Threat intelligence triple combined extraction method based on data enhancement

Abstract

The invention discloses a threat intelligence triple combined extraction method based on data enhancement, comprising a data enhancement method which is responsible for performing multi-granularity high-quality expansion on a small amount of data in the field of threat intelligence through a data enhancement method based on a large model. And the syntactic information fusion method is responsible for analyzing an input sentence into a component tree and a dependency tree, extracting information in the component tree and the dependency tree by combining a Tree-GRU syntactic fusion algorithm to obtain a syntactic dependency matrix, and fusing the syntactic dependency matrix into an extraction model to enhance the understanding of the syntactic dependency matrix on an explicit text structure and semantics. And the form filling extraction method is responsible for simultaneously representing and extracting entities and relationships in sentences in the same form through a joint extraction algorithm based on a form filling method so as to enhance interaction between the entities and the relationships, and introducing an adversarial training mechanism based on an MDA method in training so as to enhance robustness and generalization ability of the model. The invention provides a new design thought for solving the problem of insufficient labels in the network threat intelligence triple extraction field and extracting complex, long and difficult sentences.

Description

Technical Field

[0001] The present invention belongs to the field of threat intelligence extraction, and particularly relates to related fields such as form filling extraction method, triple joint extraction, data augmentation, etc. Background Art

[0002] In recent years, with the rapid development of Internet technology, the security risks in the cyber space have become more severe, and the network attack means have become more concealed. New types of attacks such as Advanced Persistent Threat (APT) and zero-day threats have gradually penetrated into important industrial fields. Traditional security means seem powerless in the face of these new threats.

[0003] In order to cope with these evolving threats, Threat Intelligence has gradually become an important part of the cyber security field. For the acquisition of threat intelligence, public cyber security texts are usually obtained according to security reports, security blogs, security vulnerability databases, etc. However, most of these texts are stored in unstructured form. In order to manage and utilize these unstructured security information more efficiently, Relation Triple Extraction is a key technology. Relation Triple Extraction is used to automatically extract valuable intelligence information from a large amount of security data to form a structure of triple (entity, relation, entity).

[0004] In the work of extracting threat intelligence relation triples (entity-relation-entity), the pipeline method was usually adopted in the early stage, and the triple extraction task was decomposed into two independent sub-tasks: Named Entity Recognition (NER) and Relation Extraction (RE). However, this method has a significant defect, that is, error propagation. In order to overcome the problem of error propagation, in recent years, researchers have proposed the method of relation triple joint extraction. For example, the end-to-end method converts the joint extraction problem into a labeling problem, showing good performance and improving the error propagation problem to a certain extent, but it cannot handle the entity relation overlap problem well. However, complex long sentences and overlapping relations are exactly common in threat intelligence. A threat intelligence sentence may contain multiple relations, and there is a complex relation network between an entity and multiple other entities. This intertwined and complex entity relation greatly increases the difficulty and uncertainty of model extraction. Moreover, the currently publicly accessible datasets for relation triple joint extraction in the threat intelligence field are relatively few. According to the investigation, there is only one public dataset with relatively high quality in this field, which is difficult to cope with the growing risk challenges in the field of network threat intelligence.

[0005] In order to solve the above problems, it is very necessary to study a new method for threat intelligence triple joint extraction. Summary of the Invention

[0006] The present invention proposes a method for jointly extracting threat intelligence triples based on data augmentation, introducing a large language model to perform multi-granularity data augmentation on the scarce entity relationship extraction dataset in this field, using Tree-GRU to fuse constituent and dependency syntactic information to enhance the model's perception of syntactic structures, and finally combining syntactic information with a filling table method for joint extraction. At the same time, an innovative adversarial training mechanism is introduced to generate adversarial samples through perturbation to enhance the generalization ability of the model.

[0007] The present invention proposes a method for jointly extracting threat intelligence triples based on data augmentation, comprising the following steps:

[0008] 1) Collect and clean the public dataset in the field of network threat intelligence, perform data augmentation from the four expression levels of vocabulary, phrase, syntax, and semantics, and combine role guidance and logical chain prompting methods to construct a large model prompt template to enhance the accuracy of the generated text.

