Knowledge graph and large model fusion intelligent question answering method oriented to network security

Abstract

The invention belongs to the technical field of data processing, and provides a network security-oriented knowledge graph and large model fused intelligent question and answer method. The method comprises the following steps: (10) performing large model reasoning on a network security problem to obtain a structured entity and an entity relationship; and (20) querying in the network security knowledge graph based on the structured entity and the relationship information. And (30) obtaining a triple related to the entity from the knowledge graph as external knowledge information of the large model. And (40) performing prompt text construction based on the external knowledge information of the large model. And (50) carrying out large language model chained call construction based on the prompt text information. And (60) combining the large model with external knowledge information to obtain a final answer. The method has the beneficial effects that the network security knowledge graph is combined with the large model, and related knowledge of entities and relationships in the question is obtained from the knowledge graph to serve as external knowledge to enhance the text information generated by the large model, so that the accuracy of knowledge questions and answers of the large model is enhanced from multiple dimensions.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and discloses an intelligent question-answering method integrating knowledge graph and large model for network security. Background Art

[0002] In today's digital age, with the rapid development of artificial intelligence and machine learning, large language models have also become one of the hot technologies in the field of data science. Large models (LLM) refer to neural network models trained with ultra-large-scale text data. They are developed from pre-trained language models (PLMs). They are characterized by large model size and parameters usually in the billions or even trillions. Compared with traditional pre-trained language models, large models show special capabilities (emergence and reasoning capabilities) when processing complex tasks. Relevant studies have shown that large models can not only understand and process large-scale text data, but also have contextual learning capabilities and domain generalization capabilities. This makes them a general choice for various natural language downstream tasks and can easily perform few-sample transfer learning. Today, many representative large models have emerged in the field of AI, such as the conversational language large model ChatGPT, the multimodal large model GPT-4 with enhanced reasoning capabilities, and so on. These models have not only made certain progress in traditional natural language processing fields (such as search engines and machine translation), but also provided effective help in various fields such as finance, medical care, and education.

[0003] At present, although the large model has a powerful ability to automatically learn and understand semantics, it still faces many challenges. The model is still uncontrollable, lacks interpretability, cannot guarantee the real-time nature of knowledge, has uncertainty in the quality of language data, and has the potential risk of generating hallucinations and toxic information. In order to meet these challenges, the present invention considers combining knowledge graphs with large models.

[0004] A knowledge graph is a network graph structure used to represent and store knowledge, where nodes represent entities and edges represent relationships between entities. Knowledge graphs are known for the authenticity of their data, a feature that can effectively alleviate the problem of hallucinations in large models. For example, the KELM corpus and the general model KG-PT provide large models with real text information based on knowledge graph transformation. As a "black box model", the output results of a large model are usually difficult to explain, while the structural knowledge inside the knowledge graph is closer to human cognition. Therefore, the knowledge graph can provide a means of explaining and reasoning knowledge, and explore the complex working steps and reasoning processes inside the large model. In addition, the knowledge graph can also be used as an external retrieval tool to help large models solve problems such as fairness, privacy, and security.

[0005] Knowledge graph technology can achieve more accurate search results and personalized recommendation experience, and big model technology can provide more efficient and intelligent natural language processing. The combination of the two has the potential to improve the processing depth and breadth of text-based knowledge and promote knowledge integration and application innovation in the field of network security, which provides us with unlimited possibilities to better utilize text data in the digital age. Summary of the invention

[0006] The present invention aims to solve the problem that when a general large language model is used to answer questions in a professional field, the real-time and accuracy of the answers cannot be guaranteed, which leads to hallucinations or harmful information, and the answers are uncontrollable and inaccurate. Therefore, the present invention proposes a network security-oriented knowledge graph and large model fusion intelligent question-answering method.

[0007] The specific steps are as follows:

[0008] (10) Obtain structured entities and entity relationships for network security issues through large-scale model reasoning.

[0009] (11) Select the vicuna open source model as the original base model, use the FastChat framework to deploy the large model, and start the API server to interact with the model.

