Knowledge graph construction method and system oriented to threat intelligence processing and computer readable storage medium

Abstract

The invention belongs to the technical field of information retrieval security, and particularly relates to a threat intelligence processing-oriented knowledge graph construction method and system and a computer readable storage medium. The method comprises the steps that structured data, semi-structured data and unstructured data are collected and processed respectively; performing entity relationship extraction on the to-be-analyzed threat intelligence text data to obtain a target entity relationship recognition result; and finally, constructing the knowledge graph. The method solves the problems that sources of threat intelligence generally have the characteristic of multi-source isomerism, data integration and analysis complexity is caused by diversity, and construction of a high-quality knowledge graph is affected.

Description

Technical Field

[0001] The present invention belongs to the technical field of information retrieval security, and more specifically, relates to a knowledge graph construction method, system and computer-readable storage medium for threat intelligence processing. Background Art

[0002] Threat intelligence refers to the evidential knowledge about existing or emerging threats to assets, which supports decision makers in responding to threats. Threat intelligence contains a large amount of valuable information and potential expressions in different structures. By adopting different processing methods and technologies for learning, extraction and analysis, the knowledge provided by threat intelligence can be fully utilized. Constructing a threat intelligence knowledge graph can transform the invisible or seemingly unrelated multi-source heterogeneous threat information into an intuitive and easy-to-understand knowledge graph, providing security researchers and practitioners with more comprehensive and rich threat knowledge, in-depth analysis of threat information, tracking attack chains, and inferring attackers' intentions, thereby enhancing the ability to respond to network security threats and providing strong support for security research and practice.

[0003] Chinese invention patent CN110717049A discloses a method for constructing a threat intelligence knowledge graph for text data. First, the ontology structure of the threat intelligence field is defined, and the threat intelligence entity and relationship triples are obtained from the text data using a threat intelligence named entity recognition model based on multiple factors and a threat intelligence entity relationship extraction model based on a graph neural network. Finally, the information is stored in a graph database to form a threat intelligence knowledge graph.

[0004] Existing threat intelligence knowledge graph construction solutions usually need to go through the stages of data collection and organization, knowledge extraction, fusion and update, graph construction, storage and application. Among them, data collection and organization is the first step in graph construction, and the quality of data often determines the quality of the graph and the progress of subsequent links. Knowledge extraction is a particularly important step in graph construction, which includes identifying entities, relationships and attributes from a large amount of unstructured data. Entity extraction and attribute extraction are important components of knowledge extraction and can be achieved through named entity recognition (NER) algorithms. The development of NER technology has evolved from dictionary and rule-based methods to machine learning-based methods and then to deep learning-based methods. In particular, with the introduction of the BERT pre-training model, the traditional benchmark model for threat intelligence knowledge graph construction has evolved from the BiLSTM-CRF model to the BERT-BiLSTM-CRF model, which significantly improves the accuracy of entity and attribute extraction.

[0005] But there are two main problems. First, traditional baseline models are all studied around BERT. Although BERT performs well in processing a variety of NLP tasks, its fixed maximum sequence length limit may affect its performance in processing ultra-long and complex threat intelligence. Second, the sources of threat intelligence can be divided into internal threat intelligence and external threat intelligence. From a structural point of view, it can be divided into structured data, semi-structured data, and unstructured data. They usually have multi-source heterogeneous characteristics, and this diversity leads to the complexity of data integration and analysis. Most open source external threat intelligence data still have low quality problems, which may affect the construction of high-quality knowledge graphs. Summary of the invention

[0006] The present invention aims to overcome at least one of the defects of the above-mentioned prior art and provide a knowledge graph construction method for threat intelligence processing, which provides an effective solution to the challenge of named entity recognition in long-sequence threat intelligence. In addition, by integrating and collating heterogeneous data from different sources and formats, the method can efficiently construct a comprehensive and accurate knowledge graph, providing strong support for the research and practice of downstream security tasks.

[0007] The present invention also includes a system for implementing a method for constructing a knowledge graph based on threat intelligence processing.

[0008] The present invention also includes a computer readable storage medium.

[0009] The detailed technical scheme of the present invention is as follows:

[0010] A method for constructing a knowledge graph for threat intelligence processing, the method comprising:

[0011] S1. Obtain the threat intelligence text data to be analyzed and extract the required structured data;

[0012] The threat intelligence text data to be analyzed is obtained by configuring multiple web crawlers to regularly crawl data from a public threat intelligence platform. Specifically, the threat intelligence text data to be analyzed includes:

[0013] S11. Use a distributed crawler architecture to collect data, and deduplicate and filter the crawled content to reduce noise data;

[0014] S12, performing data preprocessing to extract required structured data;

[0015] S13, perform data standardization, map the pre-processed data to the STIX format, and transmit the data through the TAXII protocol to obtain the threat intelligence text data to be analyzed. Furthermore, for network security events, the CybOX standard is used to describe them, including the type, source, target, and impact of the event.

[0016] S2. Performing knowledge extraction on the threat intelligence text data to be analyzed to obtain entity relationship recognition results in the text, wherein the knowledge extraction includes entity recognition and relationship extraction;

[0017] S3. Build a knowledge graph by taking entities as nodes in the graph and the relationships between entities as edges.

