A threat intelligence triplet extraction method and system based on dual-pointer architecture

Abstract

The present invention proposes a threat intelligence triple extraction method and system based on a dual-pointer architecture. The BERT model is used as an encoder to analyze threat intelligence text, that is, three independent weight matrices are used to generate context-aware vectors for the head entity, tail entity, and relationship, respectively. The context-aware vectors of the head entity and tail entity are respectively identified based on the dual-pointer architecture, and candidate entity pairs are generated. The candidate entity pairs and the context-aware vectors of the relationship are concatenated to generate a relationship entity vector. The relationship entity vectors are screened using a scoring module. The screened relationship entity vectors are input into the Softmax layer for relationship classification to generate the identification results of the threat intelligence triples. The present invention can effectively avoid mutual interference between entities, thereby ensuring that the generated threat entity triples are more accurate, accurately revealing the different links in the attack chain and the relationships between them, and providing security experts with a more comprehensive and in-depth threat intelligence analysis.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a threat intelligence triplet extraction method and system based on a dual-pointer architecture. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of cyberattack technologies, traditional security defenses face unprecedented challenges. This is especially true when faced with complex attack vectors, such as advanced persistent threats (APTs) and zero-day attacks. Traditional defense systems are often unable to effectively identify and respond to these highly covert and persistent attacks. Therefore, threat intelligence (CTI) has become an indispensable component of cybersecurity, providing detailed intelligence about cyberattacks and helping security teams prevent potential threats in real time.

[0004] Threat intelligence not only includes basic indicators of compromise (IOCs) like malicious IP addresses, domain names, and file hashes, but also encompasses more comprehensive information, including attacker activity patterns, attack tools, attack sources, and attack targets. Unlike traditional vulnerability databases like CVE, CTI provides more dynamic and timely reports that detail the entire attack process, attack chain, and impact, providing organizations with early warnings and helping them respond to new and complex cyber threats. CTI reports are typically generated by security experts through analysis of attack activity and published in the form of technical documentation, reports, or news articles.

[0005] However, as cybersecurity threats continue to escalate, the volume and complexity of CTI have exploded, placing enormous pressure on manual analysis and processing. Existing CTI extraction methods often rely on rule matching or regular expressions to extract key indicators. While these methods are effective in some cases, they lack context and semantic understanding, and can easily overlook potential threat information. Furthermore, existing methods inadequately handle the specialized terminology and complex context of threat intelligence, resulting in low accuracy in extracting and classifying information.

[0006] In recent years, deep learning technology has been widely used in automated threat intelligence analysis, particularly through natural language processing (NLP) methods for processing unstructured text data. These methods can automatically extract potential threat information from CTI reports, including attack sources, targets, and attack patterns. However, existing deep learning frameworks still have shortcomings, primarily in their understanding of the complex semantics, attack chains, and contextual dependencies in threat intelligence. As a result, existing technologies struggle to effectively address specific cybersecurity challenges, failing to provide security experts with comprehensive and accurate threat intelligence analysis, and ultimately failing to help security teams respond more quickly and accurately to complex attacks. Summary of the Invention

[0007] To overcome the shortcomings of the above-mentioned existing technologies, the present invention provides a threat intelligence triple extraction method and system based on a dual-pointer architecture, which can effectively avoid mutual interference between entities, thereby ensuring that the generated threat entity triples are more accurate, accurately revealing the different links in the attack chain and the relationship between them, and providing security experts with more comprehensive and in-depth threat intelligence analysis.

[0008] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0009] A first aspect of the present invention provides a threat intelligence triple extraction method based on a dual-pointer architecture.

[0010] A threat intelligence triplet extraction method based on a dual-pointer architecture includes:

[0011] Get the text of threat intelligence;

[0012] The resulting text is analyzed using the BERT model as an encoder, which uses three independent weight matrices to generate context-aware vectors for the head entity, tail entity, and relation, respectively.

[0013] Based on the dual-pointer architecture, the context-aware vectors of the head entity and the tail entity are respectively identified, and candidate entity pairs are generated; the candidate entity pairs are concatenated with the context-aware vector of the relationship to generate a relationship entity vector;

[0014] The scoring module is used to filter the relationship entity vectors; the filtered relationship entity vectors are input into the Softmax layer for relationship classification to generate the identification results of threat intelligence triples.

