Asset security monitoring method, equipment, medium and product

Abstract

The invention discloses an asset security monitoring method and device, a medium and a product, and relates to the technical field of network security and large language models.The method comprises the steps that an insurance waiting report is acquired; extracting asset information in the insurance-waiting report through a regular expression method to obtain first asset information; performing word segmentation on the equal insurance report by utilizing the trained asset word segmentation device to obtain a word segmentation result; inputting the word segmentation result into a trained natural language processing model to obtain feature information, and obtaining second asset information; inputting the second asset information into an asset surveying and mapping platform for asset carding to obtain third asset information; merging and de-duplicating the first asset information, the second asset information and the third asset information to obtain merged asset information; and inputting the combined asset information into a scanning missing platform, and carrying out regular scanning and change monitoring. According to the method and the device, the coverage assets in the equal insurance report can be accurately extracted, and the related assets are continuously and safely monitored.

Description

Technical Field

[0001] This application relates to the technical fields of network security and large language models, and particularly to a method, device, medium, and product for asset security monitoring. Background Art

[0002] The network security level protection assessment report (hereinafter referred to as the "equal protection report") is an official document formed after the equal protection assessment of a network system based on relevant network security standards. The purpose of this report is to evaluate the security protection level of the network system and propose corresponding security protection measures and suggestions to ensure that the network system can maintain a certain security level when facing various security threats. After the equal protection assessment, it is not easy for the tested unit to monitor high-risk assets in the face of multiple assessment reports of dozens or even hundreds of pages. How to extract the required asset content from the complex documents and comprehensively sort out the assets, so as to efficiently monitor asset security is an urgent problem to be solved.

[0003] Currently, research on large model fine-tuning mainly focuses on question-answering systems and text generation. There is still a lack of research on large models for logical reasoning and judgment based on natural language understanding and extracting relevant assets. Summary of the Invention

[0004] The purpose of this application is to provide a method, device, medium, and product for asset security monitoring, which can accurately extract the assets covered in the equal protection report and continuously monitor the involved assets, effectively solving the problem that assets cannot be continuously monitored after the equal protection test, helping enterprises to timely discover and respond to potential security hazards, and improving the overall network security protection ability.

[0005] To achieve the above purpose, this application provides the following solutions:

[0006] In the first aspect, this application provides a method for asset security monitoring, and the method for asset security monitoring includes:

[0007] Obtain the equal protection report;

[0008] Extract the asset information in the equal protection report by means of regular expressions to obtain the first asset information;

[0009] Segment the equal protection report using the trained asset tokenizer to obtain the tokenization result;

[0010] Input the tokenization result into the trained natural language processing model to obtain feature information and get the second asset information;

[0011] Input the second asset information into the asset mapping platform for asset sorting to obtain the third asset information;

[0012] Merge and deduplicate the first asset information, the second asset information, and the third asset information to obtain merged asset information;

[0013] Input the merged asset information into a vulnerability scanning platform; the vulnerability scanning platform is used to regularly scan and monitor changes to the merged asset information.

[0014] In a second aspect, the present application provides a computer device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor executes the computer program to implement the method for asset security monitoring described in any one of the above.

[0015] In a third aspect, the present application provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the method for asset security monitoring described in any one of the above.

[0016] In a fourth aspect, the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the method for asset security monitoring described in any one of the above.

[0017] According to the specific embodiments provided by the present application, the following technical effects are disclosed in the present application:

[0018] The present application provides a method, device, medium, and product for asset security monitoring. The method includes: obtaining an equal protection report; extracting asset information from the equal protection report by means of a regular expression method to obtain first asset information; segmenting the equal protection report using a trained asset tokenizer to obtain a segmentation result; inputting the segmentation result into a trained natural language processing model to obtain feature information and get second asset information; inputting the second asset information into an asset mapping platform for asset sorting to obtain third asset information; merging and deduplicating the first asset information, the second asset information, and the third asset information to obtain merged asset information; inputting the merged asset information into a vulnerability scanning platform for regular scanning and change monitoring. The present application uses three different methods to obtain asset information in the equal protection report, so as to accurately extract the assets covered in the equal protection report. After extracting the three asset information, they are merged and deduplicated, and then the vulnerability scanning platform is used for regular scanning and change monitoring, effectively solving the problem that assets cannot be continuously monitored after the equal protection test, helping enterprises to discover and respond to potential security hazards in a timely manner, and improving the overall network security protection ability. Description of the Drawings

[0019] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0020] Figure 1 It is an application environment diagram of a method for asset security monitoring in an embodiment of the present application;

[0021] Figure 2 It is a schematic flowchart of a method for asset security monitoring provided in an embodiment of the present application;

[0022] Figure 3 It is a schematic flowchart of constructing a quality detection large model for equal protection reports provided in another embodiment of the present application;

[0023] Figure 4 It is a schematic structural diagram of a computer device provided in an embodiment of the present application. Detailed implementation manners

[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present application.