[0018] Furthermore, the data categories of the threat intelligence text data to be analyzed include structured data, semi-structured data and unstructured data, and the data preprocessing respectively includes:

[0019] For structured data, follow the standardized threat intelligence format or have the ability to generate STIX format content, and use data cleaning technology to remove HTML templates and other non-content elements to extract the required structured data;

[0020] For semi-structured data, first remove the template from the web page and retain the article content. Then, use regular expressions, natural language processing algorithms, or manual positioning techniques to accurately extract the structured data required to comply with the STIX standardized format.

[0021] For unstructured data, we perform word segmentation, stop word removal, and part-of-speech tagging operations, and obtain the required structured data after in-depth mining, analysis, filtering and classification, so that we can use high-quality and highly relevant threat intelligence to build a knowledge graph in subsequent work.

[0022] Furthermore, for unstructured data, data filtering is performed by identifying IOCs, filtering out threat-irrelevant data, and identifying it as APT, malicious code, or other categories through classification algorithms;

[0023] Furthermore, the entity recognition includes entity recognition of structured, semi-structured and unstructured data;

[0024] Structured and semi-structured data are subject to entity recognition through preset programs;

[0025] Unstructured data is processed by deep learning algorithms, and entity recognition is performed based on the four-layer XLNet-BiLSTM-SA-CRF model, including:

[0026] 201. Segment the threat intelligence text data into sentences to obtain a text sentence sequence X = {x1, x2, ..., x n}, where x i is the i-th word in sentence X;

[0027] 202. Input the text sentence sequence into the XLNet encoder. The XLNet encoder learns the deep semantic representation of the text through the Transformer architecture embedded with the self-attention mechanism.

[0028] The XLNet encoder introduces relative position encoding in the self-attention mechanism to capture the order relationship between words and fine-tune the parameters of the XLNet encoder. Finally, the XLNet encoder outputs the probability sequence of each word belonging to each entity category, that is, the combined embedding feature E = {e1, e2, ..., e n};

[0029] 203. Use the BiLSTM layer to further capture the sequence characteristics of the combined embedding features of the output words. The BiLSTM layer embeds the combined embedding features of any word e i As input for training models;

[0030] 204. A single-direction LSTM network can only use the contextual information learned from the text sequence. Therefore, a BiLSTM model is composed of two LSTM networks in opposite directions to simultaneously capture the current moment x in the sequence. t The current output of the forward LSTM is The output of the reverse LSTM at this moment is Then and The result after splicing Denote as the feature encoding learned based on the context information at the current moment in the sequence;

[0031] Set H = {h1,h2,···,h T} As the output of the BiLSTM layer, it represents the feature encoding of the current threat intelligence sentence sequence;

[0032] 205. The result processed by BiLSTM is then input into the self-attention layer, namely the SA layer. The self-attention layer allows the model to dynamically focus on the part most relevant to the current task when processing sequence data;

[0033] The output of the SA layer to the BiLSTM layer is H = {h1,h2,···,h T The importance of each element in the sequence is determined by calculating the attention score of each element to all other elements, and the score sequence O = {O1, O2, ..., O n};

[0034] 206. The CRF layer optimizes the label sequence based on the score sequence, models the dependency between labels, and finally obtains the optimal entity label sequence P = {P1, P2, P3, ..., P n}, so that the final label sequence not only meets the score of a single word, but also meets the label transition probability of the entire sequence.

[0035] The present invention uses the XLNet-BiLSTM-SA-CRF model to predict the entity label sequence of each word or character in the text. The model combines the deep semantic representation capability of XLNet, the sequence feature capture capability of BiLSTM, the context relevance enhancement of Self-Attention, and the label dependency optimization of CRF.

[0036] After entity recognition is completed, the relationship extraction uses remote supervision technology, which only requires a small amount of labeled data to train the model. The present invention uses the PCNN model to treat remote supervision learning as a multi-instance learning problem. The PCNN model automatically extracts text features through a convolutional neural network and effectively learns through a segmented pooling strategy to identify the relationship between network security entities.

[0037] Furthermore, before the preprocessed text sentence sequence is input into the XLNet encoder, the XLNet encoder is pre-trained:

[0038] Each word in the threat intelligence text data is converted into an index in the vocabulary, and the annotation is converted into an index in the label index; then, the index sequence of text and label is converted into the input of the XLNet encoder. XLNet is used as the encoder and pre-trained on a large-scale threat intelligence text database to learn a general representation of threats.

[0039] Furthermore, building a knowledge graph includes:

[0040] Various entities are identified through the entity label sequence P obtained in S2, and they are classified into different entity types. The PCNN relationship extraction technology is used to identify the relationship between entities from the text to form a triple in the form of (Subject, Relation, Object). The triple is the basis for building a knowledge graph and helps organize and understand complex threat intelligence data.

[0041] Design the architecture of the knowledge graph, define entity types, attributes, and relationship types, and then build a knowledge graph based on the conceptual model of the threat intelligence field, the UCO ontology model (the unified network ontology model), and the STIX standard. Input triples and select a graph database to store the knowledge graph data.

[0042] The present invention selects key categories based on the UCO ontology model and the STIX standard, and uses them as guiding principles for annotation work in the process of building a data set. These categories include but are not limited to entity identification, attribute classification, and definition of relationships between entities. Through the application of these criteria, systematic annotation of unstructured data is achieved, and then a structured and queryable knowledge graph is constructed, which provides a solid foundation for in-depth mining of network security analysis and threat intelligence.

[0043] In another aspect of the present invention, a system for constructing a knowledge graph for threat intelligence processing is provided, the system comprising:

[0044] at least one processor; and

[0045] A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute the knowledge graph construction method for threat intelligence processing as described above.

