Training method of network threat intelligence triple extraction model based on prompt enhancement and joint learning and triple extraction method

Abstract

The invention discloses a training method of a network threat intelligence triple extraction model based on prompt enhancement and joint learning and a triple extraction method. The training method comprises the following steps: S1, constructing a problem template; s2, constructing a decoder; s3, establishing a first mapping from the tag answer word to the relation tag and a second mapping from the relation tag to the answer semantic word; predicting the probability that the relation of the entity pairs is a certain answer word; s4, inputting a hidden layer representation and an embedding vector of a learnable answer semantic word to a relation prediction layer to obtain a prediction header; s5, selecting the answer word with the highest probability, and mapping the answer word to the relation label according to the first mapping to obtain a prediction relation; s6, calculating the total loss; s7, carrying out pre-training; and S8, training the model by using the training data set to obtain a triple combined extraction model. A relation triple can be obtained by inputting network threat intelligence data to the model. According to the method, a combined extraction framework is adopted, and the problem of lack of interaction between entities and relation tasks is effectively solved.

Description

Technical Field

[0001] The utility model relates to the field of network security technology, and in particular to a training method of a network threat intelligence triplet extraction model based on prompt enhancement and joint learning and a triplet extraction method. Background Art

[0002] With the rapid development of cyberspace and the widespread deployment of network technology, network security issues have become increasingly prominent. Cyber ​​threat intelligence (CTI) is a system of information and knowledge closely related to network security. It can help us fully and deeply understand the behavior patterns of security threats, the motivations behind them, and the intentions of attackers. With this comprehensive and in-depth understanding, organizations can more effectively implement defensive measures to protect themselves from harm and take reasonable actions quickly to reduce damage when necessary. CTI has a wide range of analysis content and is suitable for analyzing a variety of network threats.

[0003] In order to more effectively manage and reasonably utilize information and knowledge related to network security, building a network threat intelligence knowledge graph is an effective solution. The network threat intelligence knowledge graph is essentially a structured knowledge base that represents the complex relationships between network threat intelligence by connecting scattered data points. Network threat intelligence relationship triple extraction is a key step in building a knowledge graph, which involves identifying entities and relationships between entity pairs from raw data and organizing this information into triples (head entity, relationship, tail entity).

[0004] The current methods for extracting triples of network threat intelligence suffer from the problem of lack of interaction between entity and relationship tasks, and require a large amount of data sets for training to achieve better results, which is highly dependent on large-scale annotated data sets. Summary of the invention

[0005] The purpose of this application is to provide a network threat intelligence triple extraction method based on prompt enhancement and joint learning to address the deficiencies in the above-mentioned prior art, which can effectively solve the problem of lack of interaction between entity and relationship tasks and reduce the dependence on large-scale annotated datasets.

[0006] The embodiment of the present invention provides a training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning, and the specific steps are as follows:

[0007] S1: construct a question template according to the input text sequence and entity type set, concatenate the question template and the text sequence to form an input sequence, and encode the input sequence using a bidirectional encoder;

[0008] S2: construct a decoder, obtain the first condition and the second condition, independently determine whether the first condition and the second condition are valid, obtain the determination condition of the answer from the cluster of valid solutions, rank the candidate results according to the determination condition, select the top n results as the best candidate results, and the decoder outputs the entity span and entity type;

[0009] S3: Establish a first mapping from label answer words to relationship labels;

[0010] Establishing a second mapping from the relationship label to the answer semantic word;

[0011] Build a relation extraction template;

[0012] Constructing learnable answer semantic words, dynamically adjusting the distribution weights of semantic units through an optimization process, and implementing constraints on the entity pair relationships;

[0013] Obtaining entity pairs according to the entity span, and predicting the probability that the relationship of the entity pairs is a certain answer word based on the relationship extraction template;

[0014] S4: Input the relation extraction template to the bidirectional encoder to obtain the hidden layer representation, input the hidden layer representation and the embedding vector of the learnable answer semantic word to the relation prediction layer, and the prediction head obtains a probability distribution covering all answer words;

[0015] S5: Select the answer word with the highest probability to obtain a predicted relationship according to the relationship label determined by the first mapping;

[0016] S6: Calculate entity extraction loss, relationship extraction loss and structured loss;

[0017] Calculate the total loss, where the total loss is the weighted sum of the entity extraction loss, the relationship extraction loss, and the structured loss;

[0018] Adjust the parameters through the gradient descent algorithm to minimize the total loss;

