A network security relationship extraction method

Abstract

The application discloses a network security relation extraction method, wherein the method steps are as follows: S1: obtaining a security event data set, cleaning, preprocessing and segmenting and marking data in the security event data set, and finally dividing the data set after completion of marking into a training data set and a test data set S2: constructing a relation extraction prediction model S3: inputting the training data set into the relation extraction prediction model, obtaining a security event prediction result, and adjusting parameters of the relation extraction prediction model according to the prediction result S4: inputting test data set data into the relation extraction prediction model to obtain performance parameters of the model, then repeating step S3 until the performance parameters are higher than preset values, and finally saving the model as a security relation extraction model.

Description

TECHNICAL FIELD

[0001] The present application relates to a relationship extraction method, in particular to a network security relationship extraction method. BACKGROUND

[0002] With the rapid development of information technology and the continuous updating of network environment, the degree of concern about network space security issues in the global scope is continuously improving. As an innovative tool, network security knowledge graph can perform fine-grained deep correlation analysis and mining on a large amount of, multi-source, heterogeneous security data. The construction technology of network security knowledge graph mainly includes the steps of relationship extraction link, security entity identification link and attribute extraction link, among which, the security relationship extraction technology is the most important technology for the construction of network security knowledge graph. One of the key tasks in the field of natural language processing (NLP task) is relationship extraction, and its goal is to identify the association between entities from text. With the development of deep learning technology, the application and research of relationship extraction technology in the field of network security, threat intelligence, etc. are also becoming mature.

[0003] In existing natural language processing (NLP) research, syntactic information, especially dependency trees, has become an important tool for improving relationship extraction. Dependency trees can capture the dependency relationships between words in a sentence, providing strong guidance for semantic analysis in natural language processing tasks (NLP). By analyzing the context information related to a given entity in the dataset, dependency trees play a crucial role in relationship extraction tasks. However, it cannot be ignored that existing research often faces the problem of noise when using dependency trees. The noise problem of dependency trees mainly comes from the uncertainty in the automatic generation process. When constructing dependency trees, the algorithm needs to determine the dependency relationships between words and establish a tree structure accordingly. However, due to the complexity and diversity of natural language, the algorithm often has difficulty accurately determining the dependency relationships between all words, resulting in the generated dependency trees containing noise.

[0004] In order to reduce the influence of the noise of the dependency tree on the relationship extraction, through the learning and analysis of the current domestic and foreign research, the present application learns the technical idea of model building, innovatively combines the BERT model, BiLSTM model, A-GCN model and entity label fusion, and proposes and designs a relationship extraction algorithm based on BERT-BiLSTM-(A-GCN) network and entity label fusion, which is used for pruning the syntactic dependency tree and reducing the influence of the noise of the dependency tree on the network threat intelligence relationship extraction task. SUMMARY

[0005] The technical problem to be solved by the present application is to improve the accuracy of the model in capturing the dependency relationship in the original text, reduce the influence of noise data, and more accurately predict the security relationship in the network.

[0006] In order to achieve the above-mentioned purpose, the present application adopts the following technical scheme:

[0007] In a first aspect, the present application provides a network security relationship extraction method, comprising the following steps:

[0008] S1: obtaining a security event data set, cleaning and preprocessing the data in the security event data set to obtain an initial data set, and dividing and marking the data in the initial data set, and dividing the initial data set after marking into a training data set and a test data set according to a preset proportion;

[0009] S2: constructing a relationship extraction prediction model, wherein the relationship extraction prediction model comprises a relationship extraction primary model, a relationship extraction secondary model and an output layer; the relationship extraction primary model comprises a data conversion layer and a relationship extraction layer;

[0010] S3: inputting the training data set into the relationship extraction primary model to obtain a first comprehensive sequence corresponding to each data in the training data set, wherein the first comprehensive sequence is a comprehensive sequence containing data text information and dependency relationship, and the first comprehensive sequence constitutes a first output set;

[0011] inputting the first output set into the relationship extraction secondary model to obtain a second comprehensive sequence corresponding to each first comprehensive sequence, wherein the second comprehensive sequence is a comprehensive sequence containing global information and local details in the first comprehensive sequence, and the second comprehensive sequence constitutes a second output set;

[0012] inputting the second output set into the output layer to obtain a security event prediction result set composed of security event prediction results corresponding to each second comprehensive sequence, and adjusting the parameters of the relationship prediction extraction model according to the security event prediction result set;

[0013] S4: inputting the test data set into the relationship prediction extraction model to obtain the corresponding security event prediction result set, and calculating the performance parameters of the model according to the result, if the performance parameters are higher than the preset value, the relationship prediction extraction model is saved as a security relationship extraction model, if the performance parameters do not reach the preset value, the step S3 is repeated.