[0010] (12) Use LangChain to build a reasonable application based on a large model server to connect the large language model with the knowledge graph database.

[0011] (13) The network security question to be answered is a query, for example: "Describe what CVE-2021-22473 is". CVE stands for Common Vulnerabilities and Exposures. CVE assigns a unique number to each vulnerability: CVE-YYYY-NNNN. CVE is a fixed prefix, YYYY is the year in the Western calendar, and NNNN is a serial number. In principle, NNNN is a four-digit number, and if it is less than four digits, the leading 0 is added. Starting from 2014, it can be up to five digits or more when necessary. Since CVE has many numbering agencies, each numbering agency uses a different numbering segment, so NNNN may not be continuous.

[0012] The query is input into the application built by LangChain to interact with the large language model. By building LLMChain, a chain call for large model reasoning is performed on complex tasks or applications, and finally one or more entities and entity relationships in the query are obtained.

[0013] (14) Use Langchain’s PydanticOutputParser output parser to construct the model response into the required Python object. This approach relies on designing well-designed prompts and then parsing the output of the large language model to make them good at extracting information. The specific prompt design is:

[0014] Build a prompt template that should be formatted as a JSON instance that conforms to the following JSON schema. For example, for the schema {"properties":{"foo":{"title":"Foo","description":"List of strings","type":"array","items":{"type":"string"}}},"required":["foo"]}. The object {"foo":["bar","baz"]} is a well-formed instance of the schema. The object {"properties":{"foo":["bar","baz"]}} is not well-formed. Output schema: {schema}.

[0015] where schema is the desired output Python object format.

[0016] (15) Finally, parse and verify the output format of the schema using the function method parse_and_check_json_markdown. If the format is not JSON, go to step 13. If the format is correct, output it. For example, "Describe what CVE-2021-22473 is", the output is: {"pairs": [{"entity": "CVE-2021-22473", "relation": ["description"]}]}.

[0017] (20) Query the cybersecurity knowledge graph based on structured entity and relationship information.

[0018] (21) KG = (E, R, T) is used to represent the knowledge graph, where the set E consists of entities; the set R consists of relations; and the set T consists of knowledge triples, which are other entities or knowledge attributes.

[0019] Use Bayesian network as the reasoning framework to quantify the association relationship between entities in the knowledge graph. Extract the optimal structure of entities in the knowledge graph KG, and i The importance value (E i )Reduce the entity scope of KG and obtain the core subgraph.

[0020] We use W to represent the sum of the importance of all entities in KG, and Mmax 、M min represents the maximum and minimum number of entities selected, W′ is the sum of the importance of the minimum number of entities to be selected, and the branch and bound algorithm is used to construct the objective function of obtaining the core subgraph:

[0021]

[0022] In the formula, when the parameter DW i When the value of DW is 0, it means that the entity is not selected. i When the value of is 1, it indicates that the entity is selected; score max (KG) indicates the importance value (E i )The maximum subgraph with the sum of

[0023] (22) Then, based on the core subgraph of the knowledge graph, the link relationship between each entity in the knowledge graph is obtained to construct a directed acyclic graph.

[0024] The importance value of the entity (E i ) as the basis, when M(X i )>M(X j ), it means that the edge is represented by X in the Bayesian network. i Point to X j , where M(X i ) can be calculated by the following formula:

[0025] M(X i )=Σvalue(E i )

[0026] The calculation results of the above formula are used to determine the link relationship of the node variables in the Bayesian network, and the above link relationship is stored through the adjacency matrix. The nodes therein are searched breadth-first. When a node is visited more than once in the Bayesian network, it indicates that there is a loop in the path. Therefore, the adjacency value between the node and the previous node in the network is set to 0. The adjacency matrix finally obtained through the above process is the target directed acyclic graph.

[0027] (23) Finally, in the above directed acyclic graph, a depth-first traversal algorithm is used to perform query search with the structured entities and entity relationships output in step 16.

