Entity marking method, electronic equipment, storage medium and computer program product

Abstract

The invention provides an entity marking method, electronic equipment, a storage medium and a computer program product. The method comprises the following steps: obtaining a feature vector of each tag marked as each word in a to-be-marked text based on a preset feature function set, wherein each word in the to-be-marked text is marked as a preset tag; an element value in the feature vector corresponds to a feature function in a feature function set, and the element value is obtained by performing rule verification on at least one of the current word, the previous word of the current word, the first two words of the current word, the tag of the current word, the tag of the previous word and the tags of the first two words by using the corresponding feature function; inputting the feature vector into an entity marking model, and obtaining a conditional probability that a word output by the entity marking model belongs to each tag; the entity marking model is obtained by training a maximum entropy model by using an average perceptron algorithm based on a training sample; and determining a target entity label corresponding to the word according to the conditional probability. The manual analysis time and the calculation cost of a computer are reduced.

Description

Technical Field

[0001] The present application relates to the field of text processing technology, and in particular to an entity marking method, electronic device, storage medium and computer program product. Background Art

[0002] Newly discovered information often first appears in unstructured text sources such as blogs, mailing lists, and news sites. Timely analysis of cybersecurity information requires automatic tagging and extraction of information from unstructured text.

[0003] In the prior art, entities in text can be identified by pre-training a neural network model. This model uses global features and regards each sentence as an object, which is annotated with a set of corresponding word labels. The search space of word labels in sentences is large and the computational cost is high. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide an entity tagging method, an electronic device, a storage medium and a computer program product, so as to reduce the computing cost when performing entity tagging on text.

[0005] In a first aspect, an embodiment of the present application provides an entity tagging method, comprising:

[0006] Based on a preset feature function set, a feature vector is obtained in which each word in the to-be-marked text is marked as a preset label; the element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on at least one of the current word, the previous word of the current word, the two previous words of the current word, the label of the current word, the label corresponding to the previous word, and the labels corresponding to the two previous words;

[0007] The feature vector is input into the entity tagging model to obtain the conditional probability that the words output by the entity tagging model belong to each label; the entity tagging model is obtained by training the maximum entropy model based on the training samples using the average perceptron algorithm;

[0008] Determine the target entity label corresponding to the word based on the conditional probability.

[0009] The embodiment of the present application obtains an entity labeling model by training the maximum entropy model using the average perceptron algorithm. The maximum entropy model can automatically learn the probability distribution of entity labels based on training data, and can automatically process large amounts of data, reducing manual analysis time and costs. In addition, when the maximum entropy model predicts the current word label, it only relies on information about the current word, the word before the current word, and the two words before the current word. It does not use global features, thereby reducing computational costs.

[0010] In any embodiment, the method further comprises:

[0011] Obtain training samples, which include training threat intelligence text and labels corresponding to each word in the training threat intelligence text;

[0012] Using a feature function set to extract features from each word in the training threat intelligence text to obtain a training feature vector for each word;

[0013] Input the training feature vectors corresponding to each word in the threat intelligence text into the maximum entropy model to obtain the prediction results output by the maximum entropy model;

[0014] Based on the prediction results and the labels corresponding to the words, the average perceptron algorithm is used to optimize the internal parameters of the maximum entropy model to obtain a trained entity labeling model.

[0015] The embodiment of the present application can achieve maximum information entropy of the unknown part by pre-training the maximum entropy model under given known information, thereby improving the accuracy of entity label marking for each word in the text.

[0016] In any embodiment, the formula corresponding to the maximum entropy model is as follows:

[0017]

[0018] Among them, t0, t -1 , w0 and w -1 is the start tag; t i is the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2 is the i-2th word; f=(f1,…,f m ) is the eigenvector, v=(v1,…,v m ) is the internal parameter of the maximum entropy model, is the standard factor, and

[0019] In any embodiment, the method further comprises:

[0020] Constructing multiple feature functions based on training samples; the training samples include training threat intelligence text and labels corresponding to each word in the training threat intelligence text;

[0021] Among them, the characteristic function is: t iis the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2 is the i-2th word.

