Training method and triple extraction method of network threat intelligence triple extraction model based on prompt enhancement and joint learning

Abstract

The present invention discloses a training method for a network threat intelligence triple extraction model based on prompt enhancement and joint learning, and a triple extraction method, comprising: S1: constructing a question template; S2: constructing a decoder; S3: establishing a first mapping from labeled answer words to relationship labels and a second mapping from relationship labels to answer semantic words; predicting the probability that the relationship of an entity pair is a certain answer word; S4: inputting the hidden layer representation and the embedding vector of the learnable answer semantic word into the relationship prediction layer to obtain a prediction head; S5: selecting the answer word with the highest probability and mapping it to the relationship label according to the first mapping to obtain a predicted relationship; S6: calculating the total loss; S7: performing pre-training; and S8: training the model using a training dataset to obtain a triple joint extraction model. By inputting network threat intelligence data into the model, relationship triples can be obtained. The present invention adopts a joint extraction framework to effectively solve the problem of lack of interaction between entity and relationship tasks.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning, and a triplet extraction method. Background Art

[0002] With the rapid development of cyberspace and the widespread deployment of network technologies, cybersecurity issues are becoming increasingly prominent. Cyber ​​threat intelligence (CTI) is a body of information and knowledge closely related to cybersecurity. It helps us gain a comprehensive and in-depth understanding of the behavioral patterns, motivations, and intent of attackers involved in security threats. This comprehensive and in-depth understanding enables organizations to more effectively implement defensive measures to protect themselves from compromise and, when necessary, take swift and appropriate action to mitigate damage. CTI covers a wide range of analysis areas and is applicable to analyzing a wide range of cyber threats.

[0003] To more effectively manage and rationally utilize cybersecurity-related information and knowledge, building a cyber threat intelligence knowledge graph is an effective solution. A cyber threat intelligence knowledge graph is essentially a structured knowledge base that represents the complex relationships between cyber threat intelligence by connecting scattered data points. Extracting cyber threat intelligence relationship triples is a key step in building a knowledge graph. This involves identifying entities and relationships between entity pairs from raw data and organizing this information into triples (head entity, relationship, tail entity).

[0004] Current methods for extracting triples from network threat intelligence suffer from a lack of interaction between entity and relationship tasks, and require a large amount of data sets for training to achieve good results, which is highly dependent on large-scale annotated data sets. Summary of the Invention

[0005] The purpose of this application is to address the deficiencies in the above-mentioned existing technologies and provide a network threat intelligence triple extraction method based on prompt enhancement and joint learning, which can effectively solve the problem of lack of interaction between entity and relationship tasks and reduce the dependence on large-scale annotated datasets.

[0006] The embodiment of the present invention provides a training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning, and the specific steps are as follows:

[0007] S1: Construct a question template based on the input text sequence and entity type set, concatenate the question template and the text sequence to form an input sequence, and encode the input sequence using a bidirectional encoder;

[0008] S2: Construct a decoder, obtain the first condition and the second condition, independently determine whether the first condition and the second condition are valid, obtain the determination condition of the answer from the cluster of valid solutions, rank the candidate results according to the determination condition, select the top n results as the best candidate results, and the decoder outputs the entity span and entity type;

[0009] S3: Establish the first mapping from the label answer word to the relationship label;

[0010] Establishing a second mapping from the relationship label to the answer semantic word;

[0011] Build a relationship extraction template;

[0012] Constructing learnable answer semantic words, and dynamically adjusting the distribution weights of semantic units through an optimization process to implement constraints on the entity pair relationships;

[0013] Obtaining entity pairs according to the entity span, and predicting the probability that the relationship of the entity pairs is a certain answer word based on the relationship extraction template;

[0014] S4: Input the relation extraction template to the bidirectional encoder to obtain the hidden layer representation, input the hidden layer representation and the embedding vector of the learnable answer semantic word to the relation prediction layer, and the prediction head obtains a probability distribution covering all answer words;

[0015] S5: Select the answer word with the highest probability to obtain a predicted relationship based on the relationship label determined by the first mapping;

[0016] S6: Calculate entity extraction loss, relationship extraction loss and structured loss;

[0017] Calculate the total loss, which is the weighted sum of the entity extraction loss, the relationship extraction loss, and the structured loss;

[0018] Adjust the parameters through the gradient descent algorithm to minimize the total loss;

