Threat intelligence extraction model training method and device and threat intelligence classification method and device

Abstract

The invention discloses a threat intelligence extraction model training method and device and a threat intelligence classification method and device. The threat intelligence extraction model training method comprises the steps of obtaining a basic model; an AdamW optimizer and a learning rate adjustment strategy are used, data processed by the data loader serve as samples, the samples are transmitted to the basic model in batches to be trained, a final model is obtained, threat intelligence serves as input of the samples, and description information of vulnerability types serves as output of the samples. Through the method and the device provided by the embodiment of the invention, the training efficiency and the training effect of the model are improved, and the final classification effect is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for threat intelligence extraction model training and threat intelligence classification. Background Art

[0002] In recent years, the development of artificial intelligence technology, including machine learning and deep learning, has made network attacks and intrusions more diverse and more difficult to analyze. The difficulty of classifying some threat intelligence is also increasing. Therefore, threat intelligence detection and classification technology based on deep learning and artificial intelligence also urgently needs researchers to continue to explore and study.

[0003] Most of the current threat intelligence vulnerability mining and classification algorithms and models use traditional classification models, giving the model threat intelligence and vulnerability categories as training content. However, the training is difficult, and the relationship between threat intelligence and a digital category is hidden and difficult to discover. As a result, it is difficult to explain how to obtain the classification principle of vulnerability information. Summary of the invention

[0004] In view of this, the present invention proposes a method and device for threat intelligence extraction model training and threat intelligence classification, aiming to solve one or more of the technical problems mentioned in the above background technology part.

[0005] In a first aspect, an embodiment of the present invention provides a method for training a threat intelligence extraction model, the method comprising: obtaining a basic model; using an AdamW optimizer and a learning rate adjustment strategy, taking the data processed by a data loader as samples, passing them to the basic model in batches for training, and obtaining a final model, wherein the samples take threat intelligence as input and take description information of the vulnerability type as output.

[0006] Furthermore, the basic model is obtained in the following manner: setting hyperparameters; loading a pre-trained T5 model as the basic model.

[0007] Furthermore, the data processed by the data loader is obtained in the following manner: constructing a data loader dataLoader, and using the data loader dataLoader to process the data.

[0008] Furthermore, the samples include a training set and a test set. The AdamW optimizer and the learning rate adjustment strategy are used to take the data processed by the data loader as samples, and the data are passed to the basic model for training in batches to obtain the final model, including: passing the current batch training set to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain an encoded intermediate state sequence; the encoded intermediate state sequence and the description information of the vulnerability type are input into the decoder; the decoder uses the description information of the vulnerability type to continuously correct the generated result, and updates the model, and obtains the loss of the current batch training set; based on the loss of the current batch training set, the gradient value of the loss is obtained, and the gradient accumulation update method is used to update the model parameters once after each gradient accumulation step; the current batch test set is used to evaluate the training effect of this round; the above steps are repeated until all batches of samples are traversed, and the model with the best evaluation effect and performance is saved as the final model.

[0009] Furthermore, the current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain an encoded intermediate state sequence, including: inputting the threat intelligence as an input sequence into the word embedding layer to convert each word into a vector representation of a fixed dimension and then output it; adding a position code to the output result of the word embedding layer to encode the position information of each word in the input sequence; and inputting the encoded sequence into a multi-layer self-attention mechanism and a feedforward neural network to obtain and output an encoded intermediate state sequence.

[0010] Furthermore, the description information of the encoding intermediate state sequence and the vulnerability type is input into the decoder, including: inputting the encoding intermediate state sequence into a word embedding layer to convert each word into a vector representation of a fixed dimension; adding a position code to the output result of the word embedding layer for the position information of each word in the encoding intermediate state sequence; inputting the encoded sequence into a multi-layer self-attention mechanism and a feedforward neural network for decoding to generate the current target word; at each position, converting the vector representation output by the decoder into a probability distribution through a softMax function to generate the next target word; repeating the stacking of the self-attention mechanism and the feedforward neural network multiple times to gradually generate each word of the target sequence; when generating the target sequence, using a beam search algorithm to select the sequence with the highest generation probability.

[0011] In a second aspect, an embodiment of the present invention also provides a method for classifying threat intelligence, the method comprising: obtaining threat intelligence; inputting the threat intelligence into a threat intelligence extraction model to obtain descriptive information of a predicted vulnerability type, wherein the threat intelligence extraction model is trained using the methods provided in the above-mentioned embodiments; calculating the similarity between the descriptive information of the predicted vulnerability type and the descriptive information of an existing label, and selecting the existing label corresponding to the highest similarity as the category of the threat intelligence.