[0022] In the embodiment of the present application, multiple feature functions are pre-constructed, and the feature functions are used to extract useful information from the input data and convert it into a form recognizable by the model. In the reasoning process, the label of each word can be accurately predicted. In any embodiment, the feature vector of each word in the text to be marked is obtained based on the preset feature function set, which is marked as a preset label, including:

[0023] Get the word, the previous word of the word, the first two words of the word, the entity tag of the previous word, and the entity tags of the first two words;

[0024] Substitute the word, the previous word, the previous two words, the entity label of the previous word, the entity label of the previous two words, and the pre-set label of the word into the feature function of the corresponding label to obtain the feature vector of the word corresponding label.

[0025] When obtaining the feature vector of the current word, the embodiment of the present application combines the previous word and the previous two words of the current word, determines the feature vector of the current word based on the context and feature function, and facilitates subsequent label prediction.

[0026] In any embodiment, before obtaining a feature vector of each word in the to-be-marked text marked as a preset label based on a preset feature function set, the method further includes:

[0027] The threat intelligence text to be marked is obtained, and the threat intelligence text to be marked is subjected to word segmentation processing to obtain multiple words to be marked.

[0028] After obtaining the threat intelligence text, the embodiment of the present application performs word segmentation on the threat intelligence text to facilitate subsequent prediction of entity labels for each word.

[0029] In any embodiment, the threat intelligence text to be marked is segmented, including:

[0030] Parse the threat intelligence text to be marked and remove sentences that do not meet the requirements;

[0031] Perform word segmentation on the remaining sentences.

[0032] The embodiment of the present application improves the efficiency of subsequent entity tagging and reduces the amount of calculation by proposing sentences that do not meet the requirements.

[0033] In a second aspect, an embodiment of the present application provides an entity marking device, including:

[0034] A feature vector acquisition module is used to obtain a feature vector of each word in the to-be-marked text marked as a preset label based on a preset feature function set; the element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on at least one of the current word, the previous word of the current word, the two previous words of the current word, the label of the current word, the label corresponding to the previous word, and the labels corresponding to the two previous words;

[0035] A conditional probability acquisition module, used to input the feature vector into an entity labeling model to obtain the conditional probability that the word output by the entity labeling model belongs to each label; the entity labeling model is obtained by training the maximum entropy model based on training samples using an average perceptron algorithm;

[0036] A label determination module is used to determine the target entity label corresponding to the word according to the conditional probability.

[0037] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor, a memory, and a bus, wherein:

[0038] The processor and the memory communicate with each other via the bus;

[0039] The memory stores program instructions that can be executed by the processor, and the processor can execute the method of the first aspect by calling the program instructions.

[0040] In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, including:

[0041] The non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute the method of the first aspect.

[0042] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer program instructions, wherein when the computer program instructions are read and executed by a processor, the method of the first aspect is executed.

[0043] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A schematic diagram of a flow chart of an entity labeling method provided in an embodiment of the present application;

[0046] Figure 2 A flow chart of an entity labeling model training method provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of the structure of an entity marking device provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0051] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0052] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0053] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0054] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0055] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0056] With the rapid development of network technology, network security has received more and more attention. Hacker groups use a variety of attack methods and attack tools to attack targets around the world. In order to analyze and better defend against these network attacks, security companies and government agency experts have released threat intelligence. Detecting and analyzing threat intelligence as soon as possible can effectively analyze the current status of security issues and the development trend of future security issues, and make corresponding security decisions based on threat intelligence. For the detection of threat intelligence, more critical words can be extracted from the known collected threat intelligence as threat intelligence entities. By detecting whether the information in the network has threat intelligence entities, threat intelligence can be discovered in a timely and accurate manner.

[0057] Currently, entities in text can be identified by pre-training a neural network model. This model uses global features and treats each sentence as an object, annotated with a set of corresponding word labels. The search space of word labels in sentences is large and computationally expensive.