[0046] In another aspect of the present invention, a computer-readable storage medium is provided, which stores executable instructions, and when the instructions are executed, the machine executes the knowledge graph construction method for threat intelligence processing as described above.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] (1) The present invention provides a knowledge graph construction method, system and computer-readable storage medium for threat intelligence processing, which constructs the conceptual level of the threat intelligence knowledge graph and adopts the Unified Network Ontology (UCO) model. The UCO ontology model provides a framework for the standardized representation of information in the field of network security, covering entity types, attributes and their relationships. The use of this method ensures that data from different sources and different formats can be represented in a unified manner in the knowledge graph, thereby facilitating the integration, analysis and sharing of data.

[0049] (2) The present invention provides a knowledge graph construction method, system and computer-readable storage medium for threat intelligence processing, which uses the key categories selected from the UCO ontology model as the guiding principles for annotation work in the process of constructing a data set. These categories include but are not limited to entity identification, attribute classification and definition of relationships between entities. Through the application of these criteria, systematic annotation of unstructured data is achieved, and then a structured and queryable knowledge graph is constructed, which provides a solid foundation for network security analysis and in-depth mining of threat intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic flow chart of the method of the present invention.

[0051] Figure 2 It is a schematic diagram of the XLNet-BiLSTM-SA-CRF model architecture described in Example 1 of the present invention.

[0052] Figure 3 This is a schematic diagram of the semi-structured data described in Example 1 of the present invention.

[0053] Figure 4 This is a schematic diagram of the unstructured data described in Example 1 of the present invention. DETAILED DESCRIPTION

[0054] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0055] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0056] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0057] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0058] Example 1

[0059] Ginseng Figure 1 This embodiment provides a method for constructing a knowledge graph for threat intelligence processing, the method comprising:

[0060] S1. Obtain threat intelligence data;

[0061] Threat intelligence can be divided into internal threat intelligence and external threat intelligence according to the source, and can be divided into structured, semi-structured, and unstructured data according to the form. The data collection channels and priorities are determined through classification, and the data is unified into a standardized format in order to effectively integrate and analyze threat intelligence from different sources.

[0062] Specifically, the threat intelligence text data to be analyzed is obtained by configuring multiple web crawlers to regularly crawl data from a public threat intelligence platform, such as malicious IP addresses, malicious domain names, and malicious file hashes. Specifically, the threat intelligence text data to be analyzed is obtained.

[0063] Specifically, obtaining the threat intelligence text data to be analyzed includes:

[0064] S11. In order to improve the collection efficiency, a distributed crawler architecture is used for data collection, and the crawled content is deduplicated and filtered to reduce noise data.

[0065] S12. Perform data preprocessing to extract the required structured data; the preprocessing includes word segmentation and part-of-speech tagging of the collected text data, or extracting key information such as time, location, attacker, and victim according to predefined rules.

[0066] S13. Finally, data standardization is implemented, the pre-processed data is mapped to the STIX format, and the data is transmitted through the TAXII protocol. For network security events, the CybOX standard is used to describe them, including but not limited to the type, source, target, and impact of the event.

[0067] Furthermore, the data categories of the threat intelligence text data to be analyzed include structured data, semi-structured data and unstructured data, and the data preprocessing respectively includes:

[0068] For structured data, follow the standardized threat intelligence format or have the ability to generate STIX format content, and use data cleaning technology to remove HTML templates and other non-content elements to extract the required structured data.

[0069] Specifically, the implementation procedures for structured data acquisition and extraction are as follows:

[0070] Use requests to get the web page content response = requests.get(url);

[0071] Use BeautifulSoup to parse HTML content;

[0072] Clean the HTML, remove unnecessary template parts, remove all script tags and navigation bars;

[0073] Get the cleaned HTML content, cleaned_html = soup.get_text().

[0074] For semi-structured data, such as malicious IP addresses, malware, malicious domain names, and related tactics, techniques, and procedures (TTPs) intelligence, we first strip the template from the web page and retain the article content. Then, we use regular expressions, natural language processing algorithms, or manual positioning techniques to accurately extract the structured data required in the STIX standardized format.

[0075] Semi-structured data is in the form of Figure 3 As shown:

[0076] Title: The latest attack activity of APT1 organization;

[0077] Date: 2024-07-10;

[0078] Attacker: APT1

[0079] Malware sample: Backdoor.APT

[0080] Malicious domain: command-and-control.example.com

[0081] Attack process: Attack process: APT1 organization uses Backdoor.APT malware to conduct C2 communication through the command-and-control.example.com domain name.

[0082] The implementation procedures for semi-structured data acquisition and extraction are as follows:

[0083] Extract key information from the reports and convert them into STIX format;

[0084] First extract the key information:

[0085] Attacker: APT1

[0086] Malware sample: Backdoor.APT

[0087] Malicious domain: command-and-control.example.com

[0088] Attack process: Using Backdoor.APT to communicate with C2 through a specific domain name.

[0089] Then convert to STIX format, as follows:

[0090] Create a STIX Threat Actor object;

[0091] Create a STIX Malware object;

[0092] Create a STIX indicator object;

[0093] Create STIX observation data (Observable) object;

[0094] Specifically, use requests to obtain web page content;

[0095] Use BeautifulSoup to parse HTML content;

[0096] Assume that the article content is in a div tag with id 'article-content', content_div = soup.find('div',id = 'article-content');

[0097] Define regular expressions to match IP addresses, domain names, and hash values

[0098] ip_pattern=r'\b(?:\d{1,3}\.){3}\d{1,3}\b';

[0099] domain_pattern=r'\b(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}\b';

[0100] hash_pattern=r'\b[A-Fa-f0-9]{32,64}\b';

[0101] Find matches using regular expressions

[0102] ips=re.findall(ip_pattern,content);

[0103] domains=re.findall(domain_pattern,content);

[0104] hashes=re.findall(hash_pattern,content).