[0025] To efficiently and accurately extract assets from equal protection reports, introducing artificial intelligence methods is a good choice. In asset extraction from equal protection reports, a large amount of logical reasoning and natural language understanding are required, and traditional machine learning models may be difficult to handle these tasks. In recent years, the rapidly developing large language models have greatly improved in reasoning and natural language understanding. For example, the BERT model is good at understanding context relationships and can better handle complex sentence structures and semantic relationships, while the RoBERTa (Robustly Optimized BERT Pretraining Approach) model is an improved version of BERT, with larger training data and better performance, and is especially suitable for processing long texts and complex contexts. In this process, the main technical problems to be solved are as follows:

[0026] Preprocess the document:

[0027] Considering that different evaluation personnel have different writing habits for reports and use different font formats, it is first necessary to unify the format of the evaluation reports, and then convert the sorted Word documents into txt texts.

[0028] Efficient and high-quality training of the model:

[0029] Considering that the asset extraction in the equal protection report is an application in a vertical field, the large model should first be retrained to adapt to the detection task. If the large model is retrained with all parameters, problems such as huge computational resource requirements, complex hyperparameter adjustment and model design, unstable training process and difficult debugging will be faced. Therefore, a new large model training method, namely transfer learning, especially the fine-tuning technology, needs to be introduced to fine-tune the RoBERTa model, accelerate the model training process, and maintain high performance at the same time.

[0030] Adapting the model to the task of asset extraction:

[0031] At present, the research on large model fine-tuning mainly focuses on question answering systems and text generation. There is still a lack of research on large models for logical reasoning and judgment based on natural language understanding and extracting relevant assets. Therefore, it is necessary to solve how to construct a dataset and train a model to enable it to perform the task of document quality detection.

[0032] Model evaluation and model iteration:

[0033] A series of indicators need to be selected to evaluate the model after fine-tuning RoBERTa, so as to facilitate the iteration and optimization of the model according to the evaluation results. Since the task of asset extraction in the equal protection report is different from the task of generating text, relying only on the current evaluation indicators of large models in text generation is not enough. Multiple indicators also need to be combined to evaluate and analyze the output results of the model.

[0034] There is no precedent for extracting asset data from the equal protection report in the existing technology. If assets are monitored, most may be screened through manual auditing. From the perspective of asset security monitoring, it may simply be to screen out IPs and URLs and then input them into the monitoring platform for monitoring.

[0035] One of the applications of this application is to use a large model to replace manual work, and then use the large model to extract in an anthropomorphic extraction method, and fine-tune and evaluate the model (mainly); the second is to increase the efficiency of automated extraction and monitoring execution; the third is to perform secondary expansion on the extracted assets to make the collected assets more comprehensive, so as to monitor the assets more effectively and reduce the risk of assets.

[0036] This technology solves the way of extracting assets from the report, and the assets in the equal protection report are relatively single. Through the way of extraction and expansion, the assets of the unit under test are comprehensively collected to achieve comprehensive monitoring as much as possible.

[0037] The monitoring part forms a complete asset monitoring system for the subsequent use of assets. Between the extraction of assets and the monitoring of assets, there is also an asset expansion part that can collect and monitor additional assets, improve the assets to be monitored, and better protect the security of the unit under test.

[0038] Current technologies extract specific categories, such as IP addresses or URLs, for which it is easy to write regular expressions. The extraction of asset names and other nouns is not involved because it requires understanding. The introduction of large models enables the extraction of some asset nouns like humans and subsequent expansion of asset collection.