[0058] Based on this, the embodiments of the present application provide an entity tagging method, an electronic device, a storage medium, and a computer program product. By using a feature function to determine the feature vector of each word, and then using an entity tagging model to predict the entity tag of each word, the entity tagging problem of unstructured text is converted into a sequence tagging problem, which reduces the analysis time of threat intelligence staff and reduces the amount of calculation.

[0059] It can be understood that the entity labeling method provided in the embodiment of the present application can be applied to electronic devices, which include terminals and servers; wherein the terminal can specifically be a smart phone, a tablet computer, a computer, a personal digital assistant (PDA), etc.; the server can specifically be an application server or a Web server.

[0060] Figure 1 A schematic diagram of a flow chart of an entity labeling method provided in an embodiment of the present application is as follows: Figure 1 As shown, the method includes:

[0061] Step 101: obtaining a feature vector in which each word in the to-be-marked text is marked as a preset label based on a preset feature function set; the element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on at least one of the current word, the previous word of the current word, the two previous words of the current word, the label of the current word, the label corresponding to the previous word, and the labels corresponding to the two previous words;

[0062] Step 102: Input the feature vector into the entity tagging model to obtain the conditional probability that the word output by the entity tagging model belongs to each label; the entity tagging model is obtained by training the maximum entropy model based on the training sample using the average perceptron algorithm;

[0063] Step 103: Determine the target entity label corresponding to the word according to the conditional probability.

[0064] In the specific implementation process, the entity tags in the threat intelligence text may include software vendor, software product, software version, software language, vulnerability name, software symbol (software symbol: file, function or method, parameter), and vulnerability relevant term.

[0065] At least one feature function can be set for each entity tag. The feature function can be understood as a rule, which is the language knowledge obtained from the training data set. It can help the model better capture text information for subsequent classification of tags. For example: if the word before the current word is "the" and the label of the current word is "B:software vendor", then f1 is 1, otherwise it is 0; another example: if the current word contains uppercase letters and its length is greater than 3, and the label of the current word is "B:vulnerabilityname", then f2 is 1, otherwise it is 0. It should be noted that the rules included in the feature function may need to use at least one of the current word, the word before the current word, the first two words of the current word, the label of the previous word, and the labels of the first two words. Taking f1 as an example, the labels used to match the feature function include the current word, the previous word, and the current word. The labels used to match the feature function f2 include the current word and the label of the current word.

[0066] Arrange multiple feature functions in a certain order to form a feature function set. It should be noted that the order of the feature functions in the feature function set is the same as the order of the feature functions when training the entity labeling model. Each feature function is pre-set based on experience, and the number of feature functions can also be set according to actual conditions.

[0067] For each word, the word and its context information are matched with each feature function. If it meets a certain feature function, the value of the word under the feature function is determined to be 1, otherwise it is 0. After matching with each feature function, a feature vector can be obtained.

[0068] After obtaining the feature vector, the feature vector is input into the pre-trained entity tagging model to obtain the conditional probability of the word belonging to each label output by the entity tagging model. The label corresponding to the maximum conditional probability is used as the target entity label of the word.

[0069] It should be noted that when determining the target entity label according to the conditional probability, it is also possible to determine whether the maximum conditional probability is greater than a preset threshold. If it is greater, the label corresponding to the conditional probability is used as the target entity label of the word. If it is not greater, it means that the word is not an entity defined in this application and is a meaningless word.

[0070] The embodiment of the present application obtains an entity labeling model by training the maximum entropy model using the average perceptron algorithm. The maximum entropy model can automatically learn the probability distribution of entity labels based on training data, and can automatically process large amounts of data, reducing manual analysis time and costs. In addition, when the maximum entropy model predicts the current word label, it only relies on information about the current word, the word before the current word, and the two words before the current word. It does not use global features, thereby reducing computational costs.

[0071] Based on the above embodiment, the method further includes:

[0072] Constructing multiple feature functions based on training samples; the training samples include training threat intelligence text and labels corresponding to each word in the training threat intelligence text;

[0073] Wherein, the characteristic function is: t i is the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2 is the i-2th word.

[0074] In the specific implementation process, multiple feature functions can be pre-built. For example, each label can correspond to at least one feature function. Based on the training samples, the relevant knowledge in the threat intelligence text can be learned through the feature function. Multiple feature functions can be arranged in a certain order, and the feature function values ​​form the feature vector corresponding to the word.

