A Method for Generating Attack Scenario Graphs (ASGs) for Network Threat Intelligence Analysis Based on Deep Learning and Natural Language Processing

Abstract

This invention discloses a method for generating Attack Scenario Graphs (ASGs) for network threat intelligence analysis based on deep learning and natural language processing. This method combines deep learning models with natural language processing techniques to improve the efficiency and accuracy of attack scenario graph generation. The steps include: collecting network threat intelligence and performing entity recognition using an improved BERT-BiLSTM-CRF model, combined with regular expressions to identify threat attack entities; using the CR-M-SpanBERT model for core referential parsing to capture semantic contextual dependencies between entities; using dependency parsing techniques to extract bidirectional contextual semantic dependencies of the text, and combining this with RoBERTa-BiGRU to generate embedding representations; finally, extracting triple information based on the BERT-RE model to generate the attack scenario graph. This invention improves the processing capability of complex network threat intelligence data, has strong robustness and adaptability, and is particularly suitable for multimodal threat intelligence.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, particularly to technologies related to network threat intelligence analysis. Specifically, it relates to an attack scenario graph (ASG) generation method based on deep learning and natural language processing, which aims to generate efficient and accurate attack scenario graphs using a variety of cutting-edge technologies to support network security protection and decision analysis. Background Technology

[0002] With the increasing prevalence of cyber threats, cyber threat intelligence analysis has become a crucial component of cybersecurity protection. Attack Scenario Graphs (ASGs), as a visual security analysis tool, are widely used in threat attribution and security response, helping analysts understand attack paths, vulnerability exploits, and attacker behavior. However, existing ASG generation methods primarily rely on simple rule matching and basic semantic analysis techniques, often lacking sufficient robustness and adaptability when faced with complex and multimodal cyber threat intelligence data.

[0003] Current technologies generally suffer from the following limitations: First, they cannot effectively handle threat data with high complexity and diversity, especially when encountering problems such as semantic ambiguity and unclear entity relationships, resulting in low accuracy and reliability of the system; second, traditional graph generation methods are inefficient, and performance bottlenecks in the computation process prevent them from being fully applied in actual network security protection; and third, most existing technologies rely on fixed rules, making it difficult to adapt to the ever-changing network threat landscape.

[0004] With the development of Natural Language Processing (NLP) and deep learning technologies, deep learning-based methods for network threat intelligence analysis have gradually emerged. Pre-trained deep learning models can more accurately extract entity relationships and semantic information from intelligence, thus providing new possibilities for attack scenario graph generation. Nevertheless, current technologies focused on attack scenario graph generation remain relatively scarce, and most employ outdated techniques that lag far behind the latest developments in the cybersecurity field. Therefore, there is an urgent need for an efficient attack scenario graph generation method that can integrate multiple contextual semantic relationships and combine modern deep learning and NLP technologies to improve the accuracy and response capabilities of threat intelligence analysis. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for generating Attack Scenario Graphs (ASGs) efficiently and accurately, especially when dealing with complex multimodal network threat data, thereby improving the efficiency and accuracy of the generation process.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] Data Acquisition and Preprocessing: Network threat intelligence information is collected and entity recognition is performed using a pre-trained deep learning model. This model is based on an improved BERT-BiLSTM-CRF structure and combines regular expressions to identify complex threat and attack entities. Regular expressions can quickly match and standardize specific patterns (such as time, IP address, hash value, etc.) in network threat intelligence, enhancing the accuracy and efficiency of entity recognition. Simultaneously, the context vectors generated by the BERT model improve the understanding of complex entities.

[0008] Entity Recognition and Labeling: By combining regular expressions with a deep learning model, a BIO label sequence is generated and input into the BERT-BiLSTM-CRF model for accurate entity recognition. This step ensures efficient capture of complex threat entities (such as dates, IP addresses, file hashes, etc.) and corrects unreasonable labels to ensure logical consistency of the labeling results.

[0009] Core referential parsing: Core referential parsing is performed using the CR-M-SpanBERT model to capture the semantic contextual dependencies between entities, further improving the accuracy of entity recognition results and providing accurate contextual information for subsequent dependency parsing and triple extraction.

[0010] Dependency parsing and semantic enhancement: Dependency parsing technology is used to extract bidirectional contextual semantic dependencies in the text, obtain five-tuple data such as subject, verb, and object related to threat entities, and combine them with RoBERTa-BiGRU to generate embedded representations, further enriching the semantic information of entity relationships and laying the foundation for the generation of attack scenario graphs.