[0012] Furthermore, calculating the similarity between the description information of the predicted vulnerability type and the description information of the existing label includes: using a Ratcliff-Obershelp similarity algorithm to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing label.

[0013] In a third aspect, an embodiment of the present invention provides a device for training a threat intelligence extraction model, the device comprising: a first acquisition unit, used to obtain a basic model; a training unit, used to use an AdamW optimizer and a learning rate adjustment strategy, to take the data processed by a data loader as samples, and pass them to the basic model in batches for training to obtain a final model, wherein the samples take threat intelligence as input and take description information of the vulnerability type as output.

[0014] Furthermore, the basic model is obtained in the following manner: setting hyperparameters; loading a pre-trained T5 model as the basic model.

[0015] Furthermore, the data processed by the data loader is obtained in the following manner: constructing a data loader dataLoader, and using the data loader dataLoader to process the data.

[0016] Furthermore, the samples include a training set and a test set. The AdamW optimizer and the learning rate adjustment strategy are used to take the data processed by the data loader as samples, and the data are passed to the basic model for training in batches to obtain the final model, including: passing the current batch training set to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain an encoded intermediate state sequence; the encoded intermediate state sequence and the description information of the vulnerability type are input into the decoder; the decoder uses the description information of the vulnerability type to continuously correct the generated result, and updates the model, and obtains the loss of the current batch training set; based on the loss of the current batch training set, the gradient value of the loss is obtained, and the gradient accumulation update method is used to update the model parameters once after each gradient accumulation step; the current batch test set is used to evaluate the training effect of this round; the above steps are repeated until all batches of samples are traversed, and the model with the best evaluation effect and performance is saved as the final model.

[0017] Furthermore, the current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain an encoded intermediate state sequence, including: inputting the threat intelligence as an input sequence into the word embedding layer to convert each word into a vector representation of a fixed dimension and then output it; adding a position code to the output result of the word embedding layer to encode the position information of each word in the input sequence; and inputting the encoded sequence into a multi-layer self-attention mechanism and a feedforward neural network to obtain and output an encoded intermediate state sequence.

[0018] Furthermore, the description information of the encoding intermediate state sequence and the vulnerability type is input into the decoder, including: inputting the encoding intermediate state sequence into a word embedding layer to convert each word into a vector representation of a fixed dimension; adding a position code to the output result of the word embedding layer for the position information of each word in the encoding intermediate state sequence; inputting the encoded sequence into a multi-layer self-attention mechanism and a feedforward neural network for decoding to generate the current target word; at each position, converting the vector representation output by the decoder into a probability distribution through a softMax function to generate the next target word; repeating the stacking of the self-attention mechanism and the feedforward neural network multiple times to gradually generate each word of the target sequence; when generating the target sequence, using a beam search algorithm to select the sequence with the highest generation probability.

[0019] In a fourth aspect, an embodiment of the present invention further provides a device for classifying threat intelligence, the device comprising: a second acquisition unit, used to acquire threat intelligence; a prediction unit, used to input the threat intelligence into a threat intelligence extraction model to obtain description information of a predicted vulnerability type, wherein the threat intelligence extraction model is trained using the methods provided in the above-mentioned embodiments; a classification unit, used to calculate the similarity between the description information of the predicted vulnerability type and the description information of an existing label, and select the existing label corresponding to the highest similarity as the category of the threat intelligence.

[0020] Furthermore, calculating the similarity between the description information of the predicted vulnerability type and the description information of the existing label includes: using a Ratcliff-Obershelp similarity algorithm to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing label.

[0021] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the methods provided in the above embodiments are implemented.

[0022] In a sixth aspect, an embodiment of the present invention further provides an electronic device, comprising: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the methods provided in the above embodiments.

[0023] The method and device for training a threat intelligence extraction model provided by an embodiment of the present invention use an AdamW optimizer and a learning rate adjustment strategy, use the data processed by a data loader as samples, and pass them to a basic model in batches for training to obtain a final model, wherein the sample uses threat intelligence as input and uses description information of the vulnerability type as output, and converts the text classification problem into a text prediction problem, thereby simplifying the complexity of the problem and improving the training efficiency of the problem, allowing the model to pay more attention to the correlation between the potential information of the original content and its internal key information, thereby prompting the model to converge faster and achieve good efficiency, reducing training efficiency and time, as well as training costs, and having more industrial implementation value.