[0075] The formula corresponding to the characteristic function is: in, t i is the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2For the i-2th word. It is understandable that the feature function can be considered as some pre-set rules. If the current word and the context information used match the rule, the feature value is 1, otherwise the feature value is 0. For example: the word before the current word is "the" and the label of the current word is "B: software vendor", then f1 is 1, otherwise it is 0; another example: the current word contains uppercase letters and the length is greater than 3, and the label of the current word is "B: vulnerability name", then f2 is 1, otherwise it is 0. It should be noted that in addition to using 1 and 0 to represent the feature value, other agreed identifiers can also be used, and the embodiment of the present application does not specifically limit this. After obtaining the feature function, the parameters required for each feature function (including at least one of the word, the previous word, the previous two words, the entity label of the previous word, the entity label of the previous two words, and the pre-set label of the word) are substituted into the feature function of the corresponding label to obtain the feature value corresponding to the word. Multiple feature values ​​constitute a feature vector.

[0076] Among them, since each feature function has a corresponding label, the pre-set label of the word is the label corresponding to the feature function.

[0077] Based on the above embodiments, Figure 2 A flow chart of an entity labeling model training method provided in an embodiment of the present application, such as Figure 2 As shown, the entity labeling model can be trained in the following way:

[0078] Step 201: Obtain a training sample, where the training sample includes a training threat intelligence text and a label corresponding to each word in the training threat intelligence text;

[0079] Step 202: extracting features of each word in the training threat intelligence text using the feature function set to obtain a training feature vector for each word;

[0080] Step 203: input the training feature vector corresponding to each word in the threat intelligence text into the maximum entropy model to obtain a prediction result output by the maximum entropy model;

[0081] Step 204: Based on the prediction results and the labels corresponding to the words, an average perceptron algorithm is used to optimize the internal parameters of the maximum entropy model to obtain the trained entity labeling model.

[0082] In the specific implementation process, the training threat intelligence text can be collected from the website by web crawling. After obtaining the training threat intelligence text, it can be preprocessed. Specifically, the training threat intelligence text can be parsed by Stanza. Stanza is an open source Python natural language analysis software package that contains a variety of tools that can be used in the processing flow. These tools can convert strings containing human language text into sentences and word lists, and generate the basic form, part of speech, lexical features, syntactic structure dependency analysis, and identification of named entities. Stanza is built with highly accurate neural network components, supports multiple languages, and has good performance in multiple languages. Through Stanza's parsing of the training threat intelligence text, sentences with more than three words can be retained, and long and complex sentences can be broken down into shorter sentences.

[0083] For the parsed sentences, the words in the sentences can be manually labeled. Since many entities are multi-word inverse processes, IOB tags can be used when labeling. Specifically, the first word of the entity name is identified with "B" (for "beginning") followed by the entity type. Any word in the entity name except the first word is marked with "I" (for "inside"), followed by the entity name. Unrecognized words are marked with "O". For example, the correct labels for the "Internet Explorer" instance are "B:Software Product" (Internet) and "I:Software Product" (Explorer).

[0084] The feature function set is used to extract features from the words in each sentence. The feature extraction method is described in the above embodiment and will not be repeated here.

[0085] After obtaining the training feature vector, the training feature vector is input into the maximum entropy model to obtain the prediction result output by the maximum entropy model.

[0086] For a sentence w=(w1,…,w n ), the corresponding label is t=(t1,…,t n ), the conditional probability of t given w is as follows:

[0087]

[0088] Among them, t0, t -1 , w0 and w -1 is defined as the start tag. Therefore, the word w j Tags j The probability of depends on the labels of the previous two words, the current word, and the previous two words. For simple notation,

[0089] make The maximum entropy model is described as follows:

[0090]

[0091] Where, f=(f1,…,f m ) is the training feature vector, v=(v1,…,v m ) is the parameter vector (or feature weights) learned from the training data, and is the standard factor.