[0015] Furthermore, the dual-pointer architecture includes a head entity recognition module and a tail entity recognition module, and the head entity recognition module and the tail entity recognition module have the same network architecture.

[0016] Furthermore, the head entity recognition module is used to identify the context-aware vector of the head entity, decode it after capturing the context information of the head entity, and finally output the head entity set; the tail entity recognition module is used to identify the context-aware vector of the tail entity, decode it after capturing the context information of the tail entity, and finally output the tail entity set.

[0017] Furthermore, each entity in the head entity set and the tail entity set is concatenated two by two to generate candidate entity pairs.

[0018] Furthermore, a scoring module is used to screen the relational entity vectors. The scoring module is implemented based on a two-layer multi-layer perceptron. Specifically, the concatenated multiple relational entity vectors are input into the two-layer multi-layer perceptron. The two-layer multi-layer perceptron scores each entity pair in the multiple relational entity vectors, and screens the relational entity vectors based on the scoring results.

[0019] Furthermore, a scoring threshold is set, and the scores given by the double-layer multi-layer perceptron to each relationship entity vector are compared with the set scoring threshold. Entity pairs with lower scores are discarded, and only entity pairs with scores higher than the set scoring threshold are retained.

[0020] Furthermore, the Softmax layer selects the optimal relationship in the filtered relationship entity vector according to the calculated output probability value, and finally generates a threat intelligence triple containing a head entity, a tail entity and a relationship.

[0021] A second aspect of the present invention provides a threat intelligence triplet extraction system based on a dual-pointer architecture.

[0022] A threat intelligence triplet extraction system based on a dual-pointer architecture, comprising:

[0023] The BERT model encoding module is configured to: obtain threat intelligence text; analyze the obtained text using the BERT model as an encoder, namely, using three independent weight matrices to generate context-aware vectors for the head entity, tail entity, and relationship;

[0024] The dual-pointer architecture module is configured to: identify the context-aware vectors of the head entity and the tail entity based on the dual-pointer architecture, and generate candidate entity pairs; and concatenate the candidate entity pairs with the context-aware vector of the relationship to generate a relationship entity vector;

[0025] The scoring module is configured to: filter the relation entity vectors using the scoring module;

[0026] The relationship classification module is configured to input the filtered relationship entity vector into the Softmax layer for relationship classification to generate the recognition result of the threat intelligence triple.

[0027] A third aspect of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps in a threat intelligence triple extraction method based on a dual-pointer architecture as described in the first aspect of the present invention.

[0028] The fourth aspect of the present invention provides an electronic device, including a memory, a processor, and a program stored in the memory and runnable on the processor. When the processor executes the program, it implements the steps in the threat intelligence triple extraction method based on a dual-pointer architecture as described in the first aspect of the present invention.

[0029] One or more of the above technical solutions have the following beneficial effects:

[0030] The present invention identifies the context-aware vectors of the head entity and the tail entity respectively based on a dual-pointer architecture, and generates candidate entity pairs; the candidate entity pairs and the context-aware vectors of the relationships are spliced ​​to generate relationship entity vectors. The present invention uses an innovative dual-pointer architecture to independently identify the head entity and the tail entity, effectively avoiding the influence of mutual interference between entities and improving the accuracy and stability of entity recognition; in addition, the model generates relationship entity vectors and splices the vectors of the head and tail entity pairs with the relationship representation to accurately capture the complex relationships between entities. This process not only enhances the model's ability to understand the context, but also better models the multi-level relationships in the attack chain, effectively improving the significant deficiencies of the deep learning framework in the existing technology in threat intelligence analysis, especially in the understanding of complex semantics, attack chains and context dependencies; at the same time, it also avoids the problem that traditional models are difficult to accurately capture the multi-level and multi-dimensional entity relationships in threat intelligence in the field of network security, resulting in the inability to provide accurate analysis results for security experts.

[0031] The present invention utilizes a scoring module to screen relational entity vectors; the screened relational entity vectors are input into the Softmax layer for relational classification to generate identification results for threat intelligence triples. By adopting a scoring mechanism and a preset threshold, the present invention can accurately screen out high-quality candidate entity pairs and discard low-quality invalid entity pairs, thereby reducing the computational burden and improving efficiency. Through this screening method, the model can focus on processing high-quality entity pairs, avoiding the interference of invalid data on the final results; at the same time, this method also ensures that the generated threat entity triples are more accurate, can accurately reveal the different links in the attack chain and the relationships between them, and provide security experts with more comprehensive and in-depth threat intelligence analysis.