[0024] The method and device for threat intelligence classification provided by the embodiments of the present invention input threat intelligence into a threat intelligence extraction model to obtain descriptive information of a predicted vulnerability type, calculate the similarity between the descriptive information of the predicted vulnerability type and the descriptive information of an existing label, and select the existing label corresponding to the highest similarity as the category of threat intelligence. This improves the training efficiency and training effect of the model on the one hand, and improves the final classification effect on the other hand. Compared with traditional classification models, this has a broader room for improvement. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 An exemplary flow chart of a method for training a threat intelligence extraction model according to an embodiment of the present invention is shown;

[0026] Figure 2 A schematic diagram showing a training process of a threat intelligence extraction model according to an embodiment of the present invention is shown;

[0027] Figure 3 An exemplary flow chart of a method for classifying threat intelligence according to an embodiment of the present invention is shown;

[0028] Figure 4 A schematic diagram showing a process of classifying threat intelligence according to an embodiment of the present invention is shown;

[0029] Figure 5 A schematic diagram of the structure of a device for training a threat intelligence extraction model according to an embodiment of the present invention is shown;

[0030] Figure 6 A schematic diagram of the structure of a device for classifying threat intelligence according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0031] Now, exemplary embodiments of the present invention are described with reference to the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. These embodiments are provided to disclose the present invention in detail and completely and to fully convey the scope of the present invention to those skilled in the art. The terms used in the exemplary embodiments shown in the accompanying drawings are not intended to limit the present invention. In the accompanying drawings, the same units / elements are marked with the same reference numerals.

[0032] Unless otherwise specified, the terms (including technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it is understood that the terms defined in commonly used dictionaries should be understood to have the same meanings as those in the context of the relevant fields, and should not be understood as idealized or overly formal meanings.

[0033] Figure 1 An exemplary flow chart of a method for training a threat intelligence extraction model according to an embodiment of the present invention is shown.

[0034] like Figure 1 As shown, the method includes:

[0035] Step S101: Obtain a basic model.

[0036] Furthermore, the basic model is obtained as follows:

[0037] Set hyperparameters;

[0038] Load the pre-trained T5 model as the base model.

[0039] Specifically, the hyperparameters are set as shown in Table 1:

[0040] Table 1 Hyperparameters

[0041] length_penalty 2.0 do_sample FALSE num_beams 1 num_return_sequences 1 repetition_penalty 1.0 num_epochs 10 learning_rate 1e-3 optimizer AdamW scheduler linear_schedule_with_warmup batch_size 32 gradient_accumulation_steps 2

[0042] Load the T5 model pre-trained with the Colossal Clean Crawled Corpus (C4) corpus as the basic model for training. The pre-training process is as follows:

[0043] The pre-trained model learns the contextual relevance of words by masking some words in the input text and then predicting these words based on the context;

[0044] The designed pre-training task is applied to the unlabeled dataset, and the model is trained using an unsupervised learning method. During the pre-training process, the model gradually extracts the semantic and grammatical features of the text data based on the pre-training task.

[0045] Step S102: Using the AdamW optimizer and the learning rate adjustment strategy, the data processed by the data loader is used as samples, and is passed to the basic model in batches for training to obtain the final model, in which the samples use threat intelligence as input and the description information of the vulnerability type as output.

[0046] Specifically, threat intelligence is used as input, and the description information of the CWE type is extracted as output (label). For example, an original CWE sample is [a certain threat intelligence, CWE-787]. During training, its sample is converted into: [a certain threat intelligence, the data written by the product exceeds the end or before the beginning of the expected buffer.], and then the model is trained. In other words, the category information of the vulnerability CWE-787 is converted into more detailed description information of the vulnerability, and then the model training can learn to extract the vulnerability meaning within the threat intelligence, avoiding predicting the meaningless category itself (CWE-787).

[0047] Figure 2 FIG. 1 is a schematic diagram showing a training process of a threat intelligence extraction model according to an embodiment of the present invention. Figure 2 As shown, the entire training process is as follows.

[0048] Specifically, the data processed by the data loader is obtained in the following way:

[0049] First, data collection is performed: cve description information, cwe description information, and CweCve association information are collected;

[0050] After that, data processing is carried out: the crawled data is preprocessed into tsv format (tab-delimited) through the data preprocessor, the name and description information of the label are extracted, the threat intelligence and label information are made into training samples required by the model, and the total samples are randomly divided into training set, evaluation set, and test set in a ratio of 8:1:1.

[0051] Furthermore, the data processed by the data loader is obtained in the following way:

[0052] Construct a data loader dataLoader and use the data loader dataLoader to process data.