[0019] S7: Obtain a text dataset in the field of network threat intelligence from a public corpus to form a pre-training corpus, retrieve data related to threat intelligence from the pre-training corpus using a best matching algorithm, perform pre-training using the output data of the best matching algorithm, and further optimize model parameters;

[0020] S8: Use the training data set to train the model; after each training epoch, use the trained model to predict the validation set, and calculate the model's performance indicators based on the model's prediction results and the true labels of the validation set. The performance indicators include accuracy, recall rate and F1 score. Evaluate the current performance of the model based on the calculation results of the performance indicators to obtain evaluation results. Iteratively optimize the training process based on the evaluation results, select the parameter setting when the evaluation indicator reaches the maximum value, and obtain a network threat intelligence triplet extraction model based on prompt enhancement and joint learning.

[0021] Furthermore, in step S2,

[0022] The first condition is a first probability of the starting position of the answer obtained by the classifier;

[0023] The second condition is a second probability of the end position of the answer obtained by the classifier;

[0024] The determination condition is the product of the first probability and the second probability.

[0025] Furthermore, in step S3:

[0026] The relation extraction template includes an input slot, an answer slot, a relation to be extracted, the original input text, the output of the decoder, and an entity type.

[0027] Furthermore, in step S3:

[0028] The specific steps of constructing the learnable answer semantic words are:

[0029] The relationship tag is decomposed into its constituent semantic units, calculation weights are assigned to the semantic units, and a weighted average is calculated using the embedding vectors and weights of the semantic units to obtain an initial embedding vector of the answer semantic word.

[0030] Furthermore, in step S6:

[0031] The binary cross entropy loss function is used to calculate the entity extraction loss, and the asymmetric loss function is used to calculate the relationship extraction loss.

[0032] Furthermore, in step S7,

[0033] The best matching algorithm includes the correlation between the words in the data query function and the corpus documents, the similarity between the words and the query function, and the weight of each word.

[0034] The embodiment of the present invention also provides a network threat intelligence triple extraction method based on prompt enhancement and joint learning, the specific steps are as follows:

[0035] Apply any of the above-mentioned triple extraction model training methods, input network threat intelligence data into the model obtained in S8, and obtain relationship triples.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] (1) A joint extraction framework is adopted to enable entity recognition and relation extraction tasks to share parameters, effectively solving the problem of lack of interaction between entity and relation tasks.

[0038] (2) Using large-scale pre-trained language models such as BERT to perform in-depth semantic encoding of input text has significantly improved the semantic understanding and expression capabilities of network threat intelligence text.

[0039] (3) Using a hint-based approach, we redesign the input of the language model and use specific templates to guide the pre-trained model to focus on task-relevant information. This approach reduces the reliance on large-scale annotated datasets and enables the model to be effectively trained even with few sample data. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a schematic diagram of the overall process of the training method of the network threat intelligence triplet extraction model based on prompt enhancement and joint learning provided by the present invention. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] Example 1:

[0043] This embodiment provides a training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning, such as Figure 1 The specific steps are as follows:

[0044] S1: Construct a question template based on the input text sequence and entity type set, such as "What is the [E]?", where E contains different entity types. For example, take E i For organization, the question-answering template is What is the organization? For a text entity recognition task, it is necessary to generate m prompt templates for E containing m entity types.

[0045] The question template and the text sequence are concatenated to form an input sequence, and the input sequence is encoded using a bidirectional encoder; for example, if the input text is Meiis from guangzhou in China, the input Bert sequence is What is the E i ? Meiis from guangzhou in China.

[0046] The input sequence is represented as S = {s1, s2, ..., s n}, S i Represents the i-th word of the sequence; then use the BERT encoder to encode the representation of the input sequence S into H = {h1,h2,…,h n}, the formula is as follows:

[0047] H = Bert(S; θ Bert ).

[0048] S2: Construct a decoder, obtain the first condition and the second condition, independently determine whether the first condition and the second condition are valid, obtain the determination condition of the answer from the cluster of valid solutions, rank the candidate results according to the determination condition, select the top n results as the best candidate results, and the decoder outputs the entity span and entity type;

[0049] The first condition is a first probability of the starting position of the answer obtained by the classifier;

[0050] The second condition is a second probability of the end position of the answer obtained by the classifier;

[0051] The determination condition is the product of the first probability and the second probability.