[0028] (30) All relevant entity triplets are queried in the knowledge graph to establish the answer dataset F as the external knowledge information of the large model.

[0029] (40) Construct prompt text based on external knowledge information of the large model.

[0030] (41) Based on the contextual learning capability of LLM, multiple tasks can share one LLM. The formula for the prompt-based contextual learning implementation process is as follows:

[0031]

[0032] Where X Prompt Indicates the prompt instructions for specific tasks, X Context represents the text from which information is to be extracted, y i is the input text category, and Y is the output probability.

[0033] (42) The question query and the answer data set F of the external information of the large model are integrated to obtain the Input input, and the prompt engineering prompt template is constructed. The construction formula is as follows:

[0034] Prompt=Prefix+Instruct+Examples+Input

[0035] Prefix is ​​fixed in use and is used to set the role of the model; Instruct is the instructions related to the specific task; Examples are examples of specific tasks; Input is the input text.

[0036] (50) A large language model chain call is constructed based on the prompt text information.

[0037] Through Langchain technology, we build LLMchain based on the prompt word template and establish data interaction between the large language model and the external knowledge of the model. The construction formula of LLMchain is as follows:

[0038] LLMchain=prompt_template|model|parser

[0039] Among them, promp_template is the prompt word template, model is the large language model, and parser is the output parser.

[0040] (60) The large model is combined with external knowledge information to obtain the final answer.

[0041] Compared with general large-model question and answer, the beneficial effects of the present invention are as follows: this method combines the knowledge graph in the field of network security on the basis of the large language model, and obtains entity-related triples through matching queries with key entities extracted from the question based on a structured semantic network knowledge base. As the external knowledge information of the large model, it can significantly improve the accuracy of question and answering and the real-time nature of knowledge of the large model in the field of network security.

[0042] The present invention builds and manages the chain call of the large language model through the LangChain framework, realizing the data interaction between the large language model and the external knowledge graph information. By building a clear and specific prompt word template, the large language model can be effectively guided to generate the expected answer, providing strong support for improving the generation quality of the large language model. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 Flow chart of the method of the present invention

[0044] Figure 2 System framework diagram

[0045] Figure 3 Constructing a graph for the prompt template

[0046] Figure 4 Building visualizations for knowledge graphs

[0047] Figure 5 Comparison chart of intelligent question answering results DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0049] The present invention is a data processing method that combines a network security knowledge graph and a large model to improve the large model's ability to generate high-quality answers in the field of network security.

[0050] The design of the present invention proposes a knowledge graph and large model integrated intelligent question answering method for network security. According to the algorithm flow chart, the specific implementation steps are as follows:

[0051] (10) Obtain structured entities and entity relationships for network security issues through large-scale model reasoning.

[0052] (11) Select the vicuna open source model as the original base model, use the FastChat framework to deploy the large model, and start the API server to interact with the model.

[0053] (12) Use LangChain to build a reasonable application based on a large model server to connect the large language model with the knowledge graph database.

[0054] (13) The network security question to be answered is a query, for example: "Describe what CVE-2021-22473 is". CVE stands for Common Vulnerabilities and Exposures. CVE assigns a unique number to each vulnerability: CVE-YYYY-NNNN. CVE is a fixed prefix, YYYY is the year in the Western calendar, and NNNN is a serial number. In principle, NNNN is a four-digit number, and if it is less than four digits, the leading 0 is added. Starting from 2014, it can be up to five digits or more when necessary. Since CVE has many numbering agencies, each numbering agency uses a different numbering segment, so NNNN may not be continuous.

[0055] The query is input into the application built by LangChain to interact with the large language model. By building LLMChain, a chain call for large model reasoning is performed on complex tasks or applications, and finally one or more entities and entity relationships in the query are obtained.