[0009] 2) Parse the input sentence into a constituent tree and a dependency tree, jointly encode using RoBERTa and

[0010] Tree-GRU, and at the same time combine the semantic features of BERT, generate a syntactic dependency matrix through a feed-forward network and a multi-head attention mechanism, and incorporate the obtained syntactic dependency matrix into the extraction model in the next stage to enhance its understanding of explicit text structures and semantics.

[0011] 3) Use a single form single-stage extraction algorithm based on the filling table method to simultaneously represent and extract entities and relationships in the sentence in the same table to enhance the interaction between entities and relationships, and introduce an adversarial training mechanism based on the MDA method during training to enhance the robustness and generalization ability of the model.

[0012] Furthermore, the network threat intelligence data augmentation process based on the large language model includes:

[0013] a. After researching and collecting the existing public datasets, screen out CTI reports related to 36 malware, including malware such as Cerberus,

[0014] Rotexy, Judy, Gooligan, and SpyNote RAT, malware defined in the ATT&CK model proposed by MITRE.

[0015] b. Compared with the corpus information in traditional information extraction tasks, the original corpus of network threat intelligence contains a large number of code snippets, URLs, IP addresses, file paths, etc. Therefore, use regular expressions to identify and filter out these irrelevant corpus fragments.

[0016] c. Transform the original training data at the four expression levels of vocabulary, phrase, syntax, and semantics, so that the generated new data has stronger diversity while meeting the semantic requirements of the original training data. The prompt template consists of two parts: role guidance and logical chain prompt. (1) Role guidance means endowing the large language model with a role strongly related to the task, restricting the knowledge scope of subsequent questions, and making the answers of the large language model more targeted. (2) The logical chain prompt splits complex questions into multiple sub-questions, and then inputs the correct reasoning steps into the large language model, effectively enhancing the accuracy of the output results of the large language model for complex questions.

[0017] Based on the above prompt template, use the large language model to identify and retain key information at different granularities in the text, and replace the non-key information in the text to generate new text data.

[0018] d. Use the Self-BLEU metric to evaluate the diversity of the data augmentation dataset. The lower the similarity, the higher the diversity of the data augmentation dataset. The core idea is:

[0019] Take each augmented sample as the "generated sample" (candidate), and the remaining augmented samples as the "reference sample set", calculate the BLEU score of each augmented sample relative to the other samples. If the BLEU score of this sample is higher than a certain threshold, it is considered that the sample quality is not high and it will be excluded.

[0020] Furthermore, in step 1), the large language model GLM4 is used for data augmentation. Some relationship types with relatively small quantities in the dataset, such as uses, hasAuthor, hasAlias, variantOf, and exploits, are selected for augmentation experiments and the effectiveness is verified.

[0021] Furthermore, in step 2), the constituency syntax and dependency syntax information are combined into the BERT model to enhance its understanding of text structure and semantics. Specifically, the dependency tree is used to describe the grammatical dependencies between words in a sentence. Using this dependency information can significantly enrich the original text representation, thereby capturing the semantic connections between adjacent words. The constituency tree organizes the sentence into a hierarchical tree structure, which not only provides additional hierarchical syntax information but also allows us to analyze clauses at any fine-grained level. At the same time, in order to effectively encode the dependency tree and constituency tree information, the Tree-GRU used in the present invention is a GRU model with a tree structure, which has more efficient parallel computing capabilities, as well as the advantages of fewer parameters and faster training.

[0022] Furthermore, in step 3), to solve the problems of relationship overlap and error transmission and further strengthen the connection between entities and relationships during the extraction process, a filling table method for jointly extracting entities and relationships in one stage using only a single table is proposed. The number of parameters to be trained for this single-table method is one-third of the original. The reduction of model parameters not only reduces the computational complexity but also enables the model to converge more quickly, greatly accelerating the training and prediction speeds. At the same time, an adversarial training mechanism is added during the training process. By constructing and using adversarial samples, the model's ability to handle noise and mutation situations is enhanced, and its robustness and generalization ability are strengthened, enabling the model to better adapt to triple extraction in the threat intelligence field.