[0011] Triple Extraction and Graph Generation: The BERT-RE model is used to extract triple information, and the graph generation module is combined to generate the final Attack Scenario Graph (ASG) based on the triples, transforming network threat intelligence into structured and visualized charts for analysts to conduct in-depth analysis.

[0012] This invention also discloses an attack scenario graph generation system based on network threat intelligence analysis, characterized by comprising:

[0013] (1) Data acquisition module: Obtain CTI reports from various organizations that provide CTI reports;

[0014] (2) Entity recognition module, which identifies entities in the collected data based on BERT-BiLSTM-CRF structure and regular expressions;

[0015] (3) Semantic parsing module, which performs core referential parsing and semantic relationship mining based on the CR-M-SpanBERT model;

[0016] (4) Dependency parsing module: extracts quintuple data and generates embedded representations;

[0017] (5) Graph generation module, which generates an attack scenario graph (ASG) based on the extracted triplet information;

[0018] (6) Visualization module, used to output and present attack scene diagrams.

[0019] This invention provides a method and system for efficiently and accurately generating Attack Scenario Graphs (ASGs). Compared with existing technologies, this invention abandons outdated rule matching and simple semantic analysis techniques, and adopts the latest deep learning model combined with natural language processing technology, which greatly improves the efficiency and accuracy of attack scenario graph generation. The specific beneficial effects are as follows: (1) By combining regular expressions with deep learning models, this invention effectively improves the efficiency and accuracy of attack scenario graph generation, solving the problems of inefficiency and low accuracy of existing methods when processing complex intelligence data. (2) By using the improved BERT-BiLSTM-CRF model, the accuracy and robustness of threat intelligence entity identification are significantly improved, solving the problem of insufficient entity identification accuracy in existing technologies. (3) The CR-M-SpanBERT model is used to achieve accurate capture of semantic context, improving the accuracy and relevance of entity relationships in attack scenario graphs. (4) By combining dependency parsing and embedding representation to generate attack scenario graphs, the efficiency and visualization effect of scenario graph generation are optimized, solving the problems of low efficiency and insufficient expressive power in traditional methods. (5) The application of this invention in network threat intelligence analysis improves the availability and reliability of network attack tracing and protection decisions. Attached Figure Description

[0020] Figure 1 This is an overall flowchart of the present invention;

[0021] Figure 2 A flowchart illustrating the process of collecting cyber threat intelligence information;

[0022] Figure 3 The flowchart refers to the core of the parsing process;

[0023] Figure 4 A flowchart of the dependency resolution process;

[0024] Figure 5 This is a flowchart of the triplet extraction process;

[0025] Figure 6 A flowchart of the process for generating an attack scenario graph. Detailed Implementation

[0026] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. It should be noted that the described embodiments are only some embodiments of the present invention, and not all embodiments are listed herein. Based on the embodiments of the present invention, other embodiments obtained by those skilled in the art without creative effort are all within the protection scope of the present invention.

[0027] according to Figure 1 As shown, this invention provides a method and system for efficiently and accurately generating Attack Scenario Graphs (ASGs). First, network threat intelligence information is collected, and entity recognition is performed on the data using a pre-trained deep learning model. This model is based on an improved BERT-BiLSTM-CRF structure and combines regular expressions to accurately identify threat attack entities. Next, core referential parsing is performed on the identified threat entities, and the CR-M-SpanBERT model is used to capture the semantic contextual dependencies between entities. Subsequently, dependency parsing techniques are used to extract bidirectional contextual semantic dependencies in the text, obtaining five-tuple data (subject, verb, object, etc.) related to the threat entities, and combining this with RoBERTa-BiGRU to generate embedding representations, enhancing semantic understanding capabilities. Next, the BERT-RE model is used to extract triplet information, preparing for the construction of the final network threat-related attack scenario graph (ASG). Finally, the attack scenario graph (ASG) is generated. Entity recognition, core reference parsing, dependency parsing, and triple extraction in this invention are key steps in generating attack scenario graphs. They can efficiently and accurately construct attack scenario graphs (ASGs) related to network threats, which is of great significance for improving network security protection capabilities.