[0092] The predictions output by the maximum entropy model are calculated against the true labels, and the internal parameters are optimized based on the calculation results. When optimizing the internal parameters, the average perceptron algorithm can be used. The perceptron algorithm and its variants are a class of online parameter fitting methods that produce competitive results in terms of accuracy and are generally more effective than other technical means. After initializing the parameter vector v (usually setting v=0), the perceptron algorithm is trained a fixed number of times in a loop in the training set. For each training example, the algorithm predicts the "best" label with the current parameters v and compares it to the true value. In the case of an incorrectly assigned label, the parameters v are updated so that the probability of the correct label increases.

[0093] The average perceptron algorithm is as follows:

[0094]

[0095]

[0096] v represents the current parameter vector; v s v is used to record the timestamp of the last time v was updated; t is the running weighted sum parameter vector used to calculate the average vector; v ave is the average vector, i.e., the final parameter vector obtained after training; y represents the label predicted for the current input sentence w and the current parameter vector v, i.e., obtained by the maximum entropy model in the previous section. When encountering an incorrectly labeled instance, v will be updated, v t will be updated to include the weighted sum before the components of v change, v s is set to the current counter of all triggered vector components. Finally, with v t Divide by the number of valid updates i to get the average vector v ave .

[0097] After a certain number of iterative optimizations, a trained entity labeling model can be obtained.

[0098] It should be noted that when training a model, the rate of change of the loss function can also be used to determine whether to end the training.

[0099] The embodiment of the present application pre-constructs multiple feature functions, which are used to extract useful information from input data and convert it into a form recognizable by the model. During the reasoning process, the label of each word can be accurately predicted.

[0100] On the basis of the above embodiment, before obtaining the feature vector of each word in the to-be-marked text marked as a preset label based on the preset feature function set, the method further includes:

[0101] The threat intelligence text to be marked is obtained, and the threat intelligence text to be marked is subjected to word segmentation processing to obtain multiple words to be marked.

[0102] In the specific implementation process, since the purpose of the embodiment of the present application is to perform entity tagging of words in the threat intelligence text, after the electronic device obtains the threat intelligence text to be tagged, it can perform word segmentation processing on the threat intelligence text to be tagged to obtain individual words. There are multiple word segmentation methods, for example: word segmentation can be performed based on rules, and the rules may include forward maximum matching rules, reverse maximum matching rules, and two-way maximum matching rules. It can also be based on a statistical word segmentation method, for example: using a hidden Markov model, a conditional random field, and a neural network model for word segmentation. It can also be based on a machine learning method for word segmentation, for example: using a support vector machine, a maximum entropy model, a perceptron, and other methods to model.

[0103] After obtaining the threat intelligence text, the embodiment of the present application performs word segmentation on the threat intelligence text to facilitate subsequent prediction of entity labels for each word.

[0104] Based on the above embodiment, the threat intelligence text to be marked is segmented, including:

[0105] Parse the threat intelligence text to be marked and remove sentences that do not meet the requirements;

[0106] Perform word segmentation on the remaining sentences.

[0107] In the specific implementation process, before word segmentation, the sentences of the threat intelligence text to be marked can be parsed to remove sentences that do not meet the requirements, such as sentences containing only one or two words.

[0108] Then, the remaining sentences are segmented using the method listed in the above embodiment.

[0109] The embodiment of the present application improves the efficiency of subsequent entity tagging and reduces the amount of calculation by proposing sentences that do not meet the requirements.

[0110] Figure 3 This is a schematic diagram of the structure of an entity marking device provided in an embodiment of the present application. The device may be a module, program segment or code on an electronic device. It should be understood that the device is similar to the above-mentioned Figure 1 The method embodiment corresponds to and can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device can be found in the above description. To avoid repetition, detailed description is appropriately omitted here. The device includes: a feature vector acquisition module 301, a conditional probability acquisition module 302 and a label determination module 303, wherein:

[0111] The feature vector acquisition module 301 is used to obtain a feature vector of each word in the to-be-marked text marked as a preset label based on a preset feature function set; the element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on the current word, the previous word of the current word, the first two words of the current word, the label of the current word, the label corresponding to the previous word, and the label corresponding to the first two words;

[0112] The conditional probability acquisition module 302 is used to input the feature vector into an entity labeling model to obtain the conditional probability that the word output by the entity labeling model belongs to each label; the entity labeling model is obtained by training the maximum entropy model based on training samples using the average perceptron algorithm;

[0113] The tag determination module 303 is used to determine the target entity tag corresponding to the word according to the conditional probability.