[0023] The method of the present invention can be used to perform threat intelligence triple joint extraction well and has the following advantages compared with the prior art:

[0024] 1. The present invention proposes a single-table single-stage extraction method with enhanced syntactic information. By combining constituent syntactic and dependency syntactic information, a Tree-GRU model is used to encode the syntactic tree, and syntactic dependency information is introduced into the BERT model, significantly enhancing the model's understanding of text structure and semantics. The multi-head attention mechanism is introduced to fuse syntactic information, improving the sensitivity to complex syntactic structures, thereby optimizing the triple extraction effect.

[0025] 2. The present invention solves the problem of insufficient labels in the field of threat intelligence triple extraction. By combining large language models for data augmentation, training data with stronger diversity and higher quality is generated, and an adversarial training mechanism is used to enhance the robustness and generalization ability of the model. The model's ability to handle data mutation is improved, ensuring its more stable and reliable performance in the actual threat intelligence field. Description of the Drawings

[0026] Figure 1 is the overall framework diagram of the network threat intelligence triple joint extraction of the present invention, which is mainly divided into three modules: a network threat intelligence data augmentation module based on a large language model, a syntactic information fusion module based on Tree-GRU, and a triple joint extraction method based on adversarial training and table filling method.

[0027] Figure 2 is a schematic diagram of the decoding strategy of the filling table method.

[0028] Figure 3 is an example diagram of the data cleaning regular expression of the present invention, and regular expressions for replacing code snippets, URLs, IP addresses, and file paths are used as examples.

[0029] Figure 4This is an example diagram of the prompt template for the data augmentation large model of the present invention, which describes the prompt template jointly generated by the role-guided and logical chain prompting methods in the word dimension.

[0030] Figure 5 It is a distribution diagram of entity and relationship types for the enhanced dataset.

[0031] Figure 6 It is a diagram of the overlapping triple extraction result, that is, the extraction effect when entities have overlapping nesting.

[0032] Figure 7 It is a diagram of the extraction results of different numbers of triples in a sentence, that is, the extraction effect when there are multiple relationships in a sentence. Detailed implementation manners

[0033] To make the above features and advantages of the present invention more obvious and understandable, the present invention will be further described in detail below in combination with specific implementation manners and drawings. The specific process is as Figure 1 shown, and its main steps include:

[0034] Step 101: Collect and screen the publicly available dataset.

[0035] Step 102: Perform data cleaning on threat intelligence, and use regular expressions to identify and filter out irrelevant corpus fragments such as code snippets, URLs, IP addresses, and file paths.

[0036] Step 103: Transform the original training data from the four expression levels of vocabulary, phrase, syntax, and semantics by using the role-guided and logical chain prompting methods.

[0037] Step 104: Use the Self-BLEU metric to evaluate the diversity of the enhanced dataset and remove low-quality data.

[0038] Step 201: Input the input sentence into RoBERTa to obtain the embedding representation, and introduce two tree-structured GRU models, the Tree-GRU network, to encode the information of the constituency tree and the dependency tree respectively.

[0039] Step 202: Obtain the dependency embedding and constituency embedding corresponding to each vocabulary in the sentence, and fuse these two embedding features through the multi-head attention mechanism.

[0040] Step 203: Concatenate the outputs of all attention heads and project them through a linear transformation, and take the average value to obtain the syntactic dependency matrix.

[0041] Step 301: Use the filling method used by the ATTable method to formulate a unique token filling strategy and decoding strategy.

[0042] Step 302: The ATTable method is based on the BERT model. At the output of the last attention layer, 12 attention matrices are obtained. The syntactic dependency matrix obtained previously is averaged with the matrix output by BERT to obtain the final output matrix, which is then decoded to obtain the result.

[0043] Step 401: ATTable introduces an innovative adversarial training mechanism during the training process. It designs a multi-party perturbation evaluation method MDA. By constructing and using adversarial samples, the ability of the model to handle noise and mutation situations is enhanced.

[0044] The present invention uses the publicly available WebNLG general domain triple extraction dataset in the industry and the network threat intelligence dataset constructed by the present invention for training and verification, and conducts experiments respectively in the scenarios of overlapping triples and multi-relation triples. The experimental results show that the present invention enhances the multi-granularity data of the scarce entity relationship extraction dataset in this field by introducing a large language model, uses Tree-GRU to fuse the constituent and dependency syntactic information to enhance the model's perception of the syntactic structure, and finally combines the syntactic information with the form-filling method for joint extraction. At the same time, an innovative adversarial training mechanism is introduced to generate adversarial samples through perturbation to enhance the generalization ability of the model. It not only achieves good results on the general domain dataset, but also can accurately and stably extract network threat intelligence triples in various complex situations.