[0053] Specifically, a dataloader is constructed based on internal threat intelligence and its CWE category (common defect enumeration type) data set, and the constructed data loaders include train_dataloader and test_dataloader.

[0054] Furthermore, the samples include training sets and test sets. Using the AdamW optimizer and learning rate adjustment strategy, the data processed by the data loader is used as samples and passed to the basic model in batches for training to obtain the final model, including:

[0055] The current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain the encoded intermediate state sequence;

[0056] Inputting the description information of the encoding intermediate state sequence and the vulnerability type into the decoder;

[0057] The decoder uses the description information of the vulnerability type to continuously correct the generated results, update the model, and obtain the loss of the current batch training set;

[0058] Based on the loss of the current batch training set, the gradient value of the loss is obtained, and the gradient accumulation update method is used to update the model parameters after each gradient accumulation step;

[0059] Use the current batch test set to evaluate the training effect of this round;

[0060] Repeat the above steps until all batches of samples are traversed, and save the model with the best evaluation effect and performance as the final model.

[0061] Furthermore, the current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain the encoded intermediate state sequence, including:

[0062] Threat intelligence is fed into the word embedding layer as an input sequence to convert each word into a vector representation of a fixed dimension and then output;

[0063] Add position encoding to the output of the word embedding layer to encode the position information of each word in the input sequence;

[0064] The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network to obtain and output the encoded intermediate state sequence.

[0065] Specifically, the above process includes:

[0066] a) The input sequence passes through a word embedding layer to convert each word into a vector representation of fixed dimension;

[0067] b) Add position encoding to the word embedding result to encode the position information of each word in the sequence. Position encoding generally uses trigonometric functions or learned vectors;

[0068] c) Encode the input sequence through a multi-layer self-attention mechanism and feed-forward network;

[0069] d) Self-attention mechanism: It can calculate the attention weight of each position in the sequence with other positions, so as to obtain the context information of each position. The specific operation is to calculate the attention score, multiply the attention score with the input vector and sum them to obtain the weighted context vector representation;

[0070] e) Feedforward neural network: It performs nonlinear transformation on the context vector of each position to increase the expressive power of the model. It usually includes a fully connected layer and an activation function;

[0071] f) Repeat the stacking of self-attention mechanisms and feedforward neural networks multiple times (usually 6 to 12 layers) to gradually extract high-level semantic representations of the sequence;

[0072] g) Output the encoded intermediate state, which contains the context information of the intelligence.

[0073] Furthermore, the description information of the encoded intermediate state sequence and the vulnerability type is input into the decoder, including:

[0074] Input the encoded intermediate state sequence into the word embedding layer to convert each word into a vector representation of fixed dimension;

[0075] Add position encoding to the output of the word embedding layer to encode the position information of each word in the intermediate state sequence;

[0076] The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network for decoding to generate the current target word;

[0077] At each position, the vector representation output by the decoder is converted into a probability distribution through the softMax function to generate the next target word;

[0078] Repeat the stacking of self-attention mechanism and feedforward neural network multiple times to gradually generate each word of the target sequence;

[0079] When generating the target sequence, a beam search algorithm is used to select the sequence with the highest generation probability.

[0080] Specifically, the above process includes:

[0081] a) The input semantic representation (the output of the encoder) passes through a word embedding layer to convert each word into a vector representation of fixed dimension;

[0082] b) Add position encoding to the word embedding result to encode the position information of each word in the sequence;

[0083] c) Decode the input sequence through a multi-layer self-attention mechanism and feed-forward neural network;

[0084] d) Self-attention mechanism: Similar to the encoder, the attention weights of each position in the target sequence and other positions are calculated to obtain contextual information. The difference is that in the decoder, in order to maintain the autoregressive characteristics of the self-attention mechanism, the attention weights after the current position need to be shielded to prevent future information leakage;

[0085] e) Feedforward neural network: nonlinear transformation of the context vector at each position;

[0086] f) At each position, the vector representation output by the decoder is converted into a probability distribution through the softMax function to generate the next target word;

[0087] g) Repeat the stacking of self-attention mechanism and feedforward neural network multiple times to gradually generate each word of the target sequence;

[0088] h) When generating a target sequence, an algorithm such as beam search can be used to select the sequence with the highest generation probability.

[0089] Specifically, based on the loss of the current batch training set, the gradient value of the loss is obtained, and the gradient accumulation update method is used to update the model parameters after each gradient accumulation step, including:

[0090] Based on the loss of the current batch training set, the gradient value of the loss is calculated by backpropagation, and the gradient accumulation update method is used to update the model parameters after each gradient accumulation update gradient_accumulation_steps steps.