[0032] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0034] Figure 1 This is a flowchart of a threat intelligence triple extraction method based on a dual-pointer architecture in Example 1 of the present invention.

[0035] Figure 2 This is a structural diagram of a threat intelligence triplet extraction system based on a dual-pointer architecture in Example 2 of the present invention. DETAILED DESCRIPTION

[0036] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0037] It should be noted that the terms used herein are for describing particular embodiments only and are not intended to limit the exemplary embodiments according to the present invention.

[0038] In the absence of conflict, the embodiments of the present invention and the features thereof may be combined with each other.

[0039] The overall idea proposed by the present invention is as follows: The present invention provides a threat intelligence triple extraction method based on a dual-pointer architecture. The method uses the BERT model as an encoder. First, three context-aware vectors are generated through three independent weight matrices, which respectively represent the semantic information of the head entity, the tail entity, and the relationship. Subsequently, the semantic information of the head entity, the tail entity, and the relationship is placed in the entity recognition unit. The unit adopts a dual-pointer network architecture and includes two identical entity recognition modules, which are used to identify the head entity and the tail entity respectively. The head entity recognition module decodes the semantic information of the head entity and processes it through the Multi-Head Self Attention layer, the Multi-Head Cross-Attention layer, and the Feed Forward Network layer. These layers help the model capture the contextual information of the head entity and finally output a set of candidate head entities. The processing process of the tail entity recognition module is the same as that of the head entity module (parameters are independent). The tail entity semantic information is decoded and, after the same three-layer structure processing, a set of candidate tail entities is generated. Next, the model concatenates each entity in the head and tail entity sets, generating multiple entity pairs. For each pair, the model concatenates the vectors of the head and tail entity pairs with the relationship representation to form a relational entity vector containing the head entity, tail entity, and relationship information. This concatenated vector is then fed into a two-layer multi-layer perceptron (MLP) for scoring. The MLP scores each entity pair and, based on the scoring results, discards pairs with lower scores, retaining only pairs with scores above a set threshold. After scoring and screening, the retained pairs are fed into the Softmax layer for relationship identification. The Softmax layer selects the optimal relationship based on the output probability values ​​and generates the final triplet (head entity, relationship, tail entity).

[0040] Example 1

[0041] This embodiment discloses a threat intelligence triple extraction method based on a dual-pointer architecture.

[0042] like Figure 1 As shown in FIG, a threat intelligence triple extraction method based on a dual-pointer architecture includes:

[0043] Step S1: Obtain threat intelligence text; use the BERT model as an encoder to analyze the obtained text, that is, use three independent weight matrices to generate context-aware vectors for the head entity, tail entity, and relationship respectively;

[0044] Step S2: identifying the context-aware vectors of the head entity and the tail entity based on the dual-pointer architecture, and generating candidate entity pairs; concatenating the candidate entity pairs with the context-aware vector of the relationship to generate a relationship entity vector;

[0045] Step S3: Use the scoring module to screen the relationship entity vectors;

[0046] Step S4: Input the filtered relationship entity vector into the Softmax layer for relationship classification to generate the recognition result of the threat intelligence triple.

[0047] Based on the above process, the present invention can effectively avoid mutual interference between entities, thereby ensuring that the generated threat entity triples are more accurate, accurately revealing the different links in the attack chain and the relationships between them, and providing security experts with more comprehensive and in-depth threat intelligence analysis. To facilitate understanding of the technical solution of the present invention, the specific implementation steps of the technical solution of the present invention are further explained and illustrated below.

[0048] Step S1: Obtain the text of threat intelligence; use the BERT model as an encoder to analyze the obtained text, that is, use three independent weight matrices to generate context-aware vectors for the head entity, tail entity, and relationship respectively.