[0014] As a preferred technical scheme of the present application, in S1, 2n markers are used to mark the boundaries of the subject and object divided at the beginning and end, wherein n>=2, and the subject and object are the subject and object in the natural language recorded in the data set that meet the definition of natural language.

[0015] As a preferred technical solution of the present application, in S1, when the data set is preprocessed, a dependency tree is first generated for the data X in each data set, and the dependency tree is pruned.

[0016] As a preferred technical solution of the present application, in S1, the pruning rule is determined according to the dependency relationship between each entity in the data X in the dependency tree, the appearance frequency of the entity in the entire data set, and the importance of the entity, to remove entities with appearance frequency and importance lower than a preset value and dependency relationships with impact less than a preset value.

[0017] As a preferred technical solution of the present application, in S3, the data conversion layer converts the input data text context information into a corresponding hidden vector containing semantic information by capturing the input data text context information, and the relationship extraction layer converts the hidden vector into a first comprehensive sequence.

[0018] As a preferred technical solution of the present application, the relationship extraction two-level model in S3 further captures the front-to-back data information and the back-to-front data information in the first comprehensive sequence, and outputs a corresponding second comprehensive sequence.

[0019] As a preferred technical solution of the present application, in S4, Micro-F1 is used as the performance parameter of the relationship pre-extraction model.

[0020] In a second aspect, the present application provides a network security relationship extraction system, which comprises:

[0021] an input module, a control module, a data processing module, a prediction module, and a storage module;

[0022] The input module is used to collect network security event data and input the data into the data processing module.

[0023] The control module is used to store computer programs and issue instructions to the data processing module and the classification module through the programs.

[0024] The programs are used to implement any of the methods of the first aspect of the embodiments.

[0025] The data processing module is used to process data according to the instructions, and is also used to establish a data model according to the instructions.

[0026] The prediction module is used to extract and predict the security relationship of the data processed by the processing module according to the instructions and the data model.

[0027] The storage module is used to calculate the output of the prediction module;

[0028] The storage module is also used to store the data model.

[0029] Thirdly, the present invention provides a terminal including a predictor, an input device, an output device, and a controller, wherein the input device, the output device, the predictor, and the controller are interconnected. The controller stores a network security relationship extraction program, which implements the method described in any of the first aspects of the embodiments. The controller is further configured to issue instructions to the predictor according to the program. The controller is also configured to collect, label, preprocess, and train a data model on the data. The predictor extracts network security relationships from the dataset according to the program instructions and the data model to obtain a corresponding network security relationship dataset.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0031] Fusing the BiLSTM model significantly improves model performance, while introducing the BERT-large encoder further enhances it; using both simultaneously results in an even greater performance boost. Furthermore, this invention sets pruning rules based on the dependency relationships of each entity pair in the dependency tree, as well as their frequency and importance across the entire training dataset. This allows the model to better identify and remove dependencies that have a smaller impact on predictions, enabling it to focus more on truly important features.

[0032] Therefore, the present invention has a stronger ability to process text data, can better capture and utilize complex features in the data, focus on important features, reduce errors caused by side branches, and improve the accuracy and completeness of security relationship extraction. Attached Figure Description

[0033] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0034] Figure 1 This is the overall flowchart of the design of this invention;

[0035] Figure 2 It is a dataset obtained by labeling and cutting the original data;

[0036] Figure 3 This is the flowchart of the Ours model module;

[0037] Figure 4 This is a flowchart of the algorithm for the design model of this invention;

[0038] Figure 5 is the overall structure of the A-GCN model. DETAILED DESCRIPTION

[0039] The preferred embodiments of the present application will be described below in conjunction with the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to explain and illustrate the technical solutions of the present application, and are not used to limit the present application.

[0040] EMBODIMENT

[0041] As shown in Figure 1 , the present disclosure provides a network security relationship extraction method, comprising the following steps:

[0042] S1: obtaining a security event data set, cleaning and preprocessing the data in the security event data set to obtain an initial data set; using special markers to split the data in the initial data set, and dividing the data set with completed markers into a training data set and a test data set;

[0043] S101: obtaining a network security event data set and cleaning it:

[0044] The security event data set includes related data of security events such as network attacks, vulnerability exploitation, and malware, and the data covers multiple dimensions such as attackers, victims, attack means, attack time, and attack targets.