[0091] In the above embodiment, the AdamW optimizer and the learning rate adjustment strategy are used, and the data processed by the data loader are used as samples, which are passed to the basic model for training in batches to obtain the final model, wherein the sample takes threat intelligence as input and the description information of the vulnerability type as output. By converting the text classification problem into a text prediction problem, the complexity of the problem is simplified, and at the same time, the training efficiency of the problem is improved, so that the model can pay more attention to the correlation between the potential information of the original content and its internal key information, thereby prompting the model to converge faster and achieve good efficiency, reducing the training efficiency and time, as well as the cost of training, and having more industrial implementation value.

[0092] Figure 3 An exemplary flow chart of a method for classifying threat intelligence according to an embodiment of the present invention is shown.

[0093] like Figure 3 As shown, the method includes:

[0094] Step S301: Obtain threat intelligence;

[0095] Step S302: input the threat intelligence into a threat intelligence extraction model to obtain description information of the predicted vulnerability type, wherein the threat intelligence extraction model is trained using the methods provided in the above embodiments;

[0096] Step S303: Calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing tags, and select the existing tag corresponding to the highest similarity as the category of threat intelligence.

[0097] Furthermore, the similarity between the description information of the predicted vulnerability type and the description information of the existing label is calculated, including:

[0098] The Ratcliff-Obershelp similarity algorithm is used to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing tags.

[0099] Specifically, Figure 4 A schematic diagram of a threat intelligence classification process according to an embodiment of the present invention is shown.

[0100] For the predicted sequence information, the Ratcliff-Obershelp-based similarity algorithm is used to calculate the similarity between it and all CWE description texts, and the similarity between its predicted output and the label description information is calculated based on the number of consecutive subsequences of the same letters in the string (i.e., common subsequences). The specific process is as follows:

[0101] a) For two sequences A and B, calculate their lengths n and m respectively;

[0102] b) Create an n×m matrix to store the matching between each character of string A and B;

[0103] c) Initialize the first row and column of the matrix to 0, indicating that there is no matching character at a certain position of strings A and B;

[0104] d) Traverse all the characters of string A and string B:

[0105] If the characters are the same (i.e. A[i] == B[j]), the value of the current position in the matrix is ​​the value of the previous position plus 1 (i.e. matrix[i][j] = matrix[i-1][j-1] + 1);

[0106] If the characters are different, the value of the current position in the matrix is ​​0;

[0107] e) Find the maximum value in the matrix, that is, the length of the longest continuous matching subsequence.

[0108] f) Calculate the similarity between string A and string B by dividing the length of the longest continuous matching subsequence by the sum of the total lengths of the two strings (ie, similarity = 2*longest matching length / (n+m)).

[0109] In the past, threat intelligence vulnerability detection and classification usually used common classification models to directly associate a piece of threat intelligence with a label id. This classification method is effective when the number of labels is small, but when the number of labels is large, the label id corresponding to the intelligence becomes vague and unclear relative to the threat intelligence, making it difficult to train. This results in poor results when using traditional classification models, and the principles are difficult to explain and have poor robustness.

[0110] Generally speaking, threat intelligence and label information are related, and the label ID has no obvious meaning and significance for the detection and classification model. This embodiment takes note of the connection between threat intelligence and its corresponding label name and description, makes full use of label information, uses preprocessing means to extract label description information and make training samples, rather than simply using label ID numbers, and uses a pre-trained generative deep learning model to extract the intrinsic characteristics and meaning of threat intelligence, and then uses a text similarity calculation method to perform further text classification, and finally completes the classification and detection of threat intelligence, effectively improving the training efficiency and training effect of the model.

[0111] In the above embodiment, threat intelligence is input into a threat intelligence extraction model to obtain descriptive information of a predicted vulnerability type, and the similarity between the descriptive information of the predicted vulnerability type and the descriptive information of an existing label is calculated, and the existing label corresponding to the highest similarity is selected as the category of threat intelligence. This improves the training efficiency and training effect of the model on the one hand, and improves its final classification effect on the other hand. Compared with traditional classification models, this has a broader room for improvement.