[0028] according to Figure 2 As shown, the implementation process of the attack scenario graph generation method based on network threat intelligence analysis is further described in detail. First, the BERT-BiLSTM-CRF model is used for entity recognition of network threat intelligence. This model includes a BERT module, an LSTM module, and a CRF module. The BERT module uses pre-trained word vectors to generate contextual representations, the bidirectional LSTM module captures long-term and short-term dependencies in the context, and the CRF module performs sequence labeling for entity recognition. The specific steps are as follows:

[0029] S1.1, the data preprocessing stage, uses regular expressions to extract and standardize specific pattern entities in network threat intelligence. For example, entities such as time, IP address, and hash value are matched using regular expressions and labeled as corresponding categories (such as "DATE", "IP_ADDRESS", "HASH"). These standardized entities are replaced with a uniform format, and a BIO-formatted labeled sequence is generated as input to the deep learning model.

[0030] Example: Original text: "December 1, 2024, source IP address is 192.168.1.1";

[0031] After the BIO mark: "B-DATE I-DATE O B-IP_ADDRESS I-IP_ADDRESS O".

[0032] Table 1 Regular Expression Definitions

[0033] Entity type Regular expressions time `\d{4}-\d{2}-\d{2}` IP address `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` Hash value (MD5) `[a-f0-9]{32}` Hash value (SHA1) `[a-f0-9]{40}` e-mail `[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}` Registry path `HKLM\\[A-F0-9]{40}`

[0034] S1.2, initialize the BERT-BiLSTM-CRF model. The BERT module is pre-trained using a masked language model (MLM) to enhance the model's understanding of contextual semantics. Next, the logical relationships between events are learned through the next sentence prediction (NSP) task.

[0035] S1.3 uses the BERT model to generate contextual semantic representations of words in network threat intelligence, which are represented as high-dimensional vectors.

[0036] Specifically, for a given sequence of network threat intelligence text X = {x1, x2, ..., x...} n Randomly mask 15% of the words to generate a masking sequence X. mask The training objective is to maximize the number of masked words x. i The conditional probability is used to predict the masked words through contextual semantics, thereby enhancing the model's understanding of cybersecurity terminology.

[0037] P(x i |X mask = softmax(W) h ·h i +b h )

[0038] Next, the model is trained using the Next Sentence Prediction (NSP) task. The NSP task, given two sentences S1 and S2, predicts whether S2 is the logical successor to S1. Its loss function is:

[0039]

[0040] Among them, y i P indicates whether a sample is positive. i This is the output of the classifier in the BERT model. It enables the model to learn the logical relationships between events, such as attack paths and causal chains of threat events.

[0041] Finally, the pre-trained BERT model is used as a feature extractor to generate contextual semantic representations of words in network threat intelligence, which are represented as high-dimensional vectors.

[0042] S1.4 captures semantic information through a bidirectional LSTM module, including modeling time step dependencies, filtering features related to network threat intelligence, and enhancing the semantic representation of input information.

[0043] Specifically, the bidirectional LSTM module takes the context vector generated by the BERT model as input and processes each word in the sequence step by step. It models short-term and long-term semantic dependencies simultaneously through forward and backward propagation. The bidirectional LSTM uses forget gates, input gates, and output gates to filter key features relevant to network threat intelligence and suppress irrelevant noise. For example, when processing threat intelligence containing time stamps, priority can be given to "attack time" and "vulnerability discovery date." The output feature representation is as follows: Finally, the forward and backward hidden state vectors of the LSTM are concatenated into a comprehensive semantic representation for further entity recognition, as shown in the formula below:

[0044] f t =σ(W f ·[h t-1 ,x t ]+b f ),

[0045] i t =σ(W i ·[h t-1 ,x t ]+b i ),

[0046]

[0047] O t =σ(W o ·[h t-1 ,x t ]+b o ),

[0048]

[0049] h t =o t *tanh(C t ).

[0050] Here, ft, it, and ot are the activation values ​​of the forget gate, input gate, and output gate, respectively, σ is the Sigmoid activation function, and W and b are the corresponding weight matrices and biases.

[0051] S1.5 uses the CRF module to perform sequence labeling on the features output by the LSTM, calculates the scores of the input feature sequence and the label sequence, uses Softmax to calculate the normalized probability of the label sequence, and finally uses the Viterbi algorithm to find the optimal label path.

[0052] Specifically, the Conditional Random Field (CRF) module is used for sequence labeling of output features. Its scoring function is given by the input feature sequence X = {x1, x2, ..., x...}. n} and the corresponding label sequence Y = {y1, y2, ..., y n The scoring function for CRF is:

[0053]

[0054] Among them, P iyi A represents the score of the current input feature. yi -1,yi represents the transition score between adjacent labels;

[0055] Normalized probability calculation: The normalized probability of the label sequence is calculated using Softmax.