[0039] This application relates to a method for asset security monitoring, which is a method for asset security monitoring in the network security level protection assessment based on equal protection big data, aiming to improve the efficiency and accuracy of asset security management. This method mainly focuses on the assets involved in the network security level protection assessment report and realizes security monitoring through innovative technical solutions. First, the equal protection report is converted into text format and systematically organized into a structured data set, and combined with the fine-tuning technology of the RoBERTa model, the large model is adjusted specifically to adapt to specific security monitoring tasks. Then, a variety of evaluation indicators are selected to comprehensively evaluate the model output, and iterative optimization is carried out according to the evaluation results to ensure the continuous improvement of the model performance. Finally, the asset information extracted by the large model and the asset information collected from the Internet are combined and used as the input of the security monitoring function, and the PoC in the comprehensive vulnerability database is used to regularly scan for vulnerabilities and detect anti-tampering for all assets. This application realizes the efficient and accurate extraction of the assets covered in the equal protection report and continuously monitors the involved assets, effectively solving the problem that assets cannot be continuously monitored after the equal protection test, helping enterprises to timely discover and respond to potential security hazards, and improving the overall network security protection ability.

[0040] To make the above objects, features, and advantages of the present application more obvious and understandable, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] The method for asset security monitoring provided by the embodiments of the present application can be applied to, for example Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be set separately, integrated on the server 104, placed on the cloud or other servers. The terminal 102 can send the pending equal protection report to the server 104. After receiving the pending equal protection report, the server 104 extracts the asset information in the equal protection report by means of regular expressions to obtain the first asset information; uses the trained asset tokenizer to tokenize the equal protection report to obtain the tokenization result; inputs the tokenization result into the trained natural language processing model to obtain the feature information and get the second asset information; inputs the second asset information into the asset mapping platform for asset sorting to obtain the third asset information; merges and de-duplicates the first asset information, the second asset information and the third asset information to obtain the merged asset information; inputs the merged asset information into the vulnerability scanning platform for regular scanning and change monitoring. The server 104 can feedback the obtained scanning and change monitoring results to the terminal 102. In addition, in some embodiments, the method of asset security monitoring can also be implemented independently by the server 104 or the terminal 102. For example, the terminal 102 can directly process the pending equal protection report, or the server 104 can obtain the pending equal protection report from the data storage system and process it.

[0042] Among them, the terminal 102 can be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. The portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers, and can also be a cloud server.

[0043] In an exemplary embodiment, as Figure 2 shown, a method for asset security monitoring is provided. This method is executed by a computer device, and can be specifically executed independently by a computer device such as a terminal or a server, or jointly executed by a terminal and a server. In the embodiments of the present application, taking this method applied to Figure 1 the server 104 in it as an example for illustration, it includes the following steps S1 to step S7. Among them:

[0044] S1. Obtain the equal protection report.

[0045] S2. Extract the asset information in the equal protection report by means of regular expressions to obtain the first asset information.

[0046] In this embodiment, first, convert the equal protection report from Word format to text format and preprocess it. This step mainly includes:

[0047] Read the equal protection report in Word format stored locally.

[0048] Uniformly process the Word file format, such as Chinese and English symbols, etc.

[0049] Convert the table content into text lines separated by a specific delimiter (such as "|" or ",").

[0050] Filter out noise information by defining rules. For example, regular expressions can be used to match and delete references to legal clauses in a specific format (such as paragraphs starting with "[Legal clause number]"), figure numbers (such as "Figure [number]-[Figure name]"), and annotations (such as content starting with "Note:").

[0051] Use the docx2txt library to convert the Word document to text.

[0052] Then preprocess the text. This step mainly includes:

[0053] Process the converted text, including removing unnecessary whitespaces, special characters, punctuation marks, etc.

[0054] Unify the format to UTF-8 format and save it as the original text information TXT.

[0055] Use regular matching rules to extract easily extractable asset information such as IP and URL. For example, use re.compile(r'\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b') to extract IP from the original text information TXT, and use re.compile(r'http[s]?:\ / \ / (?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+') to extract URL. Take the extracted information as part of the assets to be monitored to obtain the first asset information (Final1). IP and URL can be relatively simply extracted through regular matching. The RoBERTa model can extract parts that are difficult to extract by regular matching and complete the named entity recognition (NER) task. It is somewhat difficult to use regular expressions for NER matching. First, the forms and composition rules of entities are very complex. Taking company names as an example, company names may contain various components, such as geographical names (e.g., "Beijing" in "Beijing XX Technology Co., Ltd."), trade names ("XX"), industry types ("Technology"), and organizational forms ("Co., Ltd."). The combination methods of different company names are diverse, and there may also be abbreviations (e.g., "Ali" referring to "Alibaba Group"), foreign names (e.g., "Alibaba Group"), and names with special symbols (e.g., "XX-Technology Co., Ltd."). For system names, there is similar complexity, which may include software names, version numbers, functional modules, etc., such as "Enterprise Resource Planning (ERP) System V3.0 - Financial Module". At the same time, entity names are also affected by language habits and industry norms. In different industry fields, the naming methods of companies and systems vary greatly. For example, in the financial industry, company names may tend to reflect characteristics such as stability and professionalism; in the Internet industry, company names may be more innovative and trendy. System names in the medical industry may involve a large number of medical terms, and in the software development industry, there will be many technical terms and version numbering rules.