[0112] Specifically, the technical effects of the embodiments of the present invention are as follows:

[0113] 1. The embodiments of the present invention can improve the training efficiency and classification efficiency of the model, and have lower training costs. The embodiments of the present invention transform a large-category classification problem into a text generation and selection problem, simplifying the complexity of the problem. At the same time, it improves the training efficiency of the problem, allowing the model to pay more attention to the potential information of the original content and the relevance of its internal key information, thereby prompting the model to converge faster and achieve good efficiency, reducing training efficiency and time, as well as training costs, and having more industrial implementation value;

[0114] 2. The embodiment of the present invention makes the threat intelligence detection model more interpretable and improveable. It further transforms and divides a black box classification model into text classification + similarity comparison, better explores the original content information, and has good interpretability. It can further integrate external information to improve the algorithm's attention to the key content of the original text, thereby improving its final classification effect. Compared with traditional classification models, it has a broader room for improvement.

[0115] Figure 5 A schematic diagram of the structure of a device for training a threat intelligence extraction model according to an embodiment of the present invention is shown.

[0116] like Figure 5 As shown, the device comprises:

[0117] A first acquisition unit 501 is used to acquire a basic model;

[0118] The training unit 501 is used to use the AdamW optimizer and the learning rate adjustment strategy to take the data processed by the data loader as samples, pass them to the basic model in batches for training, and obtain the final model, wherein the samples take threat intelligence as input and take description information of the vulnerability type as output.

[0119] Furthermore, the basic model is obtained as follows:

[0120] Set hyperparameters;

[0121] Load the pre-trained T5 model as the base model.

[0122] Furthermore, the data processed by the data loader is obtained in the following way:

[0123] Construct a data loader dataLoader and use the data loader dataLoader to process data.

[0124] Furthermore, the samples include training sets and test sets. Using the AdamW optimizer and learning rate adjustment strategy, the data processed by the data loader is used as samples and passed to the basic model in batches for training to obtain the final model, including:

[0125] The current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain the encoded intermediate state sequence;

[0126] Inputting the description information of the encoding intermediate state sequence and the vulnerability type into the decoder;

[0127] The decoder uses the description information of the vulnerability type to continuously correct the generated results, update the model, and obtain the loss of the current batch training set;

[0128] Based on the loss of the current batch training set, the gradient value of the loss is obtained, and the gradient accumulation update method is used to update the model parameters after each gradient accumulation step;

[0129] Use the current batch test set to evaluate the training effect of this round;

[0130] Repeat the above steps until all batches of samples are traversed, and save the model with the best evaluation effect and performance as the final model.

[0131] Furthermore, the current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain the encoded intermediate state sequence, including:

[0132] Threat intelligence is fed into the word embedding layer as an input sequence to convert each word into a vector representation of a fixed dimension and then output;

[0133] Add position encoding to the output of the word embedding layer to encode the position information of each word in the input sequence;

[0134] The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network to obtain and output the encoded intermediate state sequence.

[0135] Furthermore, the description information of the encoded intermediate state sequence and the vulnerability type is input into the decoder, including:

[0136] Input the encoded intermediate state sequence into the word embedding layer to convert each word into a vector representation of fixed dimension;

[0137] Add position encoding to the output of the word embedding layer to encode the position information of each word in the intermediate state sequence;

[0138] The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network for decoding to generate the current target word;

[0139] At each position, the vector representation output by the decoder is converted into a probability distribution through the softMax function to generate the next target word;

[0140] Repeat the stacking of self-attention mechanism and feedforward neural network multiple times to gradually generate each word of the target sequence;

[0141] When generating the target sequence, a beam search algorithm is used to select the sequence with the highest generation probability.

[0142] In the above embodiment, the AdamW optimizer and the learning rate adjustment strategy are used, and the data processed by the data loader are used as samples, which are passed to the basic model for training in batches to obtain the final model, wherein the sample takes threat intelligence as input and the description information of the vulnerability type as output. By converting the text classification problem into a text prediction problem, the complexity of the problem is simplified, and at the same time, the training efficiency of the problem is improved, so that the model can pay more attention to the correlation between the potential information of the original content and its internal key information, thereby prompting the model to converge faster and achieve good efficiency, reducing the training efficiency and time, as well as the cost of training, and having more industrial implementation value.

[0143] Figure 6 A schematic diagram of the structure of a device for classifying threat intelligence according to an embodiment of the present invention is shown.

[0144] like Figure 6 As shown, the device comprises:

[0145] The second acquisition unit 601 is used to acquire threat intelligence;

[0146] A prediction unit 602 is used to input threat intelligence into a threat intelligence extraction model to obtain description information of predicted vulnerability types, wherein the threat intelligence extraction model is trained using the methods provided in the above embodiments;

[0147] The classification unit 603 is used to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing label, and select the existing label corresponding to the highest similarity as the category of threat intelligence.

