can be used to process the neighbor nodes of any relationship node in the atomic feature combination relationship graph of entity pairs, obtain the attention weights between the relationship node and each neighbor node, and then use the attention weights to update the relationship node. In this way, the relationship node can pay attention to the atomic feature combination of each neighbor node.

[0060] Exemplarily, a fully connected layer can be used to score or calculate the probability of each updated relationship node in the atomic feature combination relationship graph of the entity pair to obtain the score or probability of each relationship node, and then use the score or probability of each relationship node to determine the entity relationship type of the entity pair based on the entity relationship type initially represented by each relationship node.

[0061] According to the above implementation, the atomic features of the entity pairs of the target text are combined to obtain the atomic feature combination of the entity pairs, wherein the atomic features include the word part of speech on the left side, the word part of speech on the right side, and the position information of the first entity and the second entity in the target text, the entity type of the first entity and the second entity, and the relative position information and similarity between the first entity and the second entity. In this way, a multidimensional atomic feature combination of the entity pairs can be combined. With each preset entity relationship type as a relationship node, and the atomic feature combination of the entity pair as the neighbor node of the relationship node, an atomic feature combination relationship graph of the entity pair is constructed; based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair, each relationship node in the atomic feature combination relationship graph of the entity pair is updated respectively. In this way, the multidimensional atomic feature combination and the entity relationship type can be constructed into an atomic feature combination relationship graph. In this way, since each relationship node in the updated atomic feature combination relationship graph can reflect the feature relationship of the multidimensional atomic feature combination, based on the feature relationship reflected by these relationship nodes, the entity relationship of the entity pairs in the target text can be accurately identified.

[0062] In one embodiment, the above method may further include: performing entity recognition on the target text based on each entity data in the entity library to obtain multiple entities in the target text; and combining the multiple entities to obtain multiple entity pairs of the target text.

[0063] For example, the entity data can be collected in advance using a data collection module and stored in an entity library. The data sources of the collection module can include public accounts, forums, official websites, blogs, third-party intelligence providers, and internal security systems.

[0064] Exemplarily, data is collected from the above sources according to the set 9 threat intelligence entity types, and the collected entity data and corresponding entity types are stored in the threat intelligence entity library.

[0065] Exemplarily, the similarity between each word or term in the target text and each entity data is calculated, and the entities in the target text are determined using the similarity. Then, these identified entities are combined in pairs to obtain multiple entity pairs of the target text.

[0066] According to the above implementation, entities in the target text can be accurately identified, and the entities can be combined to obtain multiple entity pairs of the target text. Therefore, the entity relationships of these multiple entity pairs can be identified separately to obtain the entity relationship recognition result of the target text.

[0067] In one embodiment, entity recognition is performed on a target text based on each entity data in an entity library to obtain multiple entities in the target text, including: using a neural tensor network to perform similarity calculation on a feature representation of each entity data in the entity library and a feature representation of each word in the target text to obtain a similarity calculation function between each entity data and each word; using a fully connected neural network to perform dimensionality reduction calculation on the similarity calculation function between each entity data and each word to obtain the similarity between each entity data and each word; based on the similarity between each entity data and each word, multiple entities in the target text are determined in each word.

[0068] Exemplarily, the feature representation of each word in the target text can be generated in the following manner. The pre-trained language model SecBERT (SecBERT is a characteristic domain language model based on BERT, which can be trained based on a large amount of network security data) is used to encode each word in the target text to obtain a vector representation of each word in the target text, and an ordered long short-term memory neural network ON-LSTM (Ordered Neurons Long Short-term Memory Neural Network, ON-LSTM) is used to extract features from the vector representation of each word in the target text to obtain a feature representation of each word in the target text.

[0069] For example, taking the threat intelligence scenario as an example, the pre-trained language model SecBERT is used as an encoder. According to the vocabulary of the pre-trained model, the article content is All words in are converted into token representations. For the first word, For the second word, is the nth word. Then, the token representation is input into the SecBERT model, and the SecBERT model calculates the embedding vector representation of each word in the article content, that is, .in, Represents the words in the article content, The number of words representing the content of the article, Represents the embedding vector representation of the first word in the article content, Represents the embedding vector representation of the second word in the article content, Represents the embedding vector representation of the nth word in the article content.