[0052] The decoder is composed of a start word classifier and an end word classifier; the start word classifier predicts the beginning of the marked answer, and the end word classifier predicts the end of the marked answer;

[0053] The prediction of each entity type is based on each word S i Starting score Ps i and the ending score Pe i , first calculate the start / end score of each word, determine whether it reaches the correct threshold (the threshold is 0.5), and then make Ps i* Pe i Maximized S i and e i As the starting and ending positions of the answer; the formula is as follows:

[0054] Ps i =softmax(W·h i +b s )

[0055] Pe i =softmax(W′·h i +b e )

[0056] P(Si)=max(Ps i ,0.5)*max(Pe i ,0.5).

[0057] S3: The prompt contains a relation extraction template and label answer words.

[0058] Establish the first mapping from the label answer word to the relationship label; directly map the label answer word Z to the relationship label Y, M:Y→Z;

[0059] Establishing a second mapping from the relationship label to the answer semantic word;

[0060] Construct a relation extraction template, for example: x' = "[X], [Entity1] is a E1 what is [MASK] to [Entity2], which is a E2." The relation extraction template T includes the input slot [X] and the answer slot [Z], the relation to be extracted [MASK], the original input text [X], the output of the QA decoder [Entity], and the entity type Ei; the formula is as follows:

[0061] Z=M(Y)

[0062] x′=fprompt(x).

[0063] Construct a learnable answer semantic word, dynamically adjust the distribution weight of the semantic unit through the optimization process, and implement the constraint on the entity-to-relationship; use the semantic knowledge of the relationship label to initialize the answer semantic word, and each relationship label is mapped to an answer semantic word to represent the implicit semantics of the relationship label. Since the type of entity will constrain the extraction of the relationship, while embedding the entity type of the output entity span of the decoder into the relationship extraction template, a learnable answer semantic word is constructed to implement the constraint on the entity-to-relationship, so as to better capture the semantic information between entities and relationships. The answer semantic word involves converting the relationship label into a semantic representation that can initialize the embedding vector. First, the relationship label (such as "per:city_of_birth") is decomposed into its constituent semantic units e(r i), (e.g., {"person", "city", "of", "birth"}). Next, weights are assigned to these semantic units. Finally, the embedding vectors of these semantic units and their weights are used to calculate the weighted average to obtain the initial embedding vector of the answer semantic word. The answer semantic word can be further optimized during the model training process. If the relationship label is decomposed into m semantic units, the formula is as follows:

[0064]

[0065] Entity pairs are obtained based on the entity span, and the probability of the relationship between the entity pairs being a certain answer word is predicted based on the relationship extraction template. After obtaining the entity pairs based on the decoder output, the relationship extraction template is applied, for example, x' is changed to "Meiis from guangzhou in China, [Mei] is a person what is [Z] to [guangzhou], which is a location.", where [MASK] is a slot to be filled to represent the relationship. The probability of the relationship to be extracted [MASK] being a certain answer is predicted to obtain the relationship between entities.

[0066] S4: Input the relation extraction template to the bidirectional encoder to obtain the hidden layer representation. For example, input the relation extraction template to the Bert model to obtain the output hidden layer representation H′={h′1,h′1,…,h′ Z ,…,h′ n}, and then add the embedding vector of the learnable answer word to the representation to obtain H″, the formula is as follows:

[0067] H′=Bert((x′);θ′ Bert )

[0068] H″={h′1,h′1,…,h′ Z ,…,h′ n};e [rel] (v);

[0069] The hidden layer representation and the embedding vector of the learnable answer semantic word are input to the relationship prediction layer. The prediction head obtains a probability distribution covering all answer words. H' is used as the input of the relationship prediction layer, and a linear layer is used to predict the relationship. The essence of the prediction head is the probability distribution P, which is obtained as follows:

[0070] P(y;x)=P([MASK]=z|x′)=softmax(W′·H″+b′).

[0071] S5: Select the answer ^z with the highest probability and obtain the predicted relationship y according to the relationship label determined by the first mapping.

[0072] S6: Calculate entity extraction loss, relationship extraction loss and structured loss; calculate the loss using binary cross entropy as the basic loss function, and introduce ASL (Asymmetric Loss, ASL for short) to deal with the imbalance problem. At the same time, taking into account the association in the triple structure, structured loss is used for further optimization. The parameters of the answer semantic words are adjusted by the gradient descent algorithm to minimize the total loss in order to better adapt to specific relationship extraction tasks. Calculate the total loss, which is the weighted sum of the entity extraction loss, relationship extraction loss and structured loss;

[0073] Adjust the parameters through the gradient descent algorithm to minimize the total loss;

[0074] The binary cross entropy loss function is used to calculate the entity extraction loss, and the asymmetric loss function is used to calculate the relationship extraction loss.