[0148] Furthermore, the similarity between the description information of the predicted vulnerability type and the description information of the existing label is calculated, including:

[0149] The Ratcliff-Obershelp similarity algorithm is used to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing tags.

[0150] In the above embodiment, threat intelligence is input into a threat intelligence extraction model to obtain descriptive information of a predicted vulnerability type, and the similarity between the descriptive information of the predicted vulnerability type and the descriptive information of an existing label is calculated, and the existing label corresponding to the highest similarity is selected as the category of threat intelligence. This improves the training efficiency and training effect of the model on the one hand, and improves its final classification effect on the other hand. Compared with traditional classification models, this has a broader room for improvement.

[0151] Specifically, the technical effects of the embodiments of the present invention are as follows:

[0152] 1. The embodiments of the present invention can improve the training efficiency and classification efficiency of the model, and have lower training costs. The embodiments of the present invention transform a large-category classification problem into a text generation and selection problem, simplifying the complexity of the problem. At the same time, it improves the training efficiency of the problem, allowing the model to pay more attention to the potential information of the original content and the relevance of its internal key information, thereby prompting the model to converge faster and achieve good efficiency, reducing training efficiency and time, as well as training costs, and having more industrial implementation value;

[0153] 2. The embodiment of the present invention makes the threat intelligence detection model more interpretable and improveable. It further transforms and divides a black box classification model into text classification + similarity comparison, better explores the original content information, and has good interpretability. It can further integrate external information to improve the algorithm's attention to the key content of the original text, thereby improving its final classification effect. Compared with traditional classification models, it has a broader room for improvement.

[0154] It should be noted that the device provided in the above embodiment only uses the division of the above functional modules as an example to implement its functions. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0155] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for training a threat intelligence extraction model or the method for classifying threat intelligence provided in the above-mentioned embodiments is implemented.

[0156] An embodiment of the present invention also provides an electronic device, comprising: a processor; a memory for storing processor executable instructions; the processor is used to read the executable instructions from the memory and execute the instructions to implement the threat intelligence extraction model training method or threat intelligence classification method provided in the above-mentioned embodiments.

[0157] The invention has been described above with reference to a few embodiments. However, it is readily apparent to a person skilled in the art that other embodiments than the ones disclosed above are equally within the scope of the invention, as defined by the appended patent claims.

[0158] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a / said / the [means, components, etc.]" are to be openly interpreted as at least one instance of the means, components, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not necessarily have to be performed in the exact order disclosed, unless explicitly stated otherwise.

[0159] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0160] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0161] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0162] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0163] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for training a threat intelligence extraction model, characterized in that: The method comprises: Get the base model; Using the AdamW optimizer and the learning rate adjustment strategy, the data processed by the data loader is used as samples and passed to the basic model in batches for training to obtain the final model, wherein the samples take threat intelligence as input and the description information of the vulnerability type as output.

2. The method according to claim 1, characterized in that The basic model is obtained in the following way: Set hyperparameters; Load the pre-trained T5 model as the base model.

3. The method according to claim 1, characterized in that The data processed by the data loader is obtained in the following manner: Construct a data loader dataLoader and use the data loader dataLoader to process data.

4. The method according to claim 1, characterized in that: The samples include training sets and test sets. The AdamW optimizer and learning rate adjustment strategy are used to pass the data processed by the data loader as samples to the basic model for training in batches to obtain the final model, including: The current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain the encoded intermediate state sequence; Inputting the description information of the encoding intermediate state sequence and vulnerability type into a decoder; The decoder uses the description information of the vulnerability type to continuously correct the generated results, update the model, and obtain the loss of the current batch training set; Based on the loss of the current batch training set, the gradient value of the loss is obtained, and the gradient accumulation update method is used to update the model parameters after each gradient accumulation step; Use the current batch test set to evaluate the training effect of this round; Repeat the above steps until all batches of samples are traversed, and save the model with the best evaluation effect and performance as the final model.

5. The method according to claim 4, characterized in that The current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain an encoded intermediate state sequence, including: Threat intelligence is fed into the word embedding layer as an input sequence to convert each word into a vector representation of a fixed dimension and then output; Adding position encoding to the output result of the word embedding layer to encode the position information of each word in the input sequence; The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network to obtain and output the encoded intermediate state sequence.