[0049] Use the BERT model as the encoder and generate the head entity through an independent weight matrix , tail entity and relationships Context-aware vectors can accurately capture the semantic information of different entities and relationships to improve the accuracy of entity and relationship extraction. This method enhances the model's contextual understanding by optimizing the representation of each element separately and can better model the complex interactions between entities. This process involves the following key steps and formulas:

[0050] First, define the input text of threat intelligence for ;in, For text Middle words, is the length of the sentence. Enter text It is fed into the BERT model for embedding processing, and three context-aware vectors are generated through three independent weight matrices, namely:

[0051] ;

[0052] ;

[0053] ;

[0054] in, 、 and is the weight matrix of different vectors, which is used to map the context-aware vectors of head entity, tail entity and relation respectively; 、 and is the vector representation of the corresponding vector, 、 、 For words The vector embedding of 、 、 ; 、 and are the embedding dimension representations of the head entity, tail entity, and relation vector respectively; Indicates a dimensional vector space, Indicates a dimensional matrix, Represents the embedding dimension representation of the vector.

[0055] Step S2: Based on the dual-pointer architecture, the context-aware vectors of the head entity and the tail entity are respectively identified, and candidate entity pairs are generated; the candidate entity pairs and the context-aware vector of the relationship are concatenated to generate a relationship entity vector.

[0056] By employing a dual-pointer architecture to independently identify head and tail entities and concatenating the relationship representation with the head and tail entity pair vectors, this fusion allows for accurate modeling of complex relationships and interactions between entities. By independently optimizing the representations of head and tail entities and effectively integrating relationship information, this approach improves the accuracy of entity and relationship extraction, enhancing the model's understanding of context and its ability to capture complex dependencies between entities.

[0057] The dual-pointer architecture consists of two modules: a head entity recognition module and a tail entity recognition module. Both modules share the same network architecture. The head entity recognition module identifies the context-aware vector of the head entity, decodes it after capturing its contextual information, and ultimately outputs a set of head entities. The tail entity recognition module identifies the context-aware vector of the tail entity, decodes it after capturing its contextual information, and ultimately outputs a set of tail entities. The processing flow of each module in the dual-pointer architecture consists of three main layers: a multi-head self-attention layer, a multi-head cross-attention layer, and a feed forward network layer.

[0058] Take the context-aware vector for head entity recognition as an example: First, the context representation of the input is processed through the Multi-Head Self-Attention layer , to capture the self-attention relationship between words in a sentence, namely:

[0059] ;

[0060] ;

[0061] ;

[0062] in, represents the contextual representation of the input head entity, weight matrices representing the query, key, and value of the head entity, respectively; The query vector representing the head entity, a key vector representing the head entity, The value vector representing the head entity. Subsequently, the calculated attention score is normalized by the Softmax function to obtain the weighted representation of each word, namely:

[0063] ;

[0064] in, is the output of the head entity self-attention layer, is the dimension of the key vector, Represents a vector Next, the Multi-Head Cross-Attention layer is used to interactively model the representation of the head entity and the context of the tail entity, capturing the dependency between them. The specific formula is as follows:

[0065] ;

[0066] ;

[0067] ;

[0068] in, is the context representation matrix of the tail entity, are the weight matrices for query, key, and value across the attention layer, respectively; represents the query vector of the head entity across the attention layers, represents the key vector of the tail entity across the attention layer, Represents the value vector of the tail entity in the cross-attention layer. Through this cross-attention mechanism, the model is able to capture the interactive relationship between the head entity and the tail entity. After the cross-attention layer, the model performs a nonlinear transformation through the Feed Forward Network (FFN) layer to obtain the final head entity representation, namely:

[0069] ;

[0070] in, is the weight matrix of FFN, Used to transform input features to hidden layer features, Used for transformation from hidden layer features to output features; is the bias term, is the activation function, is the head entity representation after FFN processing. The final output is the set representation of the head entity , Indicates the first entity in the head entity collection A head entity.

[0071] The recognition process of the tail entity is similar to that of the head entity, and is also processed through the Multi-Head Self-Attention layer, Multi-Head Cross-Attention layer and Feed Forward Network layer (but it is based on the tail entity recognition module).