[0105] Unstructured data, such as natural language text content in security blogs and security websites, cannot be described in a standardized format, so it is necessary to use third-party analysis software to conduct in-depth mining and analysis to obtain unstructured hacker organization behavior information and attacker identity description information; and perform word segmentation, stop word removal and part-of-speech tagging operations, and obtain the required structured data after in-depth mining, analysis and filtering and classification, so as to use high-quality and highly relevant threat intelligence to build a knowledge graph in subsequent work. Figure 4 As shown:

[0106] Recently, a hacker group named "Nightwalker" was found to use a new malware sample "DarkRAT" to attack. The group usually uses the domain name "nightwalker-hq.com" as its C2 server. In addition, security researchers also found that the MD5 hash value associated with the malware is "d41d8cd98feeb204e9880998ecf8427e".

[0107] Specifically, the implementation procedures for unstructured data acquisition and extraction are as follows:

[0108] Use distributed crawlers to collect data, and perform certain deduplication and filtering to prevent the collection of too much redundant threat intelligence.

[0109] Define a Scrapy spider class named DataCollectorSpider, which inherits from RedisSpider. This spider gets URLs from the Redis queue url_queue and ensures that URLs that have been recorded in the visited_urls collection will not be visited repeatedly.

[0110] Use the _random_headers method to generate random request headers to simulate different user agents.

[0111] The _random_user_agent method provides a sample user agent string.

[0112] Use the start_requests method to send network requests. Use a loop to continuously fetch URLs from the Redis queue until a special 'STOP' flag appears in the queue, indicating that the crawler should stop.

[0113] Furthermore, we use the Scrapy framework and Redis as a message queue to implement distributed crawlers. We define a crawler class called ThreatSpider, which inherits from RedisSpider to support distributed crawling.

[0114] Define three collections seen_ips, seen_domains, and seen_hashes to store the crawled data to avoid crawling the same data repeatedly.

[0115] In the parse method, XPath selectors are used to extract malicious IP addresses, domain names, and hash values ​​on the page.

[0116] Use the getall() method to get all matching elements, and use the strip() method to remove the whitespace characters at both ends of the string. Check whether each element already exists in the set. If not, add it to the set and generate a dictionary containing the data and the data source URL, and then yield this dictionary;

[0117] Finally, for long sequences of large-scale threat intelligence, add a hypothetical page turning logic. If there is a link to the next page, use the response.follow() method to request the next page, and call the parse method again to process the new page.

[0118] Furthermore, unstructured data is filtered by identifying IOCs, filtering out threat-irrelevant data, and identified as APT, malicious code, or other categories through classification algorithms.

[0119] The data filtering uses a classification algorithm to analyze HTML files and identify threat indicators, i.e., IOCs. By identifying IOCs, a certain amount of data filtering is performed to filter out threat-irrelevant data, and further identify them as APT, malicious code, or other categories through the TF-IDF algorithm, so that high-quality, highly relevant threat intelligence can be used to build a knowledge graph in subsequent work.

[0120] Specifically, the classification algorithm uses a sample IOC list;

[0121] Define a dictionary that maps text to APT topics, define a dictionary that maps text to malicious code topics, read HTML files, extract text data, check whether the text data contains IOCs, and directly classify those that do not contain IOCs into other categories. Use the NLP library for word segmentation and convert the word segmentation results into text strings for TF-IDF vectorization.

[0122] Convert text to TF-IDF feature matrix, tfidf_matrix = vectorizer.fit_transform([text]); Get TF-IDF weight, feature_names = vectorizer.get_feature_names_out().

[0123] Calculate the weight associated with APT, taking into account the TF-IDF value

[0124] apt_tfidf_weights={word:tfidf_matrix[0,feature_names.tolist().index(word)]for word in

[0125] apt_keywords if word in feature_names}

[0126] apt_weight=sum(apt_keywords.get(word.lower(),0)*apt_tfidf_weights.get(word.lower(),0)for word in apt_keywords)

[0127] #Calculate the weight associated with malicious code, taking into account the TF-IDF value

[0128] malware_tfidf_weights={word:tfidf_matrix[0,feature_names.tolist().index(word)]for word in malware_keywords if word in feature_names}

[0129] malware_weight=sum(malware_keywords.get(word.lower(),0)*

[0130] malware_tfidf_weights.get(word.lower(),0)for word in malware_keywords)

[0131] Classify the data according to the weight and classify it into "APT", "Malware" or "Other".

[0132] The implementation of data standardization is to derive results and construct high-quality data sets;

[0133] Structured, semi-structured data and unstructured data after entity recognition and relationship extraction are uniformly mapped to the STIX format and transmitted through the TAXII protocol. For cybersecurity events, the CybOX standard is used to describe them, including the type, source, target, impact, etc. of the event. Python's stix2 and taxii2 libraries are used to process STIX objects and TAXII transmission.

[0134] Specifically, create a malicious IP indicator and a vulnerability object.

[0135] These two objects are packaged into a STIX Bundle.