[0070] In order to further enhance the multi-dimensional and contextual information of text semantic vectors, an ordered long short-term memory neural network ON-LSTM is used to extract features from the embedding vector representation of each word in the article content, deeply capturing the semantic relationship between words. Input ON-LSTM to generate the final word feature representation .in, is the number of words in the article content, is the feature representation of words in the article content, is the dimension of the word feature representation, is the feature representation of the i-th word in the article content, is the feature representation of the second word in the article content, is the feature representation of the nth word in the article content.

[0071] Exemplarily, the feature representation of each entity data in the entity library can be pre-generated and stored in the entity library in the following manner: The pre-trained language model SecBERT is used to encode each entity data to obtain a vector representation of each entity data, and an ordered long short-term memory neural network ON-LSTM is used to extract features from the vector representation of each entity data to obtain a feature representation of each entity data.

[0072] For example, in order to accurately identify entities in the article content, the entity data in the threat intelligence entity library is feature extracted using the same method as the feature representation of words in the article content. First, the pre-trained language model SecBERT is used to obtain the embedding vector representation of each entity data in the threat intelligence entity library, which is .in, Indicates the number of entity data in the threat intelligence entity library. Represents the embedding vector representation of the first entity data in the threat intelligence entity library. The embedding vector representation of the second entity data in the threat intelligence entity library, Represents the embedded vector representation of the mth entity data in the threat intelligence entity library. Then, the ON-LSTM model is used to process the embedded vector representation of the entity data to obtain the feature representation .in, Indicates the number of feature representations of entity data in the threat intelligence entity library. It is the characteristic representation of the first entity data of the threat intelligence entity library. It is the characteristic representation of the second entity data of the threat intelligence entity library. is the feature representation of the mth entity data in the threat intelligence entity library, The dimension that represents the characteristics of the entity data.

[0073] For example, a neural tensor network (NTN) is used to represent the learning model, and similarity calculation is performed between the feature representation of each word in the article content and the feature representation of each entity data in the threat intelligence entity library. The following formula can be used for calculation.

[0074] ;

[0075] in, is the feature representation of any word in the article content, It is the feature representation of any entity data in the threat intelligence entity library, and the two feature representations are the inputs of NTN respectively. It represents the dimension of the similarity vector output by NTN. and is the weight matrix, is the bias term, is a non-linear activation function.

[0076] For example, a fully connected neural network is used to measure the similarity Perform fusion dimensionality reduction to calculate the similarity score between any word in the article content and any entity data in the threat intelligence entity library .

[0077] ;

[0078] in, and are the parameters of the fully connected neural network, is a non-linear activation function.

[0079] For example, the similarity score between a word in the article content and a certain entity data is With the set threshold If the similarity score between the word and any entity data is , then the word is determined to be an entity.

[0080] It can be understood that the above thresholds are only examples and may be other data.

[0081] Exemplarily, each entity identified in the target text is represented as an entity set .in, is the first entities, is the total number of entities in the target text.

[0082] According to the above implementation, entities of the target text can be accurately identified.

[0083] For example, for the entity set Combine two entities to obtain a set of entity pairs .in, .in, Indicates Entity pairs, Represents the number of entity pairs.

[0084] In some embodiments, the combination of atomic features includes at least one of the following:

[0085] A combination of the part of speech of the left word of the first entity and the position information of the first entity;

[0086] A combination of the position information of the first entity and the part of speech of the right word of the first entity;

[0087] A combination of the part of speech of the left word of the second entity and the position information of the second entity;

[0088] A combination of the position information of the second entity and the part of speech of the right word of the second entity;

[0089] a combination of an entity type of the first entity and an entity type of the second entity;

[0090] A combination of relative position information and similarity between the first entity and the second entity.

[0091] For example, the atomic features of the article content contain rich entity information and entity relationship information. Taking entity pairs as an example, there can be 6 atomic feature types in this example. Atomic feature selection basis: In order to better learn rich text intra-word and inter-word feature information, the part-of-speech tagging method is used to enhance the text characteristics of the input entity pairs, and the position information encoding is combined to effectively capture the local and long-distance dependency information of the text information. The entity type enriches the information representation in the text, and the entity pair The relative position information of entities enhances the association between entities, and the similarity between two entities in an entity pair can deeply mine the information relationship of entity pairs and improve the accuracy of entity relationship recognition.