[0072] First, the contextual representation of the input tail entity is processed through the Multi-Head Self-Attention layer , to capture the self-attention relationship between words in a sentence, namely:

[0073] ;

[0074] ;

[0075] ;

[0076] in, represents the contextual representation of the input tail entity, The weight matrices representing the query, key, and value of the tail entity respectively; The query vector representing the tail entity, represents the key vector of the tail entity, The calculated attention score is normalized by the Softmax function to obtain the weighted representation of each word, that is:

[0077] ;

[0078] in, is the output of the tail entity self-attention layer, is the dimension of the key vector, is a vector Next, the Multi-Head Cross-Attention layer is used to model the interaction between the tail entity representation and the head entity context, capturing the dependency between them. The specific formula is as follows:

[0079] ;

[0080] ;

[0081] ;

[0082] in, is the context representation matrix of the tail entity, are the weight matrices for query, key, and value across the attention layer, respectively; represents the query vector of the tail entity across the attention layers, represents the key vector of the head entity across the attention layer, Represents the value vector of the head entity in the cross-attention layer. Through this cross-attention mechanism, the model is able to capture the interactive relationship between the tail entity and the head entity. After the cross-attention layer, the model performs a nonlinear transformation through the Feed Forward Network (FFN) layer to obtain the final tail entity representation, namely:

[0083] ;

[0084] in, is the weight matrix of FFN, Used to transform input features to hidden layer features, Used for transformation from hidden layer features to output features; is the bias term, is the activation function, is the tail entity representation after FFN processing. The final output is the set representation of the tail entity , Indicates the first entity in the tail entity set A tail entity.

[0085] Furthermore, each entity in the head entity set and the tail entity set is concatenated to generate candidate entity pairs. Specifically, in the head entity set and tail entity collection In the model, all possible entity pairs Perform pairwise combinations to generate multiple candidate entity pairs, where each entity pair can be regarded as a potential relation instance, namely:

[0086] ;

[0087] in, Represents the set of all possible candidate entity pairs. For each pair of entities , the model represents them and the relationship Perform splicing to generate a relation entity vector containing entity and relationship information, namely:

[0088] ;

[0089] in, Represents the concatenated relation entity vector, Is the head entity and tail entity Entity pairs; It is a relation representation, which contains the semantic relationship between the head entity and the tail entity.

[0090] Step S3: Use the scoring module to screen the relationship entity vectors.

[0091] The scoring module is used to screen the relational entity vectors. The scoring module is based on a two-layer multi-layer perceptron and can screen the relational entity vectors containing entity and relationship information. Scoring is performed to screen out high-quality relational entity vectors. The concatenated multiple relational entity vectors are input into a double-layer multi-layer perceptron. The double-layer multi-layer perceptron scores each entity pair in the multiple relational entity vectors and screens the relational entity vectors based on the scoring results. Specifically, the relational entity vectors are input After the first layer of full connection (linear transformation) and activation function, an intermediate representation is obtained ,Right now:

[0092] ;

[0093] in, is a weight matrix responsible for projecting the input relation entity vector into the hidden layer space, and ; is the dimension of the input relation entity vector, is the dimension of the hidden layer, is the bias term, is the activation function.

[0094] The second layer converts the output of the hidden layer Further transformed into a score value , that is, the score of each candidate entity pair, namely:

[0095] ;

[0096] in, is the weight matrix of the second layer, is the dimension of the hidden layer, 1 means the output is a scalar (score value), is the bias term. Indicates the quality or validity of a candidate entity pair.

[0097] The candidate relationship entity vectors are screened according to the preset threshold: a scoring threshold is set, and the scores given by the two-layer multi-layer perceptron to each relationship entity vector are compared with the set scoring threshold. Entity pairs with lower scores are discarded, and only entity pairs with scores higher than the set scoring threshold are retained to generate the final set of relationship entity vectors, that is:

[0098] ;

[0099] in, Represents the final filtered relationship entity vector set. Is the head entity and tail entity The relationship entity vector. is a preset scoring threshold, and relation entity vectors with scores below this threshold will be discarded.

[0100] Step S4: Input the filtered relationship entity vector into the Softmax layer for relationship classification to generate the recognition result of the threat intelligence triple.

[0101] The Softmax layer selects the optimal relationship (i.e. the most likely relationship) in the filtered relationship entity vector based on the calculated output probability value, and finally generates a threat intelligence triple containing the head entity, tail entity and relationship. Specifically, the purpose of relationship classification is to classify the relationship entity vector of each candidate entity pair according to the relationship entity vector of the candidate entity pair. , predict the type of relationship between them. The Softmax layer outputs the probability distribution of each entity pair belonging to different relationship categories. Given each relationship entity vector , the Softmax layer will calculate the corresponding relationship category probability, namely:

[0102] ;

[0103] in, is the input filtered relation entity vector, which contains entity pairs Information, is the weight matrix of the Softmax layer, where is the number of relation categories, is the bias term of the Softmax layer, is the output probability after Softmax activation, indicating the candidate entity pair The probability of belonging to each relation category.