[0114] Based on the above embodiment, the device further includes a model training module, which is used to:

[0115] Obtaining a training sample, wherein the training sample includes a training threat intelligence text and a label corresponding to each word in the training threat intelligence text;

[0116] Using the feature function set to extract features from each word in the training threat intelligence text to obtain a training feature vector for each word;

[0117] Inputting the training feature vector corresponding to each word in the threat intelligence text into the maximum entropy model to obtain a prediction result output by the maximum entropy model;

[0118] Based on the prediction results and the labels corresponding to the words, the average perceptron algorithm is used to optimize the internal parameters of the maximum entropy model to obtain the trained entity labeling model.

[0119] Based on the above embodiment, the formula corresponding to the maximum entropy model is as follows:

[0120]

[0121] Among them, t0, t -1 , w0 and w -1 is the start tag; t i is the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2 is the i-2th word; f=(f1,…,f m ) is the eigenvector, v=(v1,…,v m ) is the internal parameter of the maximum entropy model, is the standard factor, and

[0122] Based on the above embodiment, the device further includes a function training module, which is used to:

[0123] Construct multiple feature functions based on training samples; wherein the feature function is: f i =(t i ,w i )∈{1,0},t i =(t i-2 ,t i-1 ,t i ), w i =(w i-2 ,w i-1 ,w i ), t i is the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2 is the i-2th word;

[0124] The training sample includes a training threat intelligence text and a label corresponding to each word in the training threat intelligence text.

[0125] Based on the above embodiment, the feature vector obtaining module 301 is specifically used for:

[0126] Get the word, the previous word of the word, the first two words of the word, the entity tag of the previous word, and the entity tags of the first two words;

[0127] Substitute the word, the previous word, the previous two words, the entity tag of the previous word, the entity tags of the previous two words, and the pre-set tag of the word into the feature function of the corresponding tag to obtain a feature vector of the word belonging to the tag.

[0128] Based on the above embodiment, the device further includes a word segmentation module, which is used to:

[0129] The threat intelligence text to be marked is obtained, and the threat intelligence text to be marked is subjected to word segmentation processing to obtain a plurality of words to be marked.

[0130] Based on the above embodiment, the word segmentation module is specifically used for:

[0131] Parsing the threat intelligence text to be marked and removing sentences that do not meet the requirements;

[0132] Perform word segmentation on the remaining sentences.

[0133] Figure 4 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application, such as Figure 4 As shown, the electronic device includes: a processor (processor) 401, a memory (memory) 402 and a bus 403.

[0134] The processor 401 and the memory 402 communicate with each other via the bus 403;

[0135] The processor 401 is used to call the program instructions in the memory 402 to execute the methods provided by the above-mentioned method embodiments, for example, including: obtaining a feature vector in which each word in the text to be marked is marked as a preset label based on a preset feature function set; the element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on at least one of the current word, the previous word of the current word, the first two words of the current word, the label of the current word, the label corresponding to the previous word, and the label corresponding to the first two words; inputting the feature vector into an entity labeling model to obtain the conditional probability that the word belongs to each label output by the entity labeling model; the entity labeling model is obtained by training the maximum entropy model based on training samples using the average perceptron algorithm; and determining the target entity label corresponding to the word according to the conditional probability.

[0136] The processor 401 may be an integrated circuit chip with signal processing capabilities. The processor 401 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. It may implement or execute various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0137] The memory 402 may include, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0138] The present embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: obtaining a feature vector in which each word in the to-be-marked text is marked as a preset label based on a preset feature function set; the element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on at least one of the current word, the previous word of the current word, the first two words of the current word, the label of the current word, the label corresponding to the previous word, and the label corresponding to the first two words; inputting the feature vector into an entity labeling model to obtain the conditional probability that the word belongs to each label output by the entity labeling model; the entity labeling model is obtained by training the maximum entropy model based on training samples using the average perceptron algorithm; and determining the target entity label corresponding to the word according to the conditional probability.