[0075] S7: A text dataset in the field of cyber threat intelligence is obtained from a public corpus to form a pre-training corpus. Data related to threat intelligence is retrieved from the pre-training corpus using a best matching algorithm. The output data of the best matching algorithm is used for pre-training to further optimize the model parameters. Before fine-tuning the model for the task of jointly extracting entities and relationships in threat intelligence, domain adaptive pre-training can improve the model's initial understanding of domain data, helping to narrow the gap between the pre-trained model and specific domain applications, thereby potentially improving performance after fine-tuning. The best matching algorithm includes the correlation between words in the data query function and corpus documents, the similarity between words and the query function, and the weight of each word.

[0076] S8: Train the model using the training dataset; after each training epoch, use the trained model to predict the validation set. Calculate the model's performance metrics based on the model's predictions and the true labels of the validation set. These metrics include accuracy, recall, and F1 score. Evaluate the model's current performance based on the calculated performance metrics to obtain evaluation results. Iteratively optimize the training process based on the evaluation results, selecting the parameter settings that maximize the evaluation metrics to obtain a network threat intelligence triplet extraction model based on prompt enhancement and joint learning. Adjusting training parameters typically requires based on the model's performance on the validation set (accuracy, recall, F1 score) to ensure the model's generalization ability on new data. Parameter adjustment is an iterative process that requires multiple attempts and evaluations to find the optimal parameter combination.

[0077] In a preferred embodiment, step S6 includes:

[0078] S6.1: Use the binary cross entropy loss function to calculate the loss of entity extraction. The formula is as follows:

[0079] J[E]=-tlogy-(1-t)log(1-y);

[0080] The output of the model is y∈[0,1], which represents the probability of a positive sample, and the actual label t∈{0,1}, where t=1 represents a positive sample and t=0 represents a negative sample;

[0081] ASL is used to calculate the loss of relation extraction. During training, ASL causes the model to focus more on negative samples that are difficult to classify, rather than those that are easily classified correctly. Asymmetric focusing is used to assign different exponential decay factors (i.e., focusing parameters γ+ and γ-) to positive and negative samples to decouple the modulation of positive and negative samples. ASL implements hard thresholding by defining a transition probability pm, that is, when the probability of a negative sample is very low, these samples are completely discarded. Where m is an adjustable hyperparameter called the probability margin.

[0082] The ASL includes positive sample loss, negative sample loss and probability transfer mechanism pm, and the formula is as follows:

[0083]

[0084] pm=max(pm,0)

[0085] J[MASK]=L + +L - ;

[0086] S6.2: Taking into account the structural association of the triple (s, r, o), structured loss is used for further optimization. The structured loss function optimizes the positive samples by minimizing the score function of the correct relationship, so that the model tends to predict the correct entities and relationships. Negative samples (negative samples are constructed by randomly sampling irrelevant entities for the correct relationship during the negative sampling process) are penalized to maximize the difference with the negative samples and avoid predicting wrong samples. In this way, the model can learn the structural relationship between relations and entities. The total task loss is the weighted sum of the context loss and the structured constraint loss, and the parameters are adjusted by the gradient descent algorithm to minimize the total loss. The formula is as follows:

[0087]

[0088] dr(s,o)=||s+ro||2

[0089] J=J[E]+J[MASK]+J[(s,r,o)];

[0090] Among them, s in (s, r, o) represents the entity type of the main entity, o represents the entity type of the tail entity, and r represents the answer word z; among them, (s′, o′, r′) is a negative sample, γ is the edge parameter controlling the score difference between positive and negative samples, σ is the sigmoid function, and dr is the scoring function.

[0091] In a preferred embodiment, step S7 includes:

[0092] S7.1: Text data in a specific field includes academic papers, professional reports, industry news, case studies, etc. The domain-related data is retrieved from the corpus through the best matching algorithm BM25 score. The relevant data refers to data about threat intelligence, such as: documents with specific technical details of threat intelligence, malware analysis reports, vulnerability exploitation methods, security configuration guides, etc. Reports describing network attack incidents. News reports, official announcements and warnings related to network security, which may contain the latest threat intelligence and security incidents. Research papers in academia and industry, as well as in-depth analysis of specific threats or incidents. The BM25 formula includes the word q in the query. i The correlation between the word q and the document d i Similarity with the query and weight of each word:

[0093]

[0094] Where: Wi represents the IDF weight of word qi; k1, k2, b are adjustment factors, fi represents the frequency of word qi in d, qf i Indicates the frequency of word qi in the input sentence; pre-training is performed after retrieving domain-specific text from a public corpus;

[0095] S7.2: Continue training the selected pre-trained model using domain-specific data to further optimize the model’s parameters.