[0104] According to the probability distribution of the Softmax layer output , each entity can be The corresponding predicted relationship category Combined, the threat entity triple is finally generated Specifically, the triple generation formula is as follows:

[0105] ;

[0106] in, Represents entity pairs The predicted relationship category between is the relationship type corresponding to the maximum value in the output probability of the Softmax layer.

[0107] Example 2

[0108] This embodiment discloses a threat intelligence triplet extraction system based on a dual-pointer architecture.

[0109] like Figure 2 As shown, a threat intelligence triplet extraction system based on a dual-pointer architecture includes:

[0110] The BERT model encoding module is configured to: obtain threat intelligence text; analyze the obtained text using the BERT model as an encoder, that is, use three independent weight matrices to generate context-aware vectors for the head entity, tail entity, and relationship respectively; wherein the three independent weight matrices are implemented through three independent transformation layers, namely Figure 2 The head entity linear transformation layer, the tail entity linear transformation layer and the relationship linear transformation layer are shown in .

[0111] The dual-pointer architecture module is configured to: identify the context-aware vectors of the head entity and the tail entity based on the dual-pointer architecture, and generate candidate entity pairs; and concatenate the candidate entity pairs with the context-aware vector of the relationship to generate a relationship entity vector;

[0112] The scoring module is configured to: filter the relation entity vectors using the scoring module;

[0113] The relationship classification module is configured to input the filtered relationship entity vector into the Softmax layer for relationship classification to generate the recognition result of the threat intelligence triple.

[0114] Example 3

[0115] The purpose of this embodiment is to provide a computer-readable storage medium.

[0116] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a threat intelligence triple extraction method based on a dual-pointer architecture as described in the first embodiment of the present disclosure.

[0117] Example 4

[0118] The purpose of this embodiment is to provide an electronic device.

[0119] An electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps of a threat intelligence triple extraction method based on a dual-pointer architecture as described in the first embodiment of the present disclosure are implemented.

[0120] The steps involved in the apparatuses of Examples 2, 3, and 4 above correspond to those of Method Example 1. For detailed implementations, please refer to the relevant description of Example 1. The term "computer-readable storage medium" should be understood to mean a single medium or multiple media containing one or more instruction sets; it should also be understood to include any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and causing the processor to perform any method of the present invention.

[0121] Those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using a general-purpose computer device. Alternatively, they can be implemented using program code executable by a computing device, and thus stored in a storage device and executed by the computing device. Alternatively, they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0122] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.