[0019] S7: Acquire a text data set in the field of network threat intelligence from a public corpus to form a pre-training corpus, retrieve data related to threat intelligence from the pre-training corpus through a best matching algorithm, use the output data of the best matching algorithm for pre-training, and further optimize the parameters of the model;

[0020] S8: Use the training data set to train the model; after each training epoch, use the trained model to predict the validation set, calculate the performance indicators of the model according to the prediction results of the model and the true labels of the validation set, and the performance indicators include accuracy, recall rate and F1 score. Evaluate the current performance of the model according to the calculation results of the performance indicators to obtain evaluation results, iteratively optimize the training process according to the evaluation results, select the parameter setting when the evaluation indicator reaches the maximum value, and obtain the network threat intelligence triplet extraction model based on prompt enhancement and joint learning.

[0021] Furthermore, in step S2,

[0022] The first condition is a first probability of the starting position of the answer obtained by the classifier;

[0023] The second condition is a second probability of the end position of the answer obtained by the classifier;

[0024] The determination condition is the product of the first probability and the second probability.

[0025] Furthermore, in step S3:

[0026] The relation extraction template includes an input slot, an answer slot, a relation to be extracted, the original input text, the output of the decoder, and an entity type.

[0027] Furthermore, in step S3:

[0028] The specific steps of constructing the learnable answer semantic words are:

[0029] The relationship tag is decomposed into its constituent semantic units, calculation weights are assigned to the semantic units, and the weighted average is calculated using the embedding vectors and weights of the semantic units to obtain the initial embedding vector of the answer semantic word.

[0030] Furthermore, in step S6:

[0031] The binary cross entropy loss function is used to calculate the entity extraction loss, and the asymmetric loss function is used to calculate the relationship extraction loss.

[0032] Furthermore, in step S7,

[0033] The best matching algorithm includes the correlation between the words in the data query function and the corpus documents, the similarity between the words and the query function, and the weight of each word.

[0034] The embodiment of the present invention also provides a network threat intelligence triple extraction method based on prompt enhancement and joint learning, and the specific steps are as follows:

[0035] Apply any of the above-mentioned training methods for the triple extraction model, input the network threat intelligence data into the model obtained in S8, and obtain the relationship triples.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] (1) A joint extraction framework is adopted to enable entity recognition and relation extraction tasks to share parameters, effectively solving the problem of lack of interaction between entity and relation tasks.

[0038] (2) Using large-scale pre-trained language models such as BERT to perform in-depth semantic encoding of input text has significantly improved the semantic understanding and expression capabilities of network threat intelligence text.

[0039] (3) Using a prompt-based approach, by redesigning the input of the language model, a specific template is used to guide the pre-trained model to focus on task-related information. This approach reduces the reliance on large-scale annotated datasets, allowing the model to be effectively trained even with few sample data. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of the overall process of the training method of the network threat intelligence triplet extraction model based on prompt enhancement and joint learning provided by the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] Embodiment 1:

[0043] This embodiment provides a training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning, such as Figure 1 As shown, the specific steps are as follows:

[0044] S1: Construct a question template based on the input text sequence and entity type set, such as "What is the [E]?", where E contains different entity types. i For organization, the question-answering template is What is the organization? For a text entity recognition task, it is necessary to generate m prompt templates for E containing m entity types.

[0045] The question template and the text sequence are concatenated to form an input sequence, and the input sequence is encoded using a bidirectional encoder; for example, if the input text is Meiis from guangzhou in China, then the input Bert sequence is What is the E i ? Meiis from guangzhou in China.

[0046] The input sequence is represented as S = {s1, s2, ..., s n},S i represents the i-th word in the sequence; then the BERT encoder is used to encode the representation of the input sequence S into H = {h1,h2,…,h n}, the formula is as follows:

[0047] H = Bert(S; θ Bert ).

[0048] S2: construct a decoder, obtain the first condition and the second condition, independently determine whether the first condition and the second condition are valid, obtain the determination condition of the answer from the cluster of valid solutions, rank the candidate results according to the determination condition, select the top n results as the best candidate results, and the decoder outputs the entity span and entity type;

[0049] The first condition is a first probability of the starting position of the answer obtained by the classifier;

[0050] The second condition is a second probability of the end position of the answer obtained by the classifier;

[0051] The determination condition is the product of the first probability and the second probability.