[0092] For example, using the function , , , , , The atomic features of the two entities in the entity pair of the article content are calculated separately as follows: The left word part of speech, entity The right side word part of speech, entity The location information encoding, entity type, Entity-to-Entity With entity The relative position information and similarity of

[0093] Exemplarily, an atomic feature combination function may be used to combine multiple atomic features of an entity pair to obtain multiple atomic feature combinations.

[0094] For example, combining the six atomic features of the above entity pairs can obtain the semantic dependency relationship between different types of information, which is conducive to entity relationship recognition. Combine the 6 atomic features to construct a 6-atomic feature combination to , as follows:

[0095] For example, , used for entities Left side word part of speech and entity The position information is encoded for feature combination.

[0096] For example, , used for entities Location Information Encoding and Entities The right side word part of speech is combined with features.

[0097] For example, , used for entities Left side word part of speech and entity The position information is encoded for feature combination.

[0098] For example, , used for entities Location Information Encoding and Entities The right side word part of speech is combined with features.

[0099] For example, , used for entities Types and entities Types combine features.

[0100] For example, , which is used to combine the relative position information and similarity of entity pairs.

[0101] Exemplarily, according to the above content, the first Entity pairs Atomic feature combinations of .in, , For the Entity pairs The order number of one of the atomic feature combinations.

[0102] For example, to further characterize the atomic feature combination information, an ordered long short-term memory neural network can be used to encode the atomic feature combination representation. Introduced into ON-LSTM to generate the final vector representation , .in For each atomic feature combination vector representation The dimension of Represents the first atomic feature combination Entity feature information, Represents the second atomic feature combination Entity feature information, Indicates Atomic feature combination Entity feature information, Indicates the sixth atomic feature combination , thereby further enhancing the learning of contextual information of the article content.

[0103] According to the above implementation, multiple atomic feature combinations of an entity pair can be calculated, which facilitates the subsequent use of the atomic feature combinations to determine the entity relationship type between two entities in the entity pair.

[0104] In one embodiment, based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair, each relationship node in the atomic feature combination relationship graph of the entity pair is updated respectively, including: using a graph attention network to calculate the attention weights between each relationship node and each neighbor node in the atomic feature combination relationship graph of the entity pair; for each relationship node, the following operations are performed respectively: based on the attention weights between the relationship node and each neighbor node, the atomic feature combinations represented by each neighbor node are spliced, and the relationship nodes are preliminarily updated using the splicing results; weighted summation is performed on the relationship nodes before the preliminary update and the relationship nodes after the preliminary update to obtain a scalar parameter; matrix dot multiplication is performed on the scalar parameter, the relationship node before the preliminary update, and the relationship node after the preliminary update to obtain the updated relationship node.

[0105] Exemplarily, in the above step S130, when constructing the relationship graph, the entity relationship type may be vectorized, as shown in the following example.

[0106] For example, seven entity relationship types are As a predefined relationship, and embedded into a high-dimensional vector. The pre-trained language model SecBERT is used as an encoder (SecBERT is a feature domain language model based on BERT). According to the vocabulary of the pre-trained model, the entity relationship type All words in the dataset are converted into token representations. Then, the token representations are passed through the SecBERT model to calculate the vector representation of the entity relationship type. .in, For each relationship type, a vector is represented The dimension of the atomic feature vector is represented by The dimensions are the same.

[0107] For example, in the above steps S130 and S140, Entity pairs Vector representation of atomic feature combinations of and vector representation of entity relationship types Together, we build a graph of atomic feature combinations.

[0108] and As the node of the atomic feature combination relationship graph. Among them, the entity relationship type node is the main node, that is, the relationship node in this paper. The atomic feature combination vector nodes are used as neighbor nodes of the main node. Then, the graph attention network is combined with the relationship nodes of the atomic feature combination relationship graph of the entity pair to achieve the fusion of multiple feature information.

[0109] Exemplarily, a graph attention network is used to calculate the attention weights between each relationship node and each neighbor node in the atomic feature combination relationship graph of the entity pair, specifically as follows:

[0110] ;

[0111] in, represents the attention weight between the Xth neighbor node and the jth relationship node, express Trainable parameters of attention weights, Indicates the Xth neighbor node and represents the trainable parameters of the j-th relation node, Represents the connection function.