[0045] The present application selects the disclosed HACKER data set as the security event data set. The data recording method in the original data set is as follows:

[0046]

[0047] Data cleaning is performed on the obtained vehicle-mounted network traffic: the data is filtered row by row, and the dirty data filtered out is removed. After cleaning, the sentences in the data set are executed S102.

[0048] S102: preprocessing the security event data set to obtain a dependency tree and selecting more important dependency relationships through pruning:

[0049] A dependency tree is generated for each data X in the data set through CoreNLP , the dependency tree is the dependency relationship between each entity in the data X, and then the dependency tree is pruned to remove those dependency relationships that have less influence on the prediction results of the model (i.e. unimportant branches), so that the model can focus more on the truly important features.

[0050] The pruning rule is determined according to the dependency relationship between each pair of entities in the data X in the dependency tree, the frequency and importance of the entities in the entire training data set. The pruning rule can help the model better identify and remove those dependency relationships that have less influence on the model prediction results (i.e. unimportant side branches), so that the model can focus more on the truly important features.

[0051] The pruning result is stored in the data set, and then step S103 is performed on the data set after pruning.

[0052] S103: split and mark the data in the initial data set using special markers to mark the subject and object, and divide the marked data set into a training data set and a test data set;

[0053] Four special markers (i.e. <obj> ”、"< / obj> , <subj>" and< / subj> ) are inserted in the sentences in the data X to mark the boundaries of the subject and object entities, ensuring that the encoder distinguishes the positions of the entities during the encoding process, thereby improving the performance of the model. The end of the boundary of the subject entity is represented by <obj>denotes the beginning of the boundary of the subject entity, with< / obj> , and the end of the boundary of the object entity is represented by <subj>denotes the beginning of the boundary of the object entity, with< / subj> . The data in the marked data set is shown in Figure 2 .

[0054] The marked data set is divided into a training data set and a test data set according to a predetermined ratio.

[0055] S2: constructing a relationship extraction prediction model, the relationship extraction prediction model comprising a relationship extraction primary model, a relationship extraction secondary model and an output layer;

[0056] The relationship extraction primary model comprises a transformation layer based on the BERT model and a relationship extraction layer based on the A-GCN model, and is composed of two parts. The relationship extraction primary model encodes the input sentence into a hidden vector, and then generates a comprehensive sequence representation output. The relationship extraction secondary model comprises a backward LSTM layer and a forward LSTM layer, generates a comprehensive sequence representation, and inputs it into the output layer for prediction.

[0057] S3 is shown in Figure 3 : input the training data set into the relationship extraction primary model to obtain a first output set composed of a first comprehensive sequence corresponding to each data pair in the training data set;

[0058] The first output set is input into the relationship extraction secondary model as an input set to obtain a second comprehensive sequence corresponding to each first comprehensive sequence, and the second comprehensive sequence constitutes a second output set;

[0059] The second output set is input into an output layer to obtain a safety event prediction result set composed of safety event prediction results corresponding to each of the second comprehensive sequences, and parameters of the relation pre-extraction model are adjusted according to the safety event prediction result set;

[0060] S301: encode the input sentence into a hidden vector output through a BERT model layer, and then input the hidden vector into an A-GCN model layer to generate a first comprehensive sequence output:

[0061] S311: encode the input sentence into a hidden vector output through a BERT model layer, and then input the hidden vector into an A-GCN model layer:

[0062] First, the sentence in the input data X is encoded into a hidden vector by a BERT model, representing the hidden vector of the i-th entity in the sentence.

[0063] input into an A-GCN model with L layers, and the corresponding output is obtained.

[0064] After the BERT model layer is pre-trained, the output hidden vector contains a large amount of semantic information. Taking these hidden vectors as the input of the A-GCN model layer allows the A-GCN model layer to more accurately capture sequence dependency relationships and fully utilize context information.

[0065] Secondly, the forward graph convolution layer and the backward graph convolution layer of the A-GCN model layer process the inputs respectively, thereby capturing the information from front to back and from back to front in the sequence. This bidirectional processing method can fully consider the dependency relationship in the sequence, allowing both forward dependency and backward dependency to be fully processed.

[0066] Then, the outputs of the forward graph convolution layer and the backward graph convolution layer are spliced to generate a first comprehensive sequence. This first comprehensive sequence contains both the context information of the sequence and the complex dependency relationships in the sequence, and has strong expression ability.