[0056]

[0057] Finally, decoding optimization is performed by finding the optimal tag path using the Viterbi algorithm:

[0058]

[0059] S1.6, Post-processing of the model: In the CRF output, regular expressions are used to validate and correct unreasonable label sequences. For example, if "I-IP_ADDRESS" appears at the beginning of a label sequence, it is corrected to "B-IP_ADDRESS"; if a date label sequence is missing the year, it is considered an invalid label and deleted. The final entity labels are output, including key entities such as malware names, attack targets, and their categories.

[0060] according to Figure 3 As shown, this invention provides a method for generating Attack Scenario Graphs (ASGs) based on network threat intelligence analysis. Particularly in step S2, the CR-M-SpanBERT model achieves core referential parsing through five stages: input preparation, context dependency modeling, Mention representation generation, referential relation discrimination, and output. This further optimizes the entity recognition results output by the BERT-BiLSTM-CRF model. The specific steps are as follows:

[0061] S2.1, Input preparation stage: Receive the output results from step S1, including the identified threat entities and their initial context embedding representations, and organize the threat entities and their corresponding context information into a candidate mention set as input to CR-M-SpanBERT;

[0062] S2.2, Context Dependency Modeling Stage: First, the context information of each mention is transformed into a high-dimensional vector representation through multiple embedding techniques. Then, semantic embedding, syntactic embedding, and positional embedding are performed. The SpanBERT model is used to generate semantic representations. By combining syntactic dependency relations and positional encoding, the semantic dependencies between entities are captured.

[0063] S2.3, Mention generation stage, based on self-attention mechanism, generates context-aware embedding representation for each mention, combining semantic, syntactic and positional embedding, and comprehensively considering the semantic and contextual relationships between candidate mentions;

[0064] S2.4, the referential relationship discrimination stage, firstly, candidate mention pairs are constructed, and the referential probability of each mention pair is scored by a feedforward neural network (FFNN) to generate a referential score matrix. Then, the referential score is optimized by softmax, and finally the best referential entity for each mention is selected.

[0065] Specifically, CR-M-SpanBERT completes the tasks of Mention representation generation and referential relation discrimination through the following process. In Mention representation generation, a context-aware embedding representation is generated for each mention based on self-attention weights, specifically implemented through the following formula:

[0066] Z mention =Φ c (Z semantic Z syntactic Z positional )

[0067] Among them, Z semantic Z syntactic and Z positional Representing semantic, syntactic, and positional embeddings respectively, Φ c This is a multi-embedded fusion function.

[0068] The workflow for the referential relationship determination stage is as follows: First, candidate mention pairs are constructed. Then, a feedforward neural network (FFNN) is used to score the referential probability of each mention pair, generating a score matrix of candidate mention pairs. Next, an attention mechanism is used to select the best referent entity for each mention. The specific process includes:

[0069] Calculate the reference score, generating a reference score for each mention pair, using the following formula:

[0070]

[0071] Soft attention optimization uses softmax normalization of the referential score to select the most likely referential entity.

[0072] Supervised learning optimization uses the cross-entropy loss function to train the model, resulting in the highest score for correct referential relationships.

[0073] S2.5, the output stage, generates each threat entity and its referential relationship chain, forming a clear semantic chain, such as associating "it" with "malware name", for use in subsequent dependency resolution steps;

[0074] In this invention, the multi-stage processing method of the CR-M-SpanBERT model can accurately capture the referential relationships between threat entities and enhance the semantic dependencies between entities through self-attention mechanism and supervised learning optimization, thereby effectively constructing the Attack Scenario Graph (ASG). This method is of great significance for improving the parsing ability of network threat intelligence and the construction accuracy of the attack scenario graph.

[0075] according to Figure 4 As shown, this invention provides an Attack Scenario Graph (ASG) generation method based on network threat intelligence analysis. Particularly in step S3, dependency parsing technology constructs the attack scenario graph by extracting bidirectional contextual semantic dependencies in the text. This not only helps extract bidirectional contextual semantic relationships (such as subject, verb, and object) from the text, but also provides accurate syntactic structure support for triple generation. The specific steps are as follows:

[0076] S3.1, Receive the threat entity and its referencing chain from S2;

[0077] S3.2 Dependency parsing technology analyzes the contextual dependencies between threat entities to extract grammatical dependencies (such as subject, predicate, and object) from the text, constructing bidirectional contextual semantic relationships. Specifically, dependency parsing technology first identifies the grammatical relationships between words in the text, such as determining the structure "attacker (subject) - exploit (predicate) - vulnerability (object)," thus providing accurate grammatical support for subsequent triple generation. Dependency extraction not only includes common grammatical roles (such as subject, predicate, and object) but also considers contextual conditions (C) and time stamps (T), generating quintuple data (S, P, O, C, T), where S represents the subject (such as attacker), P represents the predicate (such as "exploitation" or "attack"), and O represents the object (such as vulnerability or target).