[0052] The decoder is composed of a start word classifier and an end word classifier; the start word classifier predicts the beginning of the marked answer, and the end word classifier predicts the end of the marked answer;

[0053] The prediction of each entity type is based on each word S i The starting score Ps i and the end score Pe i , first calculate the start / end score of each word, determine whether it reaches the correct threshold (the threshold is 0.5), and then make Ps i* P i Maximized S i and e i As the starting and ending position of the answer; the formula is as follows:

[0054] Ps i =softmax(W·h i +b s )

[0055] P i =softmax(W′·h i +b e )

[0056] P(Si)=max(Ps i ,0.5)*max(Pe i ,0.5).

[0057] S3: The prompt contains a relation extraction template and label answer words.

[0058] Establish the first mapping from the label answer word to the relationship label; directly map the label answer word Z to the relationship label Y, M:Y→Z;

[0059] Establishing a second mapping from the relationship label to the answer semantic word;

[0060] Construct a relation extraction template, for example: x' = "[X], [Entity1] is a E1 what is [MASK] to [Entity2], which is a E2.". The relation extraction template T includes the input slot [X] and the answer slot [Z], the relation to be extracted [MASK], the original input text [X], the output of the QA decoder [Entity] and the entity type Ei; the formula is as follows:

[0061] Z=M(Y)

[0062] x′=fprompt(x).

[0063] Construct a learnable answer semantic word, dynamically adjust the assigned weights of the semantic units through an optimization process, and implement constraints on the entity-to-relationship; use the semantic knowledge of the relationship label to initialize the answer semantic word, and each relationship label is mapped to an answer semantic word that represents the implicit semantics of the relationship label. Since the type of entity will constrain the extraction of the relationship, while embedding the entity type of the output entity span of the decoder into the relationship extraction template, a learnable answer semantic word is constructed to implement the constraint of the entity on the relationship, so as to better capture the semantic information between entities and relationships. The answer semantic word involves converting the relationship label into a semantic representation that can initialize the embedding vector. First, the relationship label (for example, "per:city_of_birth") is decomposed into its constituent semantic units e(r i), (e.g. {"person", "city", "of", "birth"}). Next, these semantic units are assigned calculation weights, and finally, the embedding vectors of these semantic units and their weights are used to calculate the weighted average to obtain the initial embedding vector of the answer semantic word. And the answer semantic word can be further optimized during the model training process. If the relationship label is decomposed into m semantic units, the formula is as follows:

[0064]

[0065] An entity pair is obtained according to the entity span, and the probability that the relationship of the entity pair is a certain answer word is predicted based on the relationship extraction template as a condition; after the entity pair is obtained according to the output of the decoder, the relationship extraction template is applied, for example, x' is changed to "Meiis from guangzhou in China, [Mei] is a person what is [Z] to [guangzhou], which is a location.", where [MASK] is a slot to be filled to represent the relationship, and the probability that the relationship [MASK] to be extracted is a certain answer is predicted to obtain the relationship between entities;

[0066] S4: Input the relation extraction template to the bidirectional encoder to obtain the hidden layer representation. For example, input the relation extraction template to the Bert model to obtain the output hidden layer representation H′={h′1,h′1,…,h′ Z ,…,h′ n}, and then add the embedding vector of the learnable answer word to the representation to get H″, the formula is as follows:

[0067] H′=Bert((x′);θ′ Bert )

[0068] H″={h′1,h′1,…,h′ Z ,…,h′ n};e [rel] (v);

[0069] The hidden layer representation and the embedding vector of the learnable answer semantic word are input to the relationship prediction layer, and the prediction head obtains a probability distribution covering all answer words; H' is used as the input of the relationship prediction layer, and a linear layer is used to predict the relationship. The essence of the prediction head is the probability distribution P, which is as follows:

[0070] P(y;x)=P([MASK]=z|x′)=softmax(W′·H″+b′).

[0071] S5: Select the answer ^z with the highest probability and obtain the predicted relationship y according to the relationship label determined by the first mapping.

[0072] S6: Calculate entity extraction loss, relationship extraction loss and structured loss; use binary cross entropy as the basic loss function to calculate the loss, and introduce ASL (Asymmetric Loss, ASL for short) to deal with the imbalance problem. At the same time, considering the association in the triple structure, use structured loss for further optimization. Adjust the parameters of the answer semantic words through the gradient descent algorithm to minimize the total loss in order to better adapt to specific relationship extraction tasks. Calculate the total loss, which is the weighted sum of the entity extraction loss, relationship extraction loss and structured loss;

[0073] Adjust the parameters through the gradient descent algorithm to minimize the total loss;

[0074] The binary cross entropy loss function is used to calculate the entity extraction loss, and the asymmetric loss function is used to calculate the relationship extraction loss.