[0045] As mentioned above, the above are only the preferred specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those familiar with the technology within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A threat intelligence triplet joint extraction method based on data enhancement, characterized in that: include: A. Collect public cyber threat intelligence triple extraction data sets, identify and filter out irrelevant corpus fragments for data cleaning, combine role guidance and logic chain prompt methods to construct prompt templates at multiple levels, and input the sentences in the data set into the large model in combination with the template to obtain an enhanced data set; B. Use the syntactic parsing tool to parse the input sentence into a component tree and a dependency tree. Use two Tree-GRU networks to encode the components and dependency syntactic information of the tree respectively, and obtain the dependency embedding and component embedding of each word in the sentence. Use the multi-head attention mechanism to fuse the two with the semantic features to obtain the syntactic dependency matrix. C. According to the established token filling strategy and decoding strategy, the entities and relations in the sentence are simultaneously represented and extracted in the same table using the table filling method; among them, this table filling method is based on the BERT model, and the syntactic dependency matrix and the matrix output by BERT are averaged to obtain the final output matrix and decoded to obtain the result; D. For the data-enhanced training set, the above model is trained using adversarial training to obtain the final triplet extraction model.

2. According to a data-enhanced threat intelligence triple joint extraction method according to claim 1, it is characterized in that: Step A further comprises the following steps: A1. Collect public network threat intelligence and perform data cleaning, using regular expressions to identify and filter out irrelevant corpus fragments such as code snippets, URLs, IP addresses, file paths, etc. A2. Generate new text data from four levels: vocabulary, phrases, syntax, and semantics. That is, use the big model to extract and retain the key information at each level, replace the non-key information of the text, and achieve data transformation. A3. The role-guidance method is used to give the large language model a role that is strongly related to the task, and the subsequent answers are limited to the knowledge scope of the role. The logical chain prompt method splits complex problems into multiple sub-problems and inputs the correct reasoning steps into the large language model.

3. According to a data-enhanced threat intelligence triple joint extraction method according to claim 1, it is characterized in that: Step B further comprises the following steps: B1. Encode the input sentence using RoBERTa to obtain the context-aware representation of each character; B2. Use the stanford-corenlp syntax analysis tool to parse the sentence into a component tree and a dependency tree respectively; introduce two tree-structured GRU models, the Tree-GRU network, to encode the information of the component tree and the dependency tree respectively; input the sentence into the RoBERTa model to encode the corresponding embedding vector, which is used as the input vector of the leaf node and propagates upward layer by layer along the Tree-GRU until the root node, to obtain the encoded representation of the sentence; B3. After encoding, we get the dependency embedding h corresponding to each word in the sentence. dep and component embedding h con , these two embedding features are fused with the semantic features of the sentence in the following way; Input the sentence into the BERT model and get the output of the last layer. Each token has a corresponding hidden layer representation. After removing the [CLS] and [SEP] tags, we get the semantic feature h of the sentence. sem ; Use the feedforward network layer FNN to perform nonlinear transformation on these three feature vectors to obtain z sem , z dep and z con Three eigenvectors; z sem The calculation process of is shown in the following formula. The other two features are also processed by the feedforward neural network using GELU as the activation function. W1 and b1 are both trainable parameters of the model, and GELU is the activation function. In order to obtain a high-dimensional fusion feature vector, the output feature vectors of the three different feedforward network layers are first concatenated. This high-dimensional vector z fus It contains component syntax, dependency syntax and sentence semantic information; With fus =[of con ;With dep ;With sem ] In order to ensure that the importance of component syntax, dependency syntax and sentence semantic information in this high-dimensional vector can be effectively distinguished, a multi-layer perceptron (MLP) is further introduced to learn the adaptive weights of each part of the information; finally, the learned model weighs the importance of the three aspects and outputs a weighted feature vector k fus ; LeakyReLU is the activation function. By optimizing the weight parameters W2 and b2, the model can adaptively fuse the component syntax, dependency syntax, and sentence semantic information to generate a higher quality fused feature vector. The vector is input into the multi-head attention mechanism, and the attention output is calculated by the scaled dot product attention mechanism. The outputs of all h attention heads are concatenated to form a new vector. The concatenated result is then transformed by another linear transformation W. O Perform projection to obtain the final multi-head attention output; Concat(head1,head2,…,head h ) Output=Concat(head1,head2,…,head h )·W O head1,head2,...,head h Represents the output feature matrix of h attention heads; takes the average of the attention scores output by each attention head in the last layer of the multi-head attention mechanism to generate a syntactic dependency matrix, which is used to summarize the weight performance of syntactic information on different attention heads; dep_matrix=average(Output(head1,head2,…,head h )) average represents the mean function.