[0078] S3.3 uses the RoBERTa-BiGRU model to generate quintuple embeddings. First, the generated quintuple data (S, P, O, C, T) is converted into serialized text to ensure it can be used as input to the RoBERTa model. Specifically, the components of each quintuple (subject, predicate, object, contextual condition, time stamp) are transformed into a format that meets the input requirements of a language model. The RoBERTa model captures the semantic relationships in the quintuples by generating contextual embeddings for each token. Then, BiGRU performs bidirectional processing on the output embeddings of RoBERTa, extracting forward and backward dependency information by concatenating the forward hidden states (h... i F ) and backward hidden state (h i B ), forming a comprehensive semantic representation (h i =[h i F ||h i B This indicates that the information is further filtered through a gating mechanism to suppress irrelevant noise information and focus on features related to the threatening entity.

[0079] In step S3.4, the generated quintuple embeddings are used for relation optimization. The embedding vector similarity is calculated for the subject (S), predicate (P), and object (O) in each quintuple to evaluate the semantic relationships between entities. Combining the embeddings with contextual conditions (C) and time stamps (T), a weighted analysis is performed on each element in the quintuple based on this semantic information. Specifically, for each pair of subject, predicate, and object, their vector similarity is calculated, and the weights are adjusted according to the influence of contextual conditions and time stamps. Finally, the optimized quintuple embeddings are output. This process, through meticulous calculation of relation weights, improves the accuracy of entity relations when generating triples, providing higher-quality input for the BERT-RE model in step S4.

[0080] according to Figure 5 As shown, this invention further provides a method for generating Attack Scenario Graphs (ASGs) based on network threat intelligence analysis. Specifically, in step S4, the BERT-RE model is used to extract more concise triples (e.g., "attacker-exploitation-vulnerability") from the input quintuples, thereby forming the foundational data for the final attack scenario graph. The specific steps are as follows:

[0081] S4.1 Receive the output quintuple embedding representation from S3 (including subject S, predicate P, object O, context condition C, and time stamp T);

[0082] S4.2 performs semantic filtering on the quintuples based on contextual conditions (C) and time stamps (T) to retain entity relationship data with high confidence.

[0083] S4.3 uses the BERT-RE model to predict the relationship of each quintuple. First, the semantic features of the input text are generated using the BERT embedding layer, and the embedding representations of the subject, predicate, and object are optimized independently to ensure the accuracy of entity relationships. Then, the SoftMax classifier is used to score all possible relationships, and the relationships are optimized using the cross-entropy loss function. The goal of the cross-entropy loss function is to maximize the probability of the correct relationship, thereby improving the accuracy of relationship classification. Finally, the set of classified triples is output, and the relationship type of each triple is labeled (such as "attack", "exploitation", "association", etc.).

[0084] S4.4, combined with quintuple embedding, optimizes triplet prediction results to eliminate redundant and contradictory data;

[0085] S4.5 The optimized set of triples will serve as the basic input for generating the attack scenario graph and proceed to the next step of graph structure construction. In this step, we will extract the set of nodes V and the set of edges E from the set of triples generated in S4, and map these triples to nodes and edges in the graph, thus constructing the preliminary structure of the attack scenario graph (ASG).

[0086] like Figure 6 As shown, the specific steps in generating the attack scenario diagram (S5) are as follows:

[0087] S5.1, Graph structure initialization step: Extract the node set V and edge set E from the triple set (EntityHead, Relation, EntityTail) generated in S4. Map the subject (EntityHead) and object (EntityTail) in the triple to nodes, and map the relation (Relation) in the triple to edges, and attach the relation type as an attribute of the edge.

[0088] S5.2 uses the embedding vectors output by the BERT-RE model to initialize the attributes of nodes and edges. For nodes, high-dimensional embedding representations are generated by combining contextual information (such as specific semantic roles like attacker, target, and vulnerability). For edges, embedding vectorization of relation types is used to capture the semantic associations between nodes.