[0075] S7: A text data set in the field of network threat intelligence is obtained from a public corpus to form a pre-trained corpus, data related to threat intelligence is retrieved from the pre-trained corpus through the best matching algorithm, and the output data of the best matching algorithm is used for pre-training to further optimize the parameters of the model; before the model is fine-tuned for prompts of the entity and relationship joint extraction task of threat intelligence, the model's initial understanding of the domain data can be improved through domain adaptive pre-training, which helps to narrow the gap between the pre-trained model and the application in a specific field, thereby possibly improving the performance after fine-tuning. The best matching algorithm includes the correlation between the word in the data query function and the corpus document, the similarity between the word and the query function, and the weight of each word.

[0076] S8: Use the training data set to train the model; after each training epoch, use the trained model to predict the validation set, calculate the performance indicators of the model based on the prediction results of the model and the real labels of the validation set, and the performance indicators include accuracy, recall rate and F1 score. Evaluate the current performance of the model based on the calculation results of the performance indicators to obtain the evaluation results, iteratively optimize the training process based on the evaluation results, select the parameter setting when the evaluation indicator reaches the maximum value, and obtain the network threat intelligence triple extraction model based on prompt enhancement and joint learning. Adjusting the training parameters usually needs to be based on the performance of the model on the validation set (accuracy, recall rate, F1 score) to ensure the generalization ability of the model on new data. Adjusting the parameters is an iterative process, and multiple attempts and evaluations are required to find the optimal parameter combination.

[0077] In a preferred embodiment, step S6 comprises:

[0078] S6.1: Use the binary cross entropy loss function to calculate the loss of entity extraction. The formula is as follows:

[0079] J[E]=-tlogy-(1-t)log(1-y);

[0080] The output of the model is y∈[0,1], which represents the probability of a positive sample, and the actual label t∈{0,1}, where t=1 represents a positive sample and t=0 represents a negative sample.

[0081] ASL is used to calculate the loss of relation extraction. ASL makes the model pay more attention to negative samples that are difficult to classify during training, rather than those that can be easily classified correctly. It decouples the modulation of positive and negative samples by assigning different exponential decay factors (i.e., focusing parameters γ+ and γ-) to positive and negative samples through asymmetric focusing. ASL implements hard threshold processing by defining a transition probability pm, that is, when the probability of negative samples is very low, these samples are completely discarded. Among them, m is an adjustable hyperparameter called the probability boundary.

[0082] The ASL includes positive sample loss, negative sample loss and probability transfer mechanism pm, and the formula is as follows:

[0083]

[0084] pm=max(pm,0)

[0085] J[MASK]=L + +L - ;

[0086] S6.2: Considering the structural association of the triple (s, r, o), structured loss is used for further optimization. The structured loss function optimizes the positive samples by minimizing the score function of the correct relationship, so that the model tends to predict the correct entities and relationships. Negative samples (negative samples are constructed by randomly sampling irrelevant entities for the correct relationship during the negative sampling process) are penalized to maximize the difference with negative samples and avoid predicting wrong samples. In this way, the model can learn the structural relationship between relations and entities. The total task loss is the weighted sum of the context loss and the structured constraint loss, and the parameters are adjusted by the gradient descent algorithm to minimize the total loss. The formula is as follows:

[0087]

[0088] dr(s,o)=||s+ro||2

[0089] J=J[E]+J[MASK]+J[(s,r,o)];

[0090] Among them, s in (s, r, o) represents the entity type of the main entity, o represents the entity type of the tail entity, and r represents the answer word z; among them, (s′, o′, r′) is a negative sample, γ is the edge parameter that controls the score difference between positive and negative samples, σ is the sigmoid function, and dr is the score function.