[0112] For example, the attention weight can be normalized as follows:

[0113] ;

[0114] Among them, among them, Indicates the total number of neighbor nodes. Indicates The attention weight between the neighbor node and the jth relationship node, Represents an exponential function with base e.

[0115] Exemplarily, a weighted fusion is performed on the atomic feature combinations represented by each neighbor node, and the weighted fusion result is used to preliminarily update the relationship node, which can be calculated using the following formula.

[0116] ;

[0117] in, is the jth relationship node before the update, represents the jth relationship node after the initial update, are model trainable parameters.

[0118] Exemplarily, the following function may be used to concatenate the relationship nodes before the preliminary update and the relationship nodes after the preliminary update to obtain a scalar parameter.

[0119] ;

[0120] in, Trainable parameters, is a scalar parameter.

[0121] Exemplarily, matrix dot multiplication of the scalar parameter, the relationship node before the preliminary update, and the relationship node after the preliminary update can be calculated using the following formula.

[0122] ;

[0123] in, Represents the dot product calculation symbol, Indicates the relationship node after the update is completed.

[0124] According to the above implementation, an atomic feature combination relationship diagram of multi-dimensional atomic feature information of entity pairs can be obtained by fusion.

[0125] In one embodiment, the entity relationship type of the entity pair is determined based on each updated relationship node in the atomic feature combination relationship graph of the entity pair, including: using a fully connected layer to calculate each updated relationship node in the atomic feature combination relationship graph of the entity pair to obtain the entity relationship score of each relationship node; using an activation function to calculate the entity relationship score of each relationship node to obtain the probability of each relationship node; based on the entity relationship type represented by each relationship node when it is initialized, and the probability of each relationship node, the entity relationship type of the entity pair is determined.

[0126] Exemplarily, the fully connected layer may include a two-layer network, which may be a multilayer perceptron (MLP).

[0127] Exemplarily, a fully connected layer is used to calculate the updated relationship node in the atomic feature combination relationship graph of the entity pair to obtain the entity relationship score of the relationship node, which can be specifically calculated using the following formula.

[0128] ;

[0129] in, The jth relationship node finally output by the atomic feature combination relationship graph Entity relationship score, is the vector representation of the jth updated relationship node. is the activation function, is the weight matrix of the last fully connected layer of MLP, is the bias term, .

[0130] Exemplarily, an activation function is used to calculate the entity relationship score of a relationship node to obtain the probability of the relationship node, which can be specifically calculated using the following formula.

[0131] ;

[0132] in, is the probability of the predicted relationship category, is the activation function, thus accurately identifying the Entity Pair Entity relationships.

[0133] According to the above implementation, the entity relationship of each entity pair in the target text can be calculated.

[0134] Figure 2 It is a structural block diagram of a threat intelligence entity relationship identification device according to an embodiment of the present disclosure.

[0135] like Figure 2 As shown, the threat intelligence entity relationship identification device may include:

[0136] An atomic feature acquisition module 210 is used to acquire atomic features of an entity pair consisting of a first entity and a second entity in a target text, wherein the atomic features include the part of speech of the left word, the part of speech of the right word and the position information of the first entity and the second entity in the target text, the entity types of the first entity and the second entity, and the relative position information and similarity between the first entity and the second entity;

[0137] A feature combination module 220, used for combining the atomic features of the entity pair to obtain an atomic feature combination of the entity pair;

[0138] A relationship graph construction module 230 is used to construct an atomic feature combination relationship graph of the entity pairs using each preset entity relationship type as a relationship node and the atomic feature combination of the entity pairs as a neighbor node of the relationship node;

[0139] A relationship graph updating module 240, configured to update each relationship node in the atomic feature combination relationship graph of the entity pair based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair;

[0140] The entity relationship determination module 250 is used to determine the entity relationship type of the entity pair based on each updated relationship node in the atomic feature combination relationship graph of the entity pair.