6. The method according to claim 4, characterized in that Inputting the description information of the encoded intermediate state sequence and the vulnerability type into the decoder includes: Inputting the encoded intermediate state sequence into a word embedding layer to convert each word into a vector representation of a fixed dimension; Adding position encoding to the output result of the word embedding layer for the position information of each word in the encoding intermediate state sequence; The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network for decoding to generate the current target word; At each position, the vector representation output by the decoder is converted into a probability distribution through the softMax function to generate the next target word; Repeat the stacking of self-attention mechanism and feedforward neural network multiple times to gradually generate each word of the target sequence; When generating the target sequence, a beam search algorithm is used to select the sequence with the highest generation probability.

7. A method for classifying threat intelligence, characterized in that: The method comprises: Obtain threat intelligence; Inputting the threat intelligence into a threat intelligence extraction model to obtain description information of the predicted vulnerability type, wherein the threat intelligence extraction model is trained using the method described in any one of claims 1 to 6 above; The similarity between the description information of the predicted vulnerability type and the description information of the existing label is calculated, and the existing label corresponding to the highest similarity is selected as the category of threat intelligence.

8. The method according to claim 7, characterized in that Calculating the similarity between the description information of the predicted vulnerability type and the description information of the existing label includes: The Ratcliff-Obershelp similarity algorithm is used to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing label.

9. A device for training a threat intelligence extraction model, characterized in that: The device comprises: A first acquisition unit, used for acquiring a basic model; The training unit is used to use the AdamW optimizer and the learning rate adjustment strategy to take the data processed by the data loader as samples, pass them to the basic model in batches for training, and obtain the final model, wherein the samples take threat intelligence as input and take description information of the vulnerability type as output.

10. The device according to claim 9, characterized in that The basic model is obtained in the following way: Set hyperparameters; Load the pre-trained T5 model as the base model.

11. The device according to claim 9, characterized in that The data processed by the data loader is obtained in the following manner: Construct a data loader dataLoader and use the data loader dataLoader to process data.

12. The device according to claim 9, characterized in that The samples include training sets and test sets. The AdamW optimizer and learning rate adjustment strategy are used to pass the data processed by the data loader as samples to the basic model for training in batches to obtain the final model, including: The current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain the encoded intermediate state sequence; Inputting the description information of the encoding intermediate state sequence and vulnerability type into a decoder; The decoder uses the description information of the vulnerability type to continuously correct the generated results, update the model, and obtain the loss of the current batch training set; Based on the loss of the current batch training set, the gradient value of the loss is obtained, and the gradient accumulation update method is used to update the model parameters after each gradient accumulation step; Use the current batch test set to evaluate the training effect of this round; Repeat the above steps until all batches of samples are traversed, and save the model with the best evaluation effect and performance as the final model.

13. The device according to claim 12, characterized in that The current batch training set is passed to the basic model for training. During the training, the threat intelligence is input into the encoder to obtain an encoded intermediate state sequence, including: Threat intelligence is fed into the word embedding layer as an input sequence to convert each word into a vector representation of a fixed dimension and then output; Adding position encoding to the output result of the word embedding layer to encode the position information of each word in the input sequence; The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network to obtain and output the encoded intermediate state sequence.

14. The device according to claim 12, characterized in that Inputting the description information of the encoded intermediate state sequence and the vulnerability type into the decoder includes: Inputting the encoded intermediate state sequence into a word embedding layer to convert each word into a vector representation of a fixed dimension; Adding position encoding to the output result of the word embedding layer for the position information of each word in the encoding intermediate state sequence; The encoded sequence is input into a multi-layer self-attention mechanism and feedforward neural network for decoding to generate the current target word; At each position, the vector representation output by the decoder is converted into a probability distribution through the softMax function to generate the next target word; Repeat the stacking of self-attention mechanism and feedforward neural network multiple times to gradually generate each word of the target sequence; When generating the target sequence, a beam search algorithm is used to select the sequence with the highest generation probability.

15. A device for classifying threat intelligence, characterized in that: The device comprises: The second acquisition unit is used to acquire threat intelligence; A prediction unit, used to input the threat intelligence into a threat intelligence extraction model to obtain description information of the predicted vulnerability type, wherein the threat intelligence extraction model is trained by the method described in any one of claims 1 to 6 above; The classification unit is used to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing label, and select the existing label corresponding to the highest similarity as the category of threat intelligence.

16. The device according to claim 15, characterized in that Calculating the similarity between the description information of the predicted vulnerability type and the description information of the existing label includes: The Ratcliff-Obershelp similarity algorithm is used to calculate the similarity between the description information of the predicted vulnerability type and the description information of the existing label.

17. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method described in any one of claims 1-6 or 7-8 is implemented.

18. An electronic device, comprising: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1-6 or 7-8.

Images