[0091] In a preferred embodiment, step S7 comprises:

[0092] S7.1: Text data in a specific field includes academic papers, professional reports, industry news, case studies, etc. The domain-related data is retrieved from the corpus through the best matching algorithm BM25 score. The relevant data refers to data about threat intelligence, such as: documents with specific technical details of threat intelligence, malware analysis reports, vulnerability exploitation methods, security configuration guides, etc. Reports describing network attack incidents. News reports, official announcements and warnings related to network security, which may contain the latest threat intelligence and security incidents. Research papers in academia and industry, as well as in-depth analysis of specific threats or incidents. The BM25 formula includes the word q in the query. i The correlation between d and the document, word q i Similarity with the query and weight of each word:

[0093]

[0094] Where: Wi represents the IDF weight of word qi; k1, k2, b are adjustment factors, fi represents the frequency of word qi in d, qf i Indicates the frequency of word qi in the input sentence; pre-training is performed after retrieving domain-specific texts from a public corpus;

[0095] S7.2: Continue training the selected pre-trained model using domain-specific data to further optimize the model’s parameters.

[0096] In a preferred embodiment, k1 is 2, and b is 0.75.

[0097] Embodiment 2:

[0098] This embodiment provides a network threat intelligence triple extraction method based on prompt enhancement and joint learning, and the specific steps are as follows:

[0099] Apply the training method of the triple extraction model described in any one of Example 1, input the network threat intelligence data into the model obtained in S8, and obtain the relationship triples.

[0100] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning, characterized in that: The specific steps are as follows: S1: construct a question template according to the input text sequence and entity type set, concatenate the question template and the text sequence to form an input sequence, and encode the input sequence using a bidirectional encoder; S2: construct a decoder, obtain the first condition and the second condition, independently determine whether the first condition and the second condition are valid, obtain the determination condition of the answer from the cluster of valid solutions, rank the candidate results according to the determination condition, select the top n results as the best candidate results, and the decoder outputs the entity span and entity type; S3: Establish a first mapping from label answer words to relationship labels; Establishing a second mapping from the relationship label to the answer semantic word; Build a relation extraction template; Constructing learnable answer semantic words, dynamically adjusting the distribution weights of semantic units through an optimization process, and implementing constraints on the entity pair relationships; Obtaining entity pairs according to the entity span, and predicting the probability that the relationship of the entity pairs is a certain answer word based on the relationship extraction template; S4: Input the relation extraction template to the bidirectional encoder to obtain the hidden layer representation, input the hidden layer representation and the embedding vector of the learnable answer semantic word to the relation prediction layer, and the prediction head obtains a probability distribution covering all answer words; S5: Select the answer word with the highest probability to obtain a predicted relationship according to the relationship label determined by the first mapping; S6: Calculate entity extraction loss, relationship extraction loss and structured loss; Calculate the total loss, where the total loss is the weighted sum of the entity extraction loss, the relationship extraction loss, and the structured loss; Adjust the parameters through the gradient descent algorithm to minimize the total loss; S7: Acquire a text data set in the field of network threat intelligence from a public corpus to form a pre-training corpus, retrieve data related to threat intelligence from the pre-training corpus through a best matching algorithm, use the output data of the best matching algorithm for pre-training, and further optimize the parameters of the model; S8: Use the training data set to train the model; after each training epoch, use the trained model to predict the validation set, calculate the performance indicators of the model according to the prediction results of the model and the true labels of the validation set, and the performance indicators include accuracy, recall rate and F1 score. Evaluate the current performance of the model according to the calculation results of the performance indicators to obtain evaluation results, iteratively optimize the training process according to the evaluation results, select the parameter setting when the evaluation indicator reaches the maximum value, and obtain the network threat intelligence triplet extraction model based on prompt enhancement and joint learning.

2. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In the step S2, The first condition is a first probability of the starting position of the answer obtained by the classifier; The second condition is a second probability of the end position of the answer obtained by the classifier; The determination condition is the product of the first probability and the second probability.

3. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In step S3: The relation extraction template includes an input slot, an answer slot, a relation to be extracted, original input text, an output of a decoder, and an entity type.

4. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In step S3: The specific steps of constructing the learnable answer semantic words are: The relationship tag is decomposed into its constituent semantic units, calculation weights are assigned to the semantic units, and the weighted average is calculated using the embedding vectors and weights of the semantic units to obtain the initial embedding vector of the answer semantic word.

5. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In step S6: The binary cross entropy loss function is used to calculate the entity extraction loss, and the asymmetric loss function is used to calculate the relationship extraction loss.

6. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In step S7, The best matching algorithm includes the correlation between the words in the data query function and the corpus documents, the similarity between the words and the query function, and the weight of each word.

7. A network threat intelligence triplet extraction method based on prompt enhancement and joint learning, characterized in that: Apply the training method of the triple extraction model described in any one of claims 1-6, input network threat intelligence data into the model obtained in S8, and obtain relationship triples.

Images