[0141] In one implementation, the relationship graph updating module 240 includes:

[0142] An attention weight calculation unit, used to calculate the attention weights between each relationship node and each neighbor node in the atomic feature combination relationship graph of each entity pair using a graph attention network;

[0143] The relationship node updating unit is used to perform the following operations on each of the relationship nodes:

[0144] Based on the attention weights between the relationship node and each of the neighbor nodes, weighted fusion is performed on the atomic feature combinations represented by each of the neighbor nodes, and the relationship node is preliminarily updated using the weighted fusion result;

[0145] Concatenating the relationship node before the preliminary update and the relationship node after the preliminary update to obtain a scalar parameter;

[0146] Matrix point multiplication is performed on the scalar parameter, the relationship node before preliminary updating, and the relationship node after preliminary updating to obtain the relationship node after completing the update.

[0147] In one embodiment, the above device further comprises:

[0148] An entity recognition module, used to perform entity recognition on the target text based on each entity data in the entity library, to obtain multiple entities in the target text;

[0149] The entity combination module is used to combine the multiple entities to obtain multiple entity pairs of the target text.

[0150] In one embodiment, the entity recognition module includes:

[0151] A similarity calculation unit, used to use a neural tensor network to perform similarity calculation on a feature representation of each entity data in the entity library and a feature representation of each word in the target text, so as to obtain a similarity calculation function between each entity data and each word;

[0152] A dimension reduction calculation unit, used to use a fully connected neural network to perform dimension reduction calculation on a similarity calculation function between each entity data and each word, so as to obtain the similarity between each entity data and each word;

[0153] The entity determination unit is used to determine multiple entities in the target text in each of the words based on the similarity between each of the entity data and each of the words.

[0154] In one embodiment, the atomic feature combination includes at least one of the following:

[0155] A combination of the part of speech of the left word of the first entity and the position information of the first entity;

[0156] A combination of the position information of the first entity and the part of speech of the right word of the first entity;

[0157] A combination of the part of speech of the left word of the second entity and the position information of the second entity;

[0158] A combination of the position information of the second entity and the part of speech of the right word of the second entity;

[0159] a combination of an entity type of the first entity and an entity type of the second entity;

[0160] A combination of relative position information and similarity between the first entity and the second entity.

[0161] In one implementation, the entity relationship determination module 250 includes:

[0162] A relationship scoring unit, used to calculate each updated relationship node in the atomic feature combination relationship graph of the entity pair using a fully connected layer to obtain an entity relationship score of each relationship node;

[0163] A probability calculation unit, used to calculate the entity relationship score of each of the relationship nodes using an activation function to obtain the probability of each of the relationship nodes;

[0164] The type determination unit is used to determine the entity relationship type of the entity pair based on the entity relationship type represented by each of the relationship nodes when initialized and the probability of each of the relationship nodes.

[0165] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present invention, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0166] In the technical solution of the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0167] According to an embodiment of the present invention, the present invention also provides a system and a readable storage medium.

[0168] Figure 3 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0169] like Figure 3 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 to a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0170] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0171] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as the threat intelligence entity relationship identification method. For example, in some embodiments, the threat intelligence entity relationship identification method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the threat intelligence entity relationship identification method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the threat intelligence entity relationship identification method in any other appropriate manner (e.g., by means of firmware).

[0172] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0173] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0174] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0175] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0176] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0177] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0178] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution disclosed in the present invention can be achieved, and this document does not limit this.

[0179] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A threat intelligence entity relationship identification method, characterized in that: include: Acquire atomic features of an entity pair consisting of a first entity and a second entity in a target text, wherein the atomic features include left word parts of speech, right word parts of speech and position information of the first entity and the second entity in the target text, entity types of the first entity and the second entity, and relative position and similarity between the first entity and the second entity; Combining the atomic features of the entity pair to obtain an atomic feature combination of the entity pair; Taking each preset entity relationship type as a relationship node and taking the atomic feature combination of the entity pair as a neighbor node of the relationship node, constructing an atomic feature combination relationship graph of the entity pair; Based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair, each relationship node in the atomic feature combination relationship graph of the entity pair is updated respectively, including: using a graph attention network to calculate the attention weights between each relationship node and each neighbor node in the atomic feature combination relationship graph of the entity pair; for each of the relationship nodes, the following operations are performed respectively: based on the attention weights between the relationship node and each of the neighbor nodes, the atomic feature combinations represented by each of the neighbor nodes are weightedly fused, and the relationship nodes are preliminarily updated using the weighted fusion results; the relationship nodes before the preliminary update and the relationship nodes after the preliminary update are concatenated to obtain scalar parameters; the scalar parameters, the relationship nodes before the preliminary update, and the relationship nodes after the preliminary update are matrix dot multiplied to obtain the updated relationship nodes; Based on each updated relationship node in the atomic feature combination relationship graph of the entity pair, the entity relationship type of the entity pair is determined.