[0056] (14) Use Langchain’s PydanticOutputParser output parser to construct the model response into the required Python object. This approach relies on designing well-designed prompts and then parsing the output of the large language model to make them good at extracting information. The specific prompt design is:

[0057] Build a prompt template that should be formatted as a JSON instance that conforms to the following JSON schema. For example, for the schema {"properties":{"foo":{"title":"Foo","description":"List of strings","type":"array","items":{"type":"string"}}},"required":["foo"]}. The object {"foo":["bar","baz"]} is a well-formed instance of the schema. The object {"properties":{"foo":["bar","baz"]}} is not well-formed. Output schema: {schema}.

[0058] where schema is the desired output Python object format.

[0059] (15) Finally, parse and verify the output format of the schema using the function method parse_and_check_json_markdown. If the format is not JSON, go to step 13. If the format is correct, output it. For example, "Describe what CVE-2021-22473 is", the output is: {"pairs": [{"entity": "CVE-2021-22473", "relation": ["description"]}]}.

[0060] (20) Query the cybersecurity knowledge graph based on structured entity and relationship information.

[0061] (21) KG = (E, R, T) is used to represent the knowledge graph, where the set E consists of entities; the set R consists of relations; and the set T consists of knowledge triples, which are other entities or knowledge attributes.

[0062] Use Bayesian network as the reasoning framework to quantify the association relationship between entities in the knowledge graph. Extract the optimal structure of entities in the knowledge graph KG, and i The importance value (E i )Reduce the entity scope of KG and obtain the core subgraph.

[0063] We use W to represent the sum of the importance of all entities in KG, and M max 、M min represents the maximum and minimum number of entities selected, W′ is the sum of the importance of the minimum number of entities to be selected, and the branch and bound algorithm is used to construct the objective function of obtaining the core subgraph:

[0064]

[0065] In the formula, when the parameter DW i When the value of DW is 0, it means that the entity is not selected. i When the value of is 1, it indicates that the entity is selected; score max (KG) indicates the importance value (E i )The maximum subgraph with the sum of

[0066] (22) Then, based on the core subgraph of the knowledge graph, the link relationship between each entity in the knowledge graph is obtained to construct a directed acyclic graph.

[0067] The importance value of the entity (E i ) as the basis, when M(X i )>M(X j ), it means that the edge is represented by X in the Bayesian network. i Point to Xj , where M(X i ) can be calculated by the following formula:

[0068] M(X i )=Σvalue(E i )

[0069] The calculation results of the above formula are used to determine the link relationship of the node variables in the Bayesian network, and the above link relationship is stored through the adjacency matrix. The nodes therein are searched breadth-first. When a node is visited more than once in the Bayesian network, it indicates that there is a loop in the path. Therefore, the adjacency value between the node and the previous node in the network is set to 0. The adjacency matrix finally obtained through the above process is the target directed acyclic graph.

[0070] (23) Finally, in the above directed acyclic graph, a depth-first traversal algorithm is used to perform query search with the structured entities and entity relationships output in step 16.

[0071] (30) All relevant entity triplets are queried in the knowledge graph to establish the answer dataset F as the external knowledge information of the large model.

[0072] (40) Construct prompt text based on external knowledge information of the large model.

[0073] (41) Based on the contextual learning capability of LLM, multiple tasks can share one LLM. The formula for the prompt-based contextual learning implementation process is as follows:

[0074]

[0075] Where X Prompt Indicates the prompt instructions for specific tasks, X Context represents the text from which information is to be extracted, y i is the input text category, and Y is the output probability.

[0076] (42) The question query and the answer data set F of the external information of the large model are integrated to obtain the Input input, and the prompt engineering prompt template is constructed. The construction formula is as follows:

[0077] Prompt=Prefix+Instruct+Examples+Input

[0078] Prefix is ​​fixed in use and is used to set the role of the model; Instruct is the instructions related to the specific task; Examples are examples of specific tasks; Input is the input text.

[0079] (50) A large language model chain call is constructed based on the prompt text information.