[0067] S312: the output layer applies a max-pooling mechanism to the two text spans to obtain a relation extraction primary model output prediction result:

[0068] First, on all , the global sentence representation obtained by formula (1) is obtained:

[0069] (1)​​​​

[0070] The second one belongs to one entity (e.g., k = 1, 2) , which is used to calculate the representation of the entity .

[0071] (2)

[0072] Then, the representation of the sentence (i.e. ) and the two entities (i.e. and ) are concatenated, and a trainable matrix is applied to the concatenated vector to map it to the output space o:

[0073] (3)

[0074] where o is a |R| -dimensional vector whose each value points to a relation type in the set of relation types R.

[0075] Finally, a softmax function of o is used to predict the relation between :

[0076] (4)

[0077] Let denote the value at dimension u in o.

[0078] o contains the prediction results for each position in the sequence, which can be used for various sequence prediction tasks, such as the relation between the two extracted entities .

[0079] S313: Adjust the relationship extraction primary model value according to the prediction result.

[0080] Different prediction results constitute a first set of safety relation predictions, and the relationship extraction primary model parameters are adjusted according to the difference between the set of safety relation predictions and the actual value.

[0081] S302: Input the first output set as an input set into the relationship extraction secondary model to obtain a second comprehensive sequence corresponding to each of the first comprehensive sequences, and the second comprehensive sequence constitutes a second output set:

[0082] The BiLSTM model is combined with the relation extraction first-level model to become a relation extraction second-level model.

[0083] The second comprehensive sequence is input into the output layer as input data. The output of the relation extraction second-level model is obtained. .

[0084] S303 inputs the second output set into the output layer to obtain a safety event prediction result set, and adjusts parameters of the relation pre-extraction model according to the safety event prediction result set:

[0085] The second comprehensive sequence is input into the output layer as input data. The output layer executes S312 to obtain a corresponding prediction result , and a safety event prediction result set is composed of the prediction result. The parameters of the relation extraction second-level model are adjusted according to the difference between the safety event prediction result set and the actual value.

[0086] S4: input the test data set data into the relation pre-extraction model to obtain a corresponding safety event prediction result set, and calculate the performance parameters of the model according to the result. If the performance parameters are higher than a preset value, the pre-relation extraction model is saved as a safety relation extraction model. If the performance parameters do not reach the preset value, repeat step S3:

[0087] The technical scheme of the present application adopts a standard Micro-F1 score as an evaluation index, and determines the model performance according to the Micro-F1 score of the model.

[0088] The model that reaches the preset required performance score is stored as a safety relation extraction model.

[0089] Finally, the final performance of the safety relation extraction model of the present application is compared with the model performance commonly used in the prior art, and it can be found that the technical scheme of the present application has obvious progress in performance.

[0090]

[0091] Secondly, the embodiment provides a network security relationship extraction system, which comprises:

[0092] an input module, a control module, a data processing module, a prediction module and a storage module;

[0093] The input module is configured to collect network security event data and input the data into the data processing module.

[0094] The control module is configured to store a computer program and issue instructions to the data processing module and the classification module through the program.

[0095] The program is configured to implement the method of the embodiment.

[0096] The data processing module is configured to process data according to the instructions and establish a data model according to the instructions.

[0097] The prediction module is configured to extract and predict the security relationship of the data processed by the processing module according to the instructions and the data model.

[0098] The storage module is configured to output the results of the prediction module.

[0099] The storage module is also configured to store the data model.

[0100] Thirdly, the embodiment provides a terminal, which comprises a predictor, an input device, an output device and a controller, wherein the input device, the output device, the predictor and the controller are connected to each other, the controller is configured to store a network security relationship extraction program, the network security relationship extraction program is configured to implement the method of the embodiment, the controller is also configured to issue instructions to the predictor according to the program, and the controller is also configured to collect, label and pre-process data, train a data model, the predictor is configured to extract the network security relationship of a data set according to the program instructions and the data model, and obtain a corresponding network security relationship data set.