2. The method according to claim 1, characterized in that: Also includes: Based on each entity data in the entity library, entity recognition is performed on the target text to obtain multiple entities in the target text; The multiple entities are combined to obtain multiple entity pairs of the target text.

3. The method according to claim 2, characterized in that The entity recognition is performed on the target text based on each entity data in the entity library to obtain multiple entities in the target text, including: Using a neural tensor network, similarity calculation is performed on the feature representation of each entity data in the entity library and the feature representation of each word in the target text to obtain a similarity matrix between each entity data and each word; Using a fully connected neural network, a dimensionality reduction calculation is performed on a similarity calculation function between each entity data and each word to obtain a similarity score between each entity data and each word, including: using network parameters of the fully connected neural network to linearly transform a similarity matrix, and using a nonlinear activation function in the fully connected neural network to map the linearly transformed similarity matrix to a low-dimensional space to obtain a similarity score between each entity data and each word; Based on the similarity scores between each of the entity data and each of the words, a plurality of entities in the target text are determined in each of the words.

4. The method according to claim 1, characterized in that: The atomic feature combination includes at least one of the following: A combination of the part of speech of the left word of the first entity and the position information of the first entity; A combination of the position information of the first entity and the part of speech of the right word of the first entity; A combination of the part of speech of the left word of the second entity and the position information of the second entity; A combination of the position information of the second entity and the part of speech of the right word of the second entity; a combination of an entity type of the first entity and an entity type of the second entity; A combination of relative position information and similarity between the first entity and the second entity.

5. The method according to claim 1, characterized in that The step of determining the entity relationship type of the entity pair based on each updated relationship node in the atomic feature combination relationship graph of the entity pair includes: Using a fully connected layer, calculating each updated relationship node in the atomic feature combination relationship graph of the entity pair to obtain an entity relationship score of each relationship node; Using an activation function, the entity relationship score of each of the relationship nodes is calculated to obtain the probability of each of the relationship nodes; The entity relationship type of the entity pair is determined based on the entity relationship type represented when each of the relationship nodes is initialized and the probability of each of the relationship nodes.

6. A threat intelligence entity relationship identification device, characterized in that: include: an atomic feature acquisition module, used to acquire atomic features of an entity pair consisting of a first entity and a second entity in a target text, wherein the atomic features include the left word part of speech, the right word part of speech and position information of the first entity and the second entity in the target text, the entity types of the first entity and the second entity, and the relative position and similarity between the first entity and the second entity; A feature combination module, used for combining the atomic features of the entity pair to obtain an atomic feature combination of the entity pair; A relationship graph construction module, used to construct an atomic feature combination relationship graph of the entity pairs using preset entity relationship types as relationship nodes and atomic feature combinations of the entity pairs as neighbor nodes of the relationship nodes; A relationship graph updating module, used for updating each relationship node in the atomic feature combination relationship graph of the entity pair based on the neighbor nodes of each relationship node in the atomic feature combination relationship graph of the entity pair; An entity relationship determination module, configured to determine the entity relationship type of the entity pair based on each updated relationship node in the atomic feature combination relationship graph of the entity pair; Wherein, the relationship graph updating module includes: An attention weight calculation unit, used to calculate the attention weights between each relationship node and each neighbor node in the atomic feature combination relationship graph of each entity pair using a graph attention network; The relationship node updating unit is used to perform the following operations on each of the relationship nodes: Based on the attention weights between the relationship node and each of the neighbor nodes, weighted fusion is performed on the atomic feature combinations represented by each of the neighbor nodes, and the relationship node is preliminarily updated using the weighted fusion result; Concatenating the relationship node before the preliminary update and the relationship node after the preliminary update to obtain a scalar parameter; Matrix point multiplication is performed on the scalar parameter, the relationship node before preliminary updating, and the relationship node after preliminary updating to obtain the relationship node after completing the update.

7. A threat intelligence entity relationship identification system, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5.

Images