[0080] Through Langchain technology, we build LLMchain based on the prompt word template and establish data interaction between the large language model and the external knowledge of the model. The construction formula of LLMchain is as follows:

[0081] LLMchain=prompt_template|model|parser

[0082] Among them, promp_template is the prompt word template, model is the large language model, and parser is the output parser.

[0083] (60) The large model is combined with external knowledge information to obtain the final answer.

[0084] Example analysis:

[0085] The present invention obtains a data set from the publicly disclosed network security vulnerability library CVE, constructs a network security knowledge graph, and combines it with a large language model to perform more accurate knowledge questions and answers in the field of network security. The system architecture diagram is shown in the figure below: Figure 2 As shown in the figure. CVE (Common Vulnerabilities and Exposures) is the full name of public vulnerabilities and exposures, which is a list of publicly disclosed network security vulnerabilities. IT personnel and security researchers refer to CVE to obtain detailed information on vulnerabilities, and then determine the priority of vulnerability resolution based on vulnerability scores.

[0086] Use the acquired dataset to build a network security knowledge graph, such as Figure 3 As shown. Then, after using LangChain to combine the knowledge graph with the large language model, the query "Describe what CVE-2021-22473 is" is passed into the system for entity extraction, and the JSON format of {"pairs": [{"entity": "CVE-2021-22473", "relation": ["description"]}]} is obtained. The knowledge graph is matched and queried to obtain relevant triples, such as {"CVE-2021-22473", "description", "There is an Authentication yulnerability in Huaweismartphone. Successful exploitation of this vulnerability may affect serviceconfidentiality."}. After the prompt template is built, as shown Figure 4As shown, the question answer is output through a large language model.

[0087] The invention is not limited to the above-mentioned embodiments, and anyone should know that any technical solution identical or similar to the present invention made under the inspiration of the present invention shall fall within the protection scope of the present invention.

Claims

1. A network security-oriented knowledge graph and large model integrated intelligent question answering method, characterized in that: The steps of the method are as follows: (10) Obtain structured entities and entity relationships through large model reasoning for network security issues; (20) Query in the cybersecurity knowledge graph based on structured entity and relationship information; (30) Obtain entity-related triples from the knowledge graph as external knowledge information of the large model; (40) Constructing prompt text based on external knowledge information of the large model; (50) constructing a large language model chain call based on prompt text information; (60) The large model is combined with external knowledge information to obtain the final answer.

2. According to claim 1, a network security-oriented knowledge graph and large model fusion intelligent question answering method is characterized in that: The division steps of (10) are specifically as follows: (11) Select the vicuna open source model as the original base model, use the FastChat framework to deploy the large model, and start the API server to interact with the model; (12) Use LangChain to build a reasonable application based on a large model server to connect the large language model with the knowledge graph database; (13) The network security question to be answered is a query, for example: "Describe what CVE-2021-22473 is". CVE stands for Common Vulnerabilities and Exposures. CVE assigns a unique number to each vulnerability: CVE-YYYY-NNNN. CVE is a fixed prefix, YYYY is the year in the Western calendar, and NNNN is a serial number. In principle, NNNN is a four-digit number. If it is less than four digits, the leading 0 is added. Starting from 2014, it can be up to five digits or more when necessary. Since CVE has many numbering agencies, each numbering agency uses a different numbering segment, so NNNN may not be continuous. Input the query into the application built by LangChain to interact with the large language model. By building LLMChain, chain calls of large model reasoning are performed on complex tasks or applications, and finally one or more entities and entity relationships in the query are obtained; (14) Use Langchain’s PydanticOutputParser output parser to construct the model response into the required Python object. This approach relies on designing well-designed prompts and then parsing the output of the large language model to make them good at extracting information. The specific prompt design is: Build a prompt template that should be formatted as a JSON instance that conforms to the following JSON schema. For example, for the schema {"properties":{"foo":{"title":"Foo","description":"List of strings","type":"array","items":{"type":"string"}}},"required":["foo"]}. The object {"foo":["bar","baz"]} is a well-formed instance of the schema. The object {"properties":{"foo":["bar","baz"]}} is not well-formed. Output schema: {schema}. Where schema is the desired output Python object format; (15) Finally, parse and verify the output format of the schema. Use the function method parse_and_check_json_markdown to parse it. If the format is not JSON, go to step 13. If the format is correct, output it. For example, "Describe what CVE-2021-22473 is", the output is: {"pairs": [{"entity":"CVE-2021-22473","relation":["description"]}]}.