[0136] Create an instance of a TAXII Server using the taxii2client.Server class and send the STIX Bundle to the server using the push_bundle method.

[0137] The to_json() method converts the Bundle object into a string in JSON format and transmits it using the TAXII protocol.

[0138] Specifically, the operations of word segmentation, stop word removal and part-of-speech tagging include:

[0139] The security-related posts were annotated by the BIO sequence annotation method to build an IOC extraction model, where BX indicates that an element of type X is at the beginning of a segment, IX indicates that an element of type X is in the middle of a segment, and O indicates other types of non-basic elements. Specifically, "the attacker organization APT1 used a malware tool called Backdoor.APT, which exploited an undisclosed vulnerability in the Windows operating system and successfully infiltrated a target network."

[0140] Using BIO to mark, “Attacker group / B-AttackerAPT1 / I-Attacker used a

[0141] / OBackdoor.APT / B-Tool's / I-Tool malware / I-Tool tool / I-Tool, / OThis / O tool / B-Tool exploits

[0142] / I-ToolWindows / B-VulnerabilityOperating System / I-Vulnerability / I-Vulnerability / I-Vulnerability / Osuccessfully / Openetrated / Oa target / Onetwork / O."

[0143] Split text into words or subsequences. ['Attacker group','APT1','used','a malware','tool','called','Backdoor.APT','which','exploited','an','undisclosed','vulnerability','in','the'Windows','operating system','and','successfully','infiltrated','a'target','network','.'].

[0144] Build a vocabulary that maps each unique word to an index. Before that, remove stop words. Vocabulary = {'Attacker Group':0,'APT1':1,'Backdoor.APT':2,'Malware':3,'Tools':4,'Windows':5,'Operating System':6,'Undisclosed':7,'Vulnerability':8}.

[0145] In the present invention, multiple strategies are used to process data to integrate and organize heterogeneous data from different sources and formats to improve the relevance and quality of the data. Through these strategies, the present invention can also effectively eliminate threat intelligence with poor relevance and low data quality, thereby providing a solid foundation for building a high-quality knowledge graph.

[0146] S2. Performing knowledge extraction on the threat intelligence text data to be analyzed to obtain entity relationship recognition results in the text, wherein the knowledge extraction includes entity recognition and relationship extraction;

[0147] Furthermore, the entity recognition includes entity recognition of structured, semi-structured and unstructured data;

[0148] Structured and semi-structured data are subject to entity recognition through preset programs;

[0149] Unstructured data is processed by deep learning algorithms. This embodiment uses deep learning algorithms to process unstructured data and proposes an XLNet-BiLSTM-SA-CRF model based on a four-layer architecture. The model architecture diagram is as follows: Figure 2 Here are some concepts:

[0150] XLNet: XLNet (eXtreme Language Model Pre-training) is a language model based on the Transformer architecture, which has achieved breakthrough performance in multiple natural language processing tasks. It generates multiple possible prediction tasks by randomly permuting the order of the input sequence, allowing the model to more comprehensively understand and learn the diversity of language.

[0151] The present invention uses XLNet to generate multiple possible prediction tasks by randomly arranging the elements of the input sequence, so that the model can learn the statistical characteristics of the language more comprehensively. XLNet outperforms the traditional BERT in many NLP tasks, especially in tasks that require understanding the complex relationship between sentences, because XLNet's training method allows it to better capture the long-distance dependencies between sentences. Therefore, XLNet has a clear advantage in processing long-sequence complex threat intelligence.

[0152] BiLSTM: BiLSTM, or bidirectional long short-term memory network, is a special recurrent neural network (RNN). Its advantage is that it can simultaneously capture the forward and backward dependencies between time steps in a sequence, which is particularly important for understanding contextual information in text and can provide richer sequence feature representations.

[0153] SA: SA (Self-Attention) is a self-attention mechanism that allows the model to allocate different levels of attention to different parts of the sequence when processing sequence data. The self-attention mechanism enables the model to process sequence data more flexibly, especially in scenarios with long-distance dependencies, it can effectively capture and utilize global information in the sequence.

[0154] CRF: CRF, or conditional random field, is a statistical modeling method that is commonly used in sequence data labeling and prediction tasks. CRF models the label distribution of the entire sequence by defining the label probability of each element in the sequence and considering the transition probability between adjacent labels. The CRF layer, as the output layer, adjusts the output of BiLSTM to better capture the dependencies between labels. CRF is used in tasks such as named entity recognition, part-of-speech tagging, and semantic role labeling, and can improve the accuracy of the model for sequence labeling tasks.

[0155] Furthermore, before the preprocessed text sentence sequence is input into the XLNet encoder, the XLNet encoder is pre-trained:

[0156] Each word in the threat intelligence text data is converted into an index in the vocabulary, and the annotation is converted into an index in the label index; then, the index sequence of text and label is converted into the input of the XLNet encoder, and XLNet is used as the encoder to perform pre-training on a large-scale threat intelligence text database to learn a general representation of threats. The implementation method is as follows:

[0157] Build a tag index, mapping each unique tag to an index.

[0158] {'O':0,'B-Attacker':1,'I-Attacker':2,'B-Tool':3,'I-Tool':4,'B-Vulnerability':5,'I-Vulnerability':6}.

[0159] Convert each word in the text to an index in the vocabulary, and convert the annotation to an index in the tag index. Convert the index sequence of text and tags to the input of the model, use XLNet as the encoder, pre-train on a large-scale threat intelligence corpus, and learn a common representation of threats. Ensure that all sequences are of the same length, and fill in the missing parts with special padding indexes, such as [PAD].