[0089] S5.3, Message Passing and Embedding Optimization Steps: A Message Passing Network (MPNN) is used to iteratively optimize the graph structure. By capturing global semantic consistency through the message passing mechanism between nodes and edges, unlike traditional rule-based graph optimization methods, the MPNN can gradually adjust the graph's structure and relationships through information passing between nodes, making the entire Attack Scenario Graph (ASG) more accurate and consistent during generation. The MPNN optimizes nodes and edges in the graph adaptively, effectively correcting semantic inconsistencies or data loss problems that may occur in traditional methods, thus significantly improving the accuracy and robustness of the graph. The node update formula is as follows:

[0090]

[0091] Where hi(l) represents the embedding of node i at layer l, N(i) represents the neighboring nodes of node i, eij represents the edge embedding, f represents the node embedding update function, and g represents the message passing function, which is used to generate messages passed from neighboring node j to node i. The message passing update process includes calculating the embedding vector of each edge eij and aggregating all messages from neighboring nodes for node i.

[0092] S5.4, Global Graph Optimization Step: After several layers of message passing, the final embedded representations of the node set V and edge set E are generated. The optimization objective is to minimize the embedding loss functions of nodes and edges.

[0093]

[0094] Where Loss is the loss function for relation prediction, f is the combination function of nodes and edges used to generate relation prediction values, and Relation is the true relation label of the edge;

[0095] In step S5.5, the graph post-processing and visualization step involves calibrating the node and edge attributes of the generated graph to ensure that the graph structure conforms to the semantic rules of the cybersecurity field. The calibration process includes correcting possible semantic inconsistencies, such as adjusting node attributes or edge types to better meet actual security analysis needs. Finally, the generated attack scenario graph is displayed using graph visualization tools (such as Graphviz or NetworkX) to facilitate user understanding and further analysis.

[0096] Through the aforementioned technical means, this invention can efficiently and accurately identify entity relationships in network threat intelligence and generate Attack Scenario Graphs (ASGs). This method not only helps cybersecurity experts accurately analyze the causal chains of threat events but also provides data support for automated security protection systems, enhancing their defense capabilities.

[0097] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for attack scenario graph (ASG) generation based on network threat intelligence analysis, characterized in that, The attack scenario graph generation method based on network threat intelligence analysis comprises the following steps: S1, collect network threat intelligence information, and perform entity recognition through a pre-trained deep learning model, wherein the model is based on an improved BERT-BiLSTM-CRF structure, in the model input stage, specific mode entities in the network threat intelligence are matched and standardized by combining regular expressions, and a BIO annotation sequence is generated to input the BERT-BiLSTM-CRF model; wherein the BERT module generates word vectors through pre-training, and performs entity recognition in combination with a bidirectional LSTM and a CRF; S2, perform core reference analysis on the identified threat entities, wherein a CR-M-SpanBERT model is used to capture semantic context dependency between entities; S3, extract bidirectional context semantic dependency in the text by using dependency parsing technology, obtain five-tuple data such as subject, verb, and object related to the threat entities, and generate embedding representation in combination with RoBERTa-BiGRU; S4, use a BERT-RE model to extract triplets to prepare for constructing a final network threat-related attack scenario graph (ASG), comprising: S4.1, receive the output five-tuple embedding representation from S3, including subject S, predicate P, object O, context condition C, and time label T; S4.2, perform semantic filtering on the five-tuple based on the context condition C and the time label T, and retain high-confidence entity relationship data; S4.3, use the BERT-RE model to predict the relationship of each five-tuple, first use the embedding layer of BERT to generate the semantic features of the input text, and independently optimize the embedding representation of the subject, predicate and object to ensure the accuracy of the entity relationship, then use a SoftMax classifier to score all possible relationships, and optimize the relationship through a cross-entropy loss function, the goal of the cross-entropy loss function is to maximize the probability of correct relationship, thereby improving the accuracy of relationship classification, finally, output the classified triplet set, and label the relationship type of each triplet; S4.4, optimize the three-tuple prediction results in combination with the five-tuple embedding to eliminate redundant and contradictory data; S4.5, the optimized three-tuple set will be used as the basis for attack scenario graph generation and input into the next step of graph structure construction, in this step, we will extract node set V and edge set E from the three-tuple set generated in S4, and map these three-tuples to nodes and edges in the graph, and finally construct the preliminary structure of the attack scenario graph (ASG); S5, attack scenario graph (ASG) generation.

2. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 1, characterized in that In S1, in the model input stage, specific mode entities in the network threat intelligence are matched and standardized by combining regular expressions, and a BIO annotation sequence is generated to input the BERT-BiLSTM-CRF model, and for the BERT-BiLSTM-CRF model, it comprises a BERT module, an LSTM module and a CRF module; Specifically, in this model, the word vectors obtained by BERT pre-training are used as input information, and the input information is identified by combining bidirectional LSTM (Long Short Term Memory) and CRF.

3. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 2, characterized in that The BERT model in S1 completes pre-training through the following process: First, Masked Language Model (MLM) training is performed on a large-scale network threat intelligence corpus; For a given network threat intelligence text sequence X = {x1, x2, …, x n}, 15% of the words are randomly masked to generate a masked sequence X mask , the training target is to maximize the conditional probability of the masked word x i , and the masked word is predicted by the context semantics, thereby enhancing the model's understanding of network security domain-specific terms; P(x i |X mask ) = softmax(W h · h i + b h ) Next, the model is trained using the Next Sentence Prediction (NSP) task, which predicts whether S2 is the logical subsequent sentence of S1 by giving two sentences S1 and S2, and its loss function is: where y i represents whether it is a positive sample, P i is the classifier output of the BERT model, which enables it to learn the logical relationship between events; Finally, the pre-trained BERT model is used as a feature extractor to generate the context semantic representation of the words in the network threat intelligence, represented as a high-dimensional vector.

4. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 2, characterized in that, In S1, the bidirectional LSTM module captures semantic information through the following process: Time step dependency modeling: the bidirectional LSTM module takes the context vector generated by the BERT model as input and processes each word in the sequence step by step, modeling both short-term and long-term semantic dependencies through forward and backward propagation; Information enhancement mechanism: the bidirectional LSTM uses forget gates, input gates, and output gates to filter out key features related to network threat intelligence and suppress irrelevant noise information; Output feature representation: the forward and backward hidden state vectors of the LSTM are finally concatenated into a comprehensive semantic representation for further entity recognition, as shown in the following formula: f t = σ(W f · [h t-1 , x t ]+ b f ), i t = σ(W i · [h t-1 , x t ]+ b i ), O t = σ(W o · [h t-1 , x t ]+ b o ), h t =O t tanh(C t ). Here, f t i t O t are the activation values of the forget gate, input gate, and output gate, respectively, and σ is the Sigmoid activation function.

5. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 2, characterized in that The Conditional Random Field (CRF) module in S1 is used for sequence labeling of the output features, and the specific process includes: A scoring function, given an input sequence of features X = {x1, x2,..., x n} and a corresponding sequence of labels Y = {y1, y2,..., y n}, the scoring function of a CRF is: where P i·yi represents the score of the current input feature, A yi-1·yi represents the transition score between adjacent labels; Normalization probability calculation: the normalized probability of the label sequence is calculated by Softmax: Finally, decoding optimization: the optimal label path is found by the Viterbi algorithm: Finally, the CRF layer is used to combine regular expression features and BERT vectors to output optimized entity recognition results, output entity labels, and finally output key entities and their categories in network threat intelligence.

6. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 1, characterized in that The CR-M-SpanBERT model in S2 implements core reference resolution through input preparation, context dependency modeling, mention representation generation, reference relationship discrimination, and output stages. This stage identifies and corrects possible incorrect annotations or semantic mismatches in the BERT-BiLSTM-CRF model.

7. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 6, characterized in that The CR-M-SpanBERT in S2 completes the input preparation and context dependency modeling stages through the following process: In the input preparation stage, CR-M-SpanBERT accepts the output results from step S1, including the identified threat entities and their initial context embedding representations. The threat entities and their corresponding context information will be organized into a candidate mention set as input for CR-M-SpanBERT; In the context-dependent modeling stage, first, the context information of each mention is converted into a high-dimensional vector representation using multi-embedding technology, then semantic embedding, syntax embedding and position embedding are performed, the semantic representation is generated for each mention using the SpanBERT pre-training model specific to the threat intelligence field, the syntax embedding is generated according to the syntax dependency relationship provided in step S1, and the position embedding encodes the relative position of the mention in the text to reflect its relationship with other entities; Through the self-attention mechanism, CR-M-SpanBERT fuses these different dimensions of information to more accurately capture the semantic dependency relationship between entities.

8. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 6, characterized in that In S2, CR-M-SpanBERT completes the work of the Mention representation generation and reference relationship discrimination stage through the following process; In the Mention representation generation, based on the self-attention weight, a context-aware embedding representation is generated for each mention, and the specific process is realized through the following formula: Z mention = Φ c (Z semantic , Z syntactic , Z positional ) where Z semantic , Z syntactic and Z positional represent semantic, syntactic and positional embeddings, respectively, and Φ c is a multi-embedding fusion function.