3. According to claim 1, a network security-oriented knowledge graph and large model fusion intelligent question answering method is characterized in that: The division steps of (20) are specifically as follows: (21) KG = (E, R, T) is used to represent the knowledge graph, where the set E consists of entities; the set R consists of relations; and the set T consists of knowledge triples, which are other entities or knowledge attributes. Use Bayesian network as the reasoning framework to quantify the association relationship between entities in the knowledge graph. Extract the optimal structure of entities in the knowledge graph KG, and i The importance value (E i )Reduce the entity scope of KG and obtain the core subgraph. We use W to represent the sum of the importance of all entities in KG, and M max 、M min represents the maximum and minimum number of entities selected, W′ is the sum of the importance of the minimum number of entities to be selected, and the branch and bound algorithm is used to construct the objective function of obtaining the core subgraph: In the formula, when the parameter DW i When the value of DW is 0, it means that the entity is not selected. i When the value of is 1, it indicates that the entity is selected; score max (KG) indicates the importance value (E i ) the maximum subgraph of the sum; (22) Then, based on the core subgraph of the knowledge graph, the link relationship between each entity in the knowledge graph is obtained to construct a directed acyclic graph. The importance value of the entity (E i ) as the basis, when M(X i )>M(X j ), it means that the edge is represented by X in the Bayesian network. i Point to X j , where M(X i ) can be calculated by the following formula: M(X i )=∑value(E i ) The link relationship of the node variable in the Bayesian network is determined by using the calculation result of the above formula, and the above link relationship is stored through the adjacency matrix. The nodes therein are searched in a breadth-first manner. When a node is visited more than once in the Bayesian network, it indicates that there is a loop in the path. Therefore, the adjacency value between the node and the previous node in the network is set to 0. The adjacency matrix finally obtained through the above process is the target directed acyclic graph. (23) Finally, in the above directed acyclic graph, a depth-first traversal algorithm is used to perform query search with the structured entities and entity relationships output in step 16.

4. According to claim 1, a network security-oriented knowledge graph and large model integrated intelligent question answering method is characterized by: (30) All relevant entity triplets are queried in the knowledge graph to establish the answer dataset F as the external knowledge information of the large model.

5. According to claim 1, a network security-oriented knowledge graph and large model fusion intelligent question answering method is characterized in that: The division steps of (40) are specifically as follows: (41) Based on the contextual learning capability of LLM, multiple tasks can share one LLM. The formula for the prompt-based contextual learning implementation process is as follows: Where X Prompt Indicates the prompt instructions for specific tasks, X Context represents the text from which information is to be extracted, y i is the input text category, and Y is the output probability; (42) The question query and the answer data set F of the external information of the large model are integrated to obtain the Input input, and the prompt engineering prompt template is constructed. The construction formula is as follows: Prompt=Prefix+Instruct+Examples+Input Prefix is ​​fixed in use and is used to set the role of the model; Instruct is the instructions related to the specific task; Examples are examples of specific tasks; Input is the input text.

6. The method for intelligent question answering based on knowledge graph and large model fusion for network security according to claim 1, characterized in that: (50) The Langchain technology is used to construct an LLMchain based on the prompt word template, and the data interaction between the large language model and the external knowledge of the model is established. The construction formula of the LLMchain is as follows: LLMchain=prompt_template|model|parser Among them, promp_template is the prompt word template, model is the large language model, and parser is the output parser.

7. The method for intelligent question answering based on the knowledge graph and large model fusion for network security according to claim 1 is characterized by: (60) The large model is combined with external knowledge information to obtain the final answer.

Images