Claims

1. A threat intelligence triplet extraction method based on a dual-pointer architecture, characterized in that: include: Get the text of threat intelligence; The BERT model is used as an encoder to analyze the obtained text and use three independent weight matrices to generate context-aware vectors for the head entity, tail entity, and relationship respectively; Based on the dual-pointer architecture, the context-aware vectors of the head entity and the tail entity are respectively identified, and candidate entity pairs are generated; the candidate entity pairs are concatenated with the context-aware vector of the relationship to generate a relationship entity vector; Use the scoring module to filter the relationship entity vectors; The filtered relationship entity vectors are input into the Softmax layer for relationship classification to generate the identification results of threat intelligence triples; The dual-pointer architecture includes a head entity recognition module and a tail entity recognition module, and the head entity recognition module and the tail entity recognition module have the same network architecture. The processing flow of each module of the dual-pointer architecture includes three main layers: Multi-Head Self-Attentionce layer, Multi-Head Cross-Attention layer and Feed Forward Network layer; Processing contextual representation of input through Multi-Head Self-Attention layer , to capture the self-attention relationship between words in a sentence: ； ； ； in, represents the contextual representation of the input head entity, weight matrices representing the query, key, and value of the head entity, respectively; The query vector representing the head entity, a key vector representing the head entity, A vector of values ​​representing the head entity; The calculated attention score is normalized by the Softmax function to obtain the weighted representation of each word: ； in, is the output of the head entity self-attention layer, is the dimension of the key vector, Represents a vector The transpose of ; the representation of the head entity is modeled interactively with the context of the tail entity through the Multi-Head Cross-Attention layer: ； ； ； in, is the context representation matrix of the tail entity, are the weight matrices for query, key, and value across the attention layer, respectively; represents the query vector of the head entity across the attention layers, represents the key vector of the tail entity across the attention layer, A vector of values ​​representing tail entities across attention layers; After the cross-attention layer, the model performs a nonlinear transformation through the Feed Forward Network layer to obtain the final head entity representation: ； in, is the weight matrix of FFN, Used to transform input features to hidden layer features, Used for transformation from hidden layer features to output features; is the bias term, is the activation function, is the head entity representation after FFN processing; the final output head entity set representation , Indicates the first entity in the head entity collection Individual entities; The recognition process of the tail entity processes the contextual representation of the input tail entity through the Multi-Head Self-Attention layer , to capture the self-attention relationship between words in a sentence: ； ； ； in, represents the contextual representation of the tail entity of the input, The weight matrices representing the query, key, and value of the tail entity respectively; The query vector representing the tail entity, represents the key vector of the tail entity, The value vector representing the tail entity; the calculated attention score is normalized by the Softmax function to obtain the weighted representation of each word: ； in, is the output of the tail entity self-attention layer, is the dimension of the key vector, is a vector The transpose of ; the representation of the tail entity is modeled interactively with the context of the head entity through the Multi-Head Cross-Attention layer: ； ； ； in, is the context representation matrix of the tail entity, are the weight matrices for query, key, and value across the attention layer, respectively; represents the query vector of the tail entity across the attention layers, represents the key vector of the head entity across the attention layer, Represents the value vector of the head entity in the cross-attention layer; after the cross-attention layer, the model performs a nonlinear transformation through the FeedForward Network (FFN) layer to obtain the final tail entity representation: ； in, is the weight matrix of FFN, Used to transform input features to hidden layer features, Used for transformation from hidden layer features to output features; is the bias term, is the activation function, is the tail entity representation after FFN processing, and the final output is the set representation of the tail entity , Represents the first entity in the tail entity set A tail entity; Each entity in the head entity set and the tail entity set is concatenated pairwise to generate candidate entity pairs.

2. A threat intelligence triplet extraction method based on a dual-pointer architecture as claimed in claim 1, characterized in that: The relational entity vectors are screened using a scoring module, which is implemented based on a two-layer multi-layer perceptron. Specifically, the concatenated multiple relational entity vectors are input into the two-layer multi-layer perceptron, which scores each entity pair in the multiple relational entity vectors and screens the relational entity vectors based on the scoring results.

3. A threat intelligence triplet extraction method based on a dual-pointer architecture as claimed in claim 2, characterized in that: Set a scoring threshold, compare the score given by the double-layer multi-layer perceptron to each relationship entity vector with the set scoring threshold, discard entity pairs with lower scores, and only retain entity pairs with scores higher than the set scoring threshold.

4. The threat intelligence triple extraction method based on a dual-pointer architecture according to claim 1, characterized in that: The Softmax layer selects the optimal relationship in the filtered relationship entity vector according to the calculated output probability value, and finally generates a threat intelligence triple containing a head entity, a tail entity, and a relationship.

5. A threat intelligence triplet extraction system based on a dual-pointer architecture, adopting a threat intelligence triplet extraction method based on a dual-pointer architecture as described in any one of claims 1 to 4, characterized in that: include: The BERT model encoding module is configured to: obtain text for threat intelligence; The BERT model is used as an encoder to analyze the obtained text and use three independent weight matrices to generate context-aware vectors for the head entity, tail entity, and relationship respectively; The dual-pointer architecture module is configured to: identify the context-aware vectors of the head entity and the tail entity based on the dual-pointer architecture, and generate candidate entity pairs; and concatenate the candidate entity pairs with the context-aware vector of the relationship to generate a relationship entity vector; The scoring module is configured to: filter the relation entity vectors using the scoring module; The relationship classification module is configured to input the filtered relationship entity vector into the Softmax layer for relationship classification to generate the recognition result of the threat intelligence triple.

6. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the steps of the threat intelligence triple extraction method based on a dual-pointer architecture as described in any one of claims 1 to 4 are implemented.

7. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps in the threat intelligence triple extraction method based on a dual-pointer architecture as described in any one of claims 1-4 are implemented.

Images