4. According to a data-enhanced threat intelligence triple joint extraction method according to claim 1, it is characterized in that: Step C further comprises the following steps: C1, the tag filling strategy and decoding strategy are as follows: 1) Mark filling: In the relation-specific table, a specific vertex marking method is used; Specifically, three vertices are defined for the entity-entity region: WL (upper left corner), WR (upper right corner), and KR (lower right corner); WL represents the starting position of the subject and object entities in the triple, WR represents the starting position of the subject entity and the ending position of the object entity, and KR represents the ending position of the subject and object entities. If there is a connection between two entities, the WL, WR, and KR positions are filled; two vertices RU (upper vertex) and RD (lower vertex) are defined for the subject entity-relationship region, and RL (left vertex) and RR (right vertex) are defined for the relationship-object entity region. The filling method is the same as that of the entity-entity region, see the attached figure of the specification for details; 2) Decoding strategy: After the vertex positions in the table are filled, a bidirectional decoding strategy is used to extract triples; by simultaneously decoding from two different directions (WL, WR, RU, KR, RD) and (KR, WR, RR, WL, RL), the triple information in the table can be more comprehensively covered and extracted, as shown in the attached figure of the specification; C2, the table filling method is based on the BERT framework. The sentences and all relationship types are input into the BERT Encoder for encoding. The output of the last layer is obtained through calculation by the BERT model. The output contains the attention matrix corresponding to the twelve attention heads. The syntactic dependency matrix obtained in step B is averaged with these attention matrices to obtain the final output matrix. The output matrix is ​​decoded according to the decoding strategy in C1 to obtain the triple extraction result.

5. According to a data-enhanced threat intelligence triple joint extraction method according to claim 1, it is characterized in that: Step D further comprises the following steps: D1. During the training process, an anti-training mechanism based on dynamic gradient adjustment is introduced. By constructing and using adversarial samples, the model's ability to cope with noise and variation is improved. The input sample is x, the true label is y, and the generative model of the adversarial sample is G. Then the perturbation value of the current model is calculated by gradient ascent, and it is added to the original embedding to obtain the adversarial sample for the next step of training. The specific formula is as follows: Where g represents the gradient of the embedding layer obtained by calculating the gradient of the loss function L with respect to the input x; Dynamic gradient adjustment: dynamically adjust the step size α k Adaptively adjust according to the size of the gradient and the current performance of the model; if the loss value of the model on the current sample is large, it means that the model is highly sensitive to the sample and requires stronger perturbations to challenge the model; conversely, if the loss is small, adjust the step size to reduce the perturbation amplitude; Among them, β is a constant coefficient, λ is the adjustment factor, |g| is the norm of the gradient g; according to the dynamic step size α k To calculate the perturbation δ k , instead of using a fixed step size: Perturbation δ k will be gradually added to the original input, and the final adversarial sample x′ is: Where K is the number of iterations of the perturbation; D2. In terms of perturbation calculation method, a multi-party perturbation evaluation method MDA is designed, which uses three loss functions L1, L2, and L3. L1 represents the cross entropy loss function, L2 represents the conditional random field loss function, and L3 represents the robustness loss function. At the same time, the adversarial regularization loss L reg , to prevent the model from over-reliance on adversarial attacks and overfitting, so that the adversarial samples can still maintain semantic consistency within the perturbation range, x′ represents the adversarial sample; L reg =∥x’-x∥2 L(x,y;θ)=t1L1(x,y;θ)+t2L2(x,y;θ)+t3L3(x,y:θ)+λ·L reg t1, t2, t3 represent the weight coefficients of different loss functions, and λ is the regularization hyperparameter.

Images