[0139] The present embodiment provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable the computer to execute the methods provided by the above-mentioned method embodiments, for example, including: obtaining a feature vector in which each word in the text to be marked is marked as a preset label based on a preset feature function set; the element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on at least one of the current word, the previous word of the current word, the first two words of the current word, the label of the current word, the label corresponding to the previous word, and the label corresponding to the first two words; inputting the feature vector into an entity labeling model to obtain the conditional probability that the word belongs to each label output by the entity labeling model; the entity labeling model is obtained by training the maximum entropy model based on training samples using the average perceptron algorithm; and determining the target entity label corresponding to the word according to the conditional probability.

[0140] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0141] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0143] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0144] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. An entity labeling method, characterized in that: include: Based on a preset feature function set, each word in the to-be-marked text is obtained as a feature vector of each preset label; Said The element value in the feature vector corresponds to the feature function in the feature function set, and the element value is obtained by using the corresponding feature function to perform rule verification on at least one of the current word, the word before the current word, the two words before the current word, the label of the current word, the label corresponding to the previous word, and the labels corresponding to the two words before the current word; Input the feature vector into an entity labeling model to obtain the conditional probability of the word belonging to each label output by the entity labeling model; the entity labeling model is obtained by training the maximum entropy model based on training samples using the average perceptron algorithm; Determine a target entity label corresponding to the word according to the conditional probability.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining a training sample, wherein the training sample includes a training threat intelligence text and a label corresponding to each word in the training threat intelligence text; Using the feature function set to extract features from each word in the training threat intelligence text to obtain a training feature vector for each word; Inputting the training feature vector corresponding to each word in the threat intelligence text into the maximum entropy model to obtain a prediction result output by the maximum entropy model; Based on the prediction results and the labels corresponding to the words, the average perceptron algorithm is used to optimize the internal parameters of the maximum entropy model to obtain the trained entity labeling model.

3. The method according to claim 2, characterized in that The formula corresponding to the maximum entropy model is as follows: Among them, t0, t -1 , w0 and w -1 is the start tag; t i is the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2 is the i-2th word; f=(f1,…,f m ) is the eigenvector, v=(v1,…,v m ) is the internal parameter of the maximum entropy model, is the standard factor, and 4. The method according to claim 1, characterized in that: The method further comprises: Constructing multiple feature functions based on training samples; the training samples include training threat intelligence text and labels corresponding to each word in the training threat intelligence text; Wherein, the characteristic function is: t i is the label corresponding to the i-th word; t i-1 is the label corresponding to the i-1th word; t i-2 is the label corresponding to the i-2th word; w i is the i-th word; w i-1 is the i-1th word; w i-2 is the i-2th word.

5. The method according to claim 1, characterized in that The method of obtaining a feature vector of each word in the to-be-marked text marked as a preset label based on a preset feature function set includes: Get the word, the previous word of the word, the first two words of the word, the entity tag of the previous word, and the entity tags of the first two words; Substitute the word, the previous word, the previous two words, the entity tag of the previous word, the entity tags of the previous two words, and the pre-set tag of the word into the feature function of the corresponding tag to obtain a feature vector of the word belonging to the tag.

6. The method according to any one of claims 1 to 5, characterized in that: Before obtaining a feature vector of each word in the to-be-marked text marked as a preset label based on a preset feature function set, the method further includes: The threat intelligence text to be marked is obtained, and the threat intelligence text to be marked is subjected to word segmentation processing to obtain a plurality of words to be marked.

7. The method according to claim 6, characterized in that The word segmentation processing of the threat intelligence text to be marked includes: Parsing the threat intelligence text to be marked and removing sentences that do not meet the requirements; Perform word segmentation on the remaining sentences.

8. An electronic device, characterized in that: include: processor, memory and bus, wherein, The processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method according to any one of claims 1 to 7.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images