[0160] Entity recognition is performed based on the four-layer XLNet-BiLSTM-SA-CRF model, which includes:

[0161] 201. Segment the threat intelligence into sentences to obtain a text sentence sequence X = {x1, x2, ..., x n}, where x i is the i-th word in sentence X. The preprocessed text sentence sequence is input into the XLNet encoder, which learns the deep semantic representation of text through its self-attention mechanism and Transformer architecture;

[0162] The objective function of pre-training is to maximize the likelihood of the permutation language model:

[0163]

[0164] In formula (1), θ represents the model parameters, N is the sequence length, K is the predicted span size, and X ＜i and X ＞i Represent the target word x i The left and right context, P(X ＜i ,X ＞i ) is the permutation probability of the context.

[0165] 202. The preprocessed text sentence sequence is input into the XLNet encoder. The XLNet encoder learns the deep semantic representation of the text through the Transformer architecture embedded with the self-attention mechanism.

[0166] The XLNet encoder introduces relative position encoding in the self-attention mechanism to capture the sequential relationship between words and fine-tune the parameters of the XLNet encoder; given a sentence, XLNet outputs the probability that each word belongs to each entity category. The goal of fine-tuning is to minimize the loss function, using cross entropy loss:

[0167]

[0168] In formula (2), y i,j is an indicator variable, j is the jth label; if word x i Belongs to the tag t j, then it is 1, otherwise it is 0; p θ (t j |x 1:i ,x i+1:N ) is the model prediction for word x i Belongs to the tag t j probability.

[0169] The output of XLNet is first fed into a bidirectional long short-term memory network (BiLSTM). The BiLSTM layer is used to further capture sequence features in the text, especially those patterns related to time or order. BiLSTM consists of two LSTM units, one for the forward sequence and the other for the reverse sequence, thus capturing contextual information. The XLNet layer outputs the combined embedding feature E = {e1, e2, ..., e n}, where e i represents the combined features of the i-th word. The BiLSTM layer embeds the combination of words into the feature e i as input for training the model.

[0170] 203. A single-direction LSTM network can only use the contextual information learned from the text sequence. To this end, two LSTM networks in opposite directions are used to form a BiLSTM model to simultaneously capture the current moment x in the sequence. t Context information:

[0171]

[0172] The current output of the forward LSTM is The output of the reverse LSTM at this moment is Then and The result after splicing is recorded as the feature code learned based on the context information at the current moment in the sequence. T} As the output of the BiLSTM layer, it represents the feature encoding of the current threat intelligence sentence sequence.

[0173] 205. XLNet uses the self-attention mechanism to capture the relationship between each word and other words in a sentence. The result processed by BiLSTM is then input into the self-attention layer, namely the SA layer, which allows the model to dynamically focus on the part most relevant to the current task when processing sequence data. The output of the BiLSTM layer to the SA layer is H = {h1,h2,···,h T The importance of each element in the sequence is determined by calculating the attention score of each element to all other elements, and the score sequence O = {O1,O i ,...,O n}.

[0174] The self-attention mechanism can be expressed as:

[0175]

[0176] In formula (5), Q, K, and V are query, key, and value matrices respectively. k is the dimension of the key vector. Usually, in order to obtain rich features, the self-attention model needs to be expanded into a multi-head attention model, that is, the above scaled dot product attention calculation process is performed h times, the input is mapped to h different subspaces through the parameter matrix, the scaled dot product attention scores are calculated in turn, and the final results are concatenated as the final attention score. The specific calculation of the attention mechanism is:

[0177] Map feature encoding H to query matrix Q i , key matrix K i Sum value matrix V i , formally expressed as

[0178]

[0179] In formula (6), is the weight parameter matrix obtained from the corresponding training. Then the scaled dot product attention vector is calculated to obtain

[0180]

[0181] According to the idea of ​​multi-head attention, the above attention calculation process is performed in h different subspaces with trainable weight parameters, and all scaled dot product attention vectors are concatenated together to obtain U = {u1,u2,…,u h}. Finally, the matrix U is transformed to obtain the attention vector A = {a1, a1, …, a1}, which can be expressed as

[0182] A=(u1,u2,…,u h )·W o (8);

[0183] 206. The output score sequence O of the SA layer = {O1, O2, ..., O n} is passed to the CRF layer, and finally the CRF layer is used to model the dependencies between tags and adjust the output of the SA layer to better capture the sequence relationship between tags. Using CRF helps the model consider the dependencies between tags and improve the accuracy of entity boundaries. The CRF layer can be expressed as:

[0184]

[0185] In formula (9), Z(xi ) is the normalization factor, ψ(t i |x i ) is the feature function, which transforms word x i The feature map is mapped to the label t i The probability of logψ(t i |x i-1 ,t i-1 ) represents the label transfer feature.

[0186] The CRF layer calculates the label probability of the sequence using the following formula:

[0187]

[0188] In formula (10), P(T|O) is the probability of label sequence T under score sequence O after feature extraction, Z(O) is the normalization factor, and score(t i ,t i-1 ,O) is the label transfer score, which combines the label t i and t i-1 And the characteristics of the score sequence O. Finally, the optimal entity label sequence P = {P1, P2, P3, ..., P n}, where P i Indicates the entity tag type of the i-th word.