9. The attack scenario graph (ASG) generation method according to claim 8, wherein the workflow of the reference relationship discrimination stage in S2 is as follows: First, construct a candidate mention pair, score the reference possibility of each mention pair through a feedforward neural network (FFNN), the input of the FFNN includes the semantic features, syntax information and context embedding information of each mention pair, through these features, the FFNN generates a reference score to evaluate whether the candidate mention pair refers to the same entity, then, combined with the attention mechanism, the best reference entity for each mention is selected, the specific process includes: Calculate the reference score, generate a reference score for the mention pair, the formula is as follows: Soft attention optimization, use softmax to normalize the reference score to select the most likely reference entity; Supervised learning optimization, use the cross-entropy loss function to train the model to make the correct reference relationship score the highest.

10. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 6, characterized in that In S2, CR-M-SpanBERT completes the output process through the following process: The output includes each threat entity and its reference relationship chain, which is used for subsequent dependency parsing steps.

11. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 1, characterized in that In S3, the dependency parsing technology extracts the bidirectional context semantic dependency relationship in the text through the following process: Receive the threat entities and their reference chains from S2, analyze the context dependency relationship between the threat entities through dependency parsing technology, and extract the bidirectional semantic dependency of the subject, predicate and object; Combined with the context condition C and the time label T, output the five-tuple data (S, P, O, C, T), wherein S represents the subject, P represents the predicate, and O represents the object; Use the RoBERTa-BiGRU model to generate five-tuple embedding to capture the context semantic features as input for subsequent steps.

12. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 11, characterized in that The specific steps of generating embedding representation of five-tuple in S3 combined with RoBERTa-BiGRU model include: The quintuple data (S, P, O, C, T) is converted into serialized text, input into the RoBERTa model, and the context embedding representation of each Token is generated by RoBERTa to capture the semantic relationship in the quintuple. The output embedding of RoBERTa is processed bidirectionally by BiGRU to extract the forward and backward dependency information of the text respectively. The forward hidden state h i F and the backward hidden state h i B are spliced to generate a comprehensive semantic representation h i =[h i F ||h i B , and the features related to the threat entity are further screened through the gating mechanism to suppress irrelevant noise information.

13. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 11, characterized in that The five-tuple embedding representation generated in S3 is used for the following relationship optimization: The subject S, predicate P and object O of each five tuple are subjected to embedding vector similarity calculation, and the embedding based on context condition C and time tag T is subjected to weighted analysis of entity relationship, and the final optimized five tuple embedding is output as the input of the BERT-RE model in step S4.

14. The attack scenario graph (ASG) generation method based on network threat intelligence analysis according to claim 1, characterized in that The specific steps of the attack scene graph generation process are as follows: The graph structure initialization step extracts the node set V and the edge set E from the triple set (EntityHead, Relation, EntityTail) generated in S4, maps the subject EntityHead and the object EntityTail in the triple to nodes, maps the relation Relation in the triple to an edge, and attaches the relation type as an attribute of the edge; The embedding vector output by the BERT-RE model is used to initialize the attributes of the nodes and edges, the high-dimensional embedding representation of the nodes is generated in combination with the context information, and the embedding vectorization processing of the relation type is used to capture the semantic association between the nodes; The message passing and embedding optimization step uses the message passing network (MPNN) to iteratively optimize the graph structure, captures the global semantic consistency through the message passing mechanism of the nodes and edges, and the node update formula is as follows: where h i (l) denotes the embedding of node i at layer l, N(i) denotes the neighbor nodes of node i, e ij denotes the embedding of edge e, f denotes a node embedding update function, g denotes a message passing function for generating a message passing from neighbor node j to node i, the update process of message passing includes calculating the embedding vector of each edge e ij , and for node i, aggregating all messages from neighbor nodes; The global graph optimization step generates the final embedding representation of the node set V and the edge set E after a plurality of layers of message passing, and the optimization target is to minimize the embedding loss function of the nodes and edges: Where Loss is the loss function of relation prediction, f is the combination function of nodes and edges, used to generate the relation prediction value, and Relation is the real relation label of the edge; The graph post-processing and visualization step calibrates the attributes of the generated nodes and edges to ensure that they meet the semantic rules in the network security field, uses a graph visualization tool to display the generated attack scene graph to the user, and facilitates understanding and analysis.

Images