[0101] Finally, it should be noted that the above only describes the preferred embodiments of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent replacements to some technical features. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A network security relation extraction method, characterized in that, The method comprises the following steps: S1: obtaining a safety event data set, cleaning and preprocessing the data in the safety event data set to obtain an initial data set, and dividing the initial data set marked with a preset proportion into a training data set and a test data set; S2: constructing a relation extraction prediction model, the relation extraction prediction model comprising a relation extraction first-level model, a relation extraction second-level model and an output layer; the relation extraction first-level model comprising a data conversion layer and a relation extraction layer; S3: inputting the training data set into the relation extraction first-level model to obtain a first comprehensive sequence corresponding to each data in the training data set, the first comprehensive sequence being a comprehensive sequence containing data text information and dependency relations, and the first comprehensive sequence forming a first output set; inputting the first output set into the relation extraction second-level model to obtain a second comprehensive sequence corresponding to each first comprehensive sequence, the second comprehensive sequence being a comprehensive sequence containing global information and local details in the first comprehensive sequence, and the second comprehensive sequence forming a second output set; inputting the second output set into the output layer to obtain a safety event prediction result set composed of safety event prediction results corresponding to each second comprehensive sequence, and adjusting parameters of the relation extraction prediction model according to the safety event prediction result set; S4: inputting the test data set into the relation extraction prediction model to obtain performance parameters of the model, if the performance parameters are higher than a preset value, saving the relation extraction prediction model as a safety relation extraction model, and if the performance parameters do not reach the preset value, repeating step S3; The relation extraction first-level model comprises a conversion layer based on a BERT model and a relation extraction layer based on an A-GCN model, and is composed of two parts in combination. The relation extraction first-level model encodes the input sentence into a hidden vector, and then generates a comprehensive sequence representation output. The relation extraction second-level model comprises a backward LSTM layer and a forward LSTM layer, generates a comprehensive sequence representation, and inputs it into the output layer for prediction. The relation extraction second-level model is combined with the relation extraction first-level model based on a BiLSTM model as a prototype. The relation extraction second-level model comprises a forward LSTM layer and a backward LSTM layer. The first comprehensive sequence generated by the relation extraction first-level model is input into the relation extraction second-level model. The forward LSTM layer and the backward LSTM layer process the input respectively, further capture the data information from front to back and from back to front in the sequence, and the relation extraction second-level model splices the outputs of the forward LSTM layer and the backward LSTM layer to generate the second comprehensive sequence.

2. The network security relation extraction method of claim 1, wherein, In S1, 2n markers are used to mark the boundaries of the subject and object, where n≥2, and the subject and object are the subject and object in the natural language recorded in the data set that meet the definition of natural language.

3. The network security relation extraction method of claim 1, wherein, In the S1, when pre-processing the data sets, firstly, a dependency tree is generated for the data X in each data set , and the dependency tree is pruned.

4. The network security relationship extraction method of claim 3, wherein, In the S1, the pruning rule is determined according to the dependency relationship between each entity in the data X in the dependency tree, the frequency of occurrence of the entity in the entire data set, and the importance of the entity, to remove entities with a frequency of occurrence, importance lower than a preset value, and dependency relationships with an impact less than a preset value.

5. The method of claim 1, wherein, In the S3, the data transformation layer captures the text context information of the input data and converts it into a corresponding hidden vector containing semantic information, and the relationship extraction layer converts the hidden vector into a first comprehensive sequence.

6. The method of claim 1, wherein, The relationship extraction two-level model in the S3 further captures the forward data information and the backward data information in the first comprehensive sequence, and outputs a corresponding second comprehensive sequence.

7. The method of claim 1, wherein, In the S4, Micro-F1 is used as the performance parameter of the relationship extraction prediction model.

8. A cyber-security relationship extraction system, comprising: The system comprises: an input module, a control module, a data processing module, a prediction module, and a storage module; The input module is used to collect network security event data and input the data into the data processing module. The control module is used to store a computer program and issue instructions to the data processing module and the prediction module through the program. The program is used to implement the method of any one of claims 1-7. The data processing module is used to process data according to the instructions, and also used to establish a data model according to the instructions. The prediction module is used to extract and predict the security relationship of the data processed by the processing module according to the instructions and the data model. The storage module is used to output the results of the prediction module. The storage module is also used to store the data model.

9. A terminal, characterized by comprising: The system comprises a predictor, an input device, an output device, a controller, and the input device, the output device, the predictor, and the controller are connected to each other, wherein the controller is used to store a network security relationship extraction program, the network security relationship extraction program is used to implement the method of any one of claims 1-7, the controller is also used to issue instructions to the predictor according to the program, and the controller is also used to collect, label, and pre-process data, train a data model, and the predictor is used to extract network security relationships from a data set according to the program instructions and the data model, and obtain a corresponding network security relationship data set.

Images