[0189] After entity recognition is completed, relationship extraction uses remote supervision technology, which only requires a small amount of labeled data to train the model. The present invention uses a model based on piecewise convolutional neural networks (PCNN), which regards remote supervision learning as a multi-instance learning problem, uses convolutional neural networks to automatically extract text features, and effectively learns through segmented pooling strategies.

[0190] The PCNN model first converts the input vocabulary into word vectors through the word embedding layer. Subsequently, the PCNN model generates position vectors based on the position of each word relative to the two entities. These position vectors are input into the convolution layer together with the word vectors to extract the key features of the text. Given that the traditional maximum pooling operation may ignore important features such as sentence length, PCNN adopts an innovative segmented pooling strategy to divide the sentence into three parts according to the position of the entity and pool each part separately. Finally, the prediction score of each relationship category is output through the softmax layer, and the relationship between entities is finally obtained.

[0191] When dealing with threat intelligence security entity relationship identification, PCNN uses a multi-instance learning framework to mitigate the impact of mislabeled data. In the multi-instance learning framework, each "bag" contains a set of entity pair samples that share the same relationship label in the knowledge graph, but the samples in the bag are independent of each other. During the training process, the model will learn multiple such "bags" and select the most representative samples from each "bag" for analysis. The selection and calculation methods are as follows:

[0192]

[0193] In formula (11), q i represents the number of samples in the i-th bag, y i is the label of the i-th bag data, represents the jth sample in the i-th bag of data; then, the label of the sample is regarded as the predicted label of this bag of data, and the cross entropy loss is calculated:

[0194]

[0195] In formula (12), M represents the number of bags, y i is the label of the i-th bag data, is the most representative sample selected from the i-th bag of data.

[0196] S3, taking entities as nodes in the graph and the relationships between entities as edges to construct a knowledge graph;

[0197] Specifically, various entities, such as attackers, malware, IP addresses, domain names, etc., are identified through the entity tag sequence P obtained in S2, and they are classified into different entity types. Using PCNN relation extraction technology, the relationship between entities is identified from the text to form a triple (Subject, Relation, Object), such as (IP address, association, malware family). Triples are the basis for building knowledge graphs, which help organize and understand complex threat intelligence data.

[0198] Design the architecture of the knowledge graph, that is, ontology construction, define entity types, attributes, and relationship types, and then based on the conceptual model of the threat intelligence field, the UCO ontology model, that is, the unified network ontology model and the STIX (Structured Threat Information Expression) standard, select a suitable graph database (such as Neo4j) to store the knowledge graph data, that is, build a good knowledge graph.

[0199] The specific program implementation is as follows: "The attacker used the IP address 192.168.1.1 to attack. The attacker also used the domain example.com and the MD5 hash value d41d8cd98f00b204e9800998ecf8427e."

[0200] After being processed by the XLNet-BiLSTM-SA-CRF model, the following entity recognition results are obtained:

[0201] IP address: 192.168.1.1;

[0202] Domain name: example.com;

[0203] MD5 hash: d41d8cd98f00b204e9800998ecf8427e

[0204] These entities can be used as nodes in the knowledge graph. The relationships between entities, such as the association between "attacker" and these entities, can be used as edges in the knowledge graph. When constructing the knowledge graph, the following triples are constructed:

[0205] (Attacker,uses,192.168.1.1);

[0206] (attacker,exploits,example.com);

[0207] (attacker,association,d41d8cd98f00b204e9800998ecf8427e);

[0208] The present invention constructs the conceptual level of threat intelligence knowledge graph, referring to the unified network ontology (UCO) model and structured threat information expression (STIX) standard. The UCO ontology model provides a framework for the standardized representation of information in the field of network security, namely ontology construction, covering entity types, attributes and their interrelationships.

[0209] STIX is a standardized language for describing cybersecurity threat information. It aims to provide a structured approach to represent and share information about cyber threats, attack patterns, malicious actors, vulnerabilities, incidents, and other cybersecurity-related information. It is also the most widely used standard in the field of threat intelligence. The use of the two standards ensures that data from different sources and in different formats can be represented in a unified way within the knowledge graph, thereby facilitating the integration, analysis, and sharing of data.

[0210] Key categories are selected based on the UCO ontology model and the STIX standard, and are used as guidelines for annotation in the process of building the dataset. These categories include, but are not limited to, entity identification, attribute classification, and definition of relationships between entities. Through the application of these guidelines, systematic annotation of unstructured data is achieved, and a structured and queryable knowledge graph is constructed, providing a solid foundation for in-depth mining of network security analysis and threat intelligence.

[0211] The present invention screens and defines 9 entities and 5 relationships, and uses them to guide data annotation work. It is proposed that the threat intelligence ontology includes 9 types of threat entities, namely attackers, malware, technology, tools, vulnerabilities, locations, industries, fields, and IP. In addition, there are 5 relationships between entities, namely attack, use, originate from, similar, and same.

[0212] Example 2

[0213] This embodiment provides a system for implementing a knowledge graph construction method for threat intelligence processing, the system comprising:

[0214] at least one processor; and

[0215] A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute the knowledge graph construction method for threat intelligence processing as described above.

[0216] In this embodiment, electronic devices include but are not limited to: personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile computing devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable computing devices, consumer electronic devices, etc.

[0217] Example 3

[0218] This embodiment also provides a computer-readable storage medium storing executable instructions, which, when executed, enable the machine to execute the knowledge graph construction method for threat intelligence processing as described above.

[0219] Specifically, a system or device equipped with a readable storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer or processor of the system or device can read and execute instructions stored in the readable storage medium.