[0096] In a preferred embodiment, k1 is 2 and b is 0.75.

[0097] Example 2:

[0098] This embodiment provides a network threat intelligence triple extraction method based on prompt enhancement and joint learning. The specific steps are as follows:

[0099] Apply the training method of the triple extraction model described in any one of Example 1, input network threat intelligence data into the model obtained in S8, and obtain relationship triples.

[0100] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the claims of the present invention.

Claims

1. A training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning, characterized in that: The specific steps are as follows: S1: Construct a question template based on the input text sequence and entity type set, concatenate the question template and the text sequence to form an input sequence, and encode the input sequence using a bidirectional encoder; S2: Construct a decoder, obtain the first condition and the second condition, independently determine whether the first condition and the second condition are valid, obtain the determination condition of the answer from the cluster of valid solutions, rank the candidate results according to the determination condition, select the top n results as the best candidate results, and the decoder outputs the entity span and entity type; S3: Establish the first mapping from the label answer word to the relationship label; Establishing a second mapping from the relationship label to the answer semantic word; Build a relationship extraction template; Construct learnable answer semantic words and dynamically adjust the distribution weights of semantic units through optimization process to implement constraints on entity pair relationships; Obtaining entity pairs according to the entity span, and predicting the probability that the relationship of the entity pairs is a certain answer word based on the relationship extraction template; S4: Input the relation extraction template to the bidirectional encoder to obtain the hidden layer representation, input the hidden layer representation and the embedding vector of the learnable answer semantic word to the relation prediction layer, and the prediction head obtains a probability distribution covering all answer words; S5: Select the answer word with the highest probability to obtain a predicted relationship based on the relationship label determined by the first mapping; S6: Calculate entity extraction loss, relationship extraction loss and structured loss; Calculate the total loss, which is the weighted sum of the entity extraction loss, the relationship extraction loss, and the structured loss; Adjust the parameters through the gradient descent algorithm to minimize the total loss; S7: Obtain a text dataset in the field of network threat intelligence from a public corpus to form a pre-training corpus, retrieve data related to threat intelligence from the pre-training corpus using a best matching algorithm, perform pre-training using the output data of the best matching algorithm, and further optimize model parameters; S8: Use the training data set to train the model; after each training epoch, use the trained model to predict the validation set, and calculate the model's performance indicators based on the model's prediction results and the true labels of the validation set. The performance indicators include accuracy, recall rate and F1 score. Evaluate the current performance of the model based on the calculation results of the performance indicators to obtain evaluation results. Iteratively optimize the training process based on the evaluation results, select the parameter setting when the evaluation indicator reaches the maximum value, and obtain a network threat intelligence triplet extraction model based on prompt enhancement and joint learning.

2. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In the step S2, The first condition is a first probability of the starting position of the answer obtained by the classifier; The second condition is a second probability of the end position of the answer obtained by the classifier; The determination condition is the product of the first probability and the second probability.

3. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In the step S3: The relation extraction template includes an input slot, an answer slot, a relation to be extracted, the original input text, the output of the decoder, and an entity type.

4. The training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In the step S3: The specific steps of constructing the learnable answer semantic words are: The relationship tag is decomposed into its constituent semantic units, calculation weights are assigned to the semantic units, and a weighted average is calculated using the embedding vectors and weights of the semantic units to obtain an initial embedding vector of the answer semantic word.

5. The training method for the network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In step S6: The binary cross entropy loss function is used to calculate the entity extraction loss, and the asymmetric loss function is used to calculate the relationship extraction loss.

6. The training method for a network threat intelligence triplet extraction model based on prompt enhancement and joint learning according to claim 1 is characterized in that: In the step S7, The best matching algorithm includes the correlation between the words in the data query function and the corpus documents, the similarity between the words and the query function, and the weight of each word.

7. A network threat intelligence triplet extraction method based on prompt enhancement and joint learning, characterized by: Apply the training method of the triple extraction model described in any one of claims 1-6, input network threat intelligence data into the model obtained in S8, and obtain relationship triples.

Images