[0220] In this case, the program code itself read from the machine-readable medium can realize the function of any one of the above embodiments, and thus the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of this specification.

[0221] Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer or a cloud via a communication network.

[0222] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0223] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0224] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0225] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0226] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solution of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the claims of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A knowledge graph construction method for threat intelligence processing, characterized in that: The method comprises: S1. Obtain the threat intelligence text data to be analyzed and extract the required structured data, including: S11. Use a distributed crawler architecture to collect data, and deduplicate and filter the crawled content; S12, performing data preprocessing to extract required structured data; S13, perform data standardization, map the pre-processed data into the STIX format, and transmit the data through the TAXII protocol to obtain the threat intelligence text data to be analyzed; S2. Performing knowledge extraction on the threat intelligence text data to be analyzed to obtain entity relationship recognition results in the text, wherein the knowledge extraction includes entity recognition and relationship extraction; S3. Build a knowledge graph by taking entities as nodes in the graph and the relationships between entities as edges.

2. According to claim 1, a knowledge graph construction method for threat intelligence processing is characterized in that: The data categories of the threat intelligence text data to be analyzed include structured data, semi-structured data and unstructured data, and the data preprocessing includes: For structured data, follow the standardized threat intelligence format or have the ability to generate STIX format content, and use data cleaning technology to remove HTML templates and other non-content elements to extract the required structured data; For semi-structured data, first remove the template from the web page and retain the article content. Then, use regular expressions, natural language processing algorithms, or manual positioning techniques to accurately extract the structured data required to comply with the STIX standardized format. For unstructured data, perform word segmentation, remove stop words and part-of-speech tagging operations, and obtain the required structured data after in-depth mining, analysis, filtering and classification.

3. According to claim 2, a knowledge graph construction method for threat intelligence processing is characterized in that: The entity recognition includes entity recognition of structured, semi-structured and unstructured data; Structured and semi-structured data are subject to entity recognition through preset programs; Unstructured data is processed through deep learning methods, and entity recognition is performed based on the XLNet-BiLSTM-SA-CRF model with a four-layer architecture, including:

201. Segment the threat intelligence text data into sentences to obtain a text sentence sequence X = {x1, x2, ..., x n }, where x i is the i-th word in sentence X; 202. The text sentence sequence is input into the XLNet encoder, which learns the deep semantic representation of the text through the Transformer architecture embedded with the self-attention mechanism; The XLNet encoder introduces relative position encoding in the self-attention mechanism to capture the order relationship between words and fine-tune the parameters of the XLNet encoder. Finally, the XLNet encoder outputs the probability sequence of each word belonging to each entity category, that is, the combined embedding feature E = {e1, e2, ..., e n }; 203. Use the BiLSTM layer to capture the sequence characteristics of the combined embedding features of the output words. The BiLSTM layer embeds the combined embedding features of any word e i As input for training models; 204. The BiLSTM model is composed of two LSTM networks in opposite directions, capturing the current moment x in the sequence at the same time t The context information of the forward LSTM at this moment is The output of the reverse LSTM at this moment is Then and The result after splicing Denote as the feature encoding learned based on the context information at the current moment in the sequence; H={h1,h2,…,h T } As the output of the BiLSTM layer, it represents the feature encoding of the current threat intelligence sentence sequence; 205. The result processed by BiLSTM is input into the self-attention layer, i.e., the SA layer. The output of the BiLSTM layer to the SA layer is H = {h1, h2, ..., h T The importance of each element in the sequence is determined by calculating the attention score of each element to all other elements, and the score sequence O = {O1, O2, ..., O n }; 206. The CRF layer optimizes the label sequence based on the score sequence, models the dependency between labels, and finally obtains the optimal entity label sequence P = {P1, P2, P3, ..., P n }.

4. The method for constructing a knowledge graph for threat intelligence processing according to claim 3 is characterized in that: Before inputting the preprocessed text sentence sequence into the XLNet encoder, the XLNet encoder is also pre-trained: Each word in the threat intelligence text data is converted into an index in the vocabulary, and the annotation is converted into an index in the label index; then, the index sequence of text and label is converted into the input of the XLNet encoder. XLNet is used as the encoder and pre-trained on a large-scale threat intelligence text database to learn a general representation of threats.

5. A method for constructing a knowledge graph for threat intelligence processing according to claim 3 or 4, characterized in that: The S3 specifically includes: Identify various entities through the entity tag sequence P obtained in S2 and classify them into different entity types. Use PCNN relation extraction technology to identify the relationship between entities from the text to form triples. Design the architecture of the knowledge graph, define entity types, attributes, and relationship types, and then based on the conceptual model of the threat intelligence field, the UCO ontology model, and the STIX standard, input triples and select a graph database to store the knowledge graph data to build a knowledge graph.

6. A knowledge graph construction method for threat intelligence processing according to claim 2, characterized in that: When acquiring the threat intelligence text data to be analyzed, the CybOX standard is used to describe the network security events, including the type, source, target, and impact of the events.

7. The method for constructing a knowledge graph for threat intelligence processing according to claim 2, characterized in that: Unstructured data is filtered by identifying IOCs, filtering out threat-irrelevant data and identifying it as APT, malicious code, or other through classification algorithms.

8. A knowledge graph construction system for threat intelligence processing, characterized in that: The system comprises: processor; a memory having stored thereon a computer program executable on the processor; Wherein, when the computer program is executed by the processor, the steps of a method for constructing a knowledge graph for threat intelligence processing as described in any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images