[0056] The processed original text information is labeled and divided into two categories: The processed original text information is manually marked. For example, "The enterprise resource planning (ERP) system deployed by XX Technology Co., Ltd. successfully passed the third-level information security protection assessment. This system integrates multiple module functions such as finance, procurement, and production, providing support for the efficient operation of XX Technology." In the report, "XX Technology Co., Ltd." is a company name and is labeled as the target entity; "enterprise resource planning (ERP) system" is a system name and is also labeled as the target entity. The BIO labeling method can be used. For example, "XX Technology Co., Ltd." is labeled as "B-COMPANY" (indicating the start of a company entity), "enterprise resource planning (ERP) system" is labeled as "B-SYSTEM" (indicating the start of a system entity), and other non-target words in the sentence are labeled as "O" (indicating non-entity). The original text information and the processed marked text are put into one-to-one correspondence and are overall divided into two parts: training set TXT1 (80%) and test set TXT2 (20%).

[0057] S3. Use the trained asset tokenizer to tokenize the said information security protection report to obtain the tokenization result.

[0058] In this embodiment, a random small part of the above original text information TXT is used to train the tokenizer. This step mainly includes:

[0059] Construct a dedicated network security term dictionary. Before training the tokenizer, these terms are pre-added to the vocabulary of the tokenizer.

[0060] Load the original RobertaTokenizer tokenizer and initialize other parameters according to the characteristics of the equal protection report. The original tokenizer itself has fixed parameters and attributes that can be set. Process specific symbol and format-related parameters: a. Punctuation handling: There may be some punctuation marks with specific uses in the equal protection report, such as semicolons, colons, etc. used to list security requirements, evaluation results, etc. b. Handling of special characters related to format: For example, in the equal protection report, specific bracket forms (such as square brackets for marking some supplementary explanations) and code block formats (if there are security configuration code examples, etc.) may be used to represent different text meanings. It can be processed by setting the additional_special_tokens attribute of the tokenizer. Handling of professional vocabulary and low-frequency words: a. Adjust the vocabulary frequency parameters: Since the equal protection report contains many network security professional vocabulary, some of which may have a relatively low frequency of occurrence in the pre-trained corpus but are high-frequency and important vocabulary in the equal protection scenario. The relevant parameters for word frequency statistics in the internal vocabulary of the tokenizer can be adjusted to make these professional vocabulary easier to be correctly tokenized and encoded. b. Set the handling strategy for unknown words (UNK): For some rare professional vocabulary that may appear in the equal protection report but are not in the pre-trained vocabulary and the added network security term dictionary, it is necessary to reasonably set the handling strategy when encountering unknown words. The unk_token (the token used to replace unknown words) of the tokenizer and related unknown word conversion rules can be configured, such as splitting unknown professional vocabulary into character levels for processing (by setting appropriate tokenization mode parameters, etc.).

[0061] Further process the processed training corpus txt file to make it suitable as training data; for example, split the text into sentences or paragraphs and perform tokenization on each sentence / paragraph. Use the tokenizer.tokenize() method to perform preliminary tokenization on the text, and then convert the tokenized result into an input format acceptable to the model (such as a sequence of token IDs and an attention mask);

[0062] Create a custom dataset class that inherits from torch.utils.data.Dataset (PyTorch is used in this embodiment). In this class, implement the len and getitem methods. The len method returns the size of the dataset (i.e., the number of sentences / paragraphs in the training corpus), and the getitem method returns the corresponding input data (such as a sequence of token IDs, an attention mask, and the corresponding label if there is a label) according to the index.

[0063] Fine-tune the training parameters and perform training: Determine parameters such as the number of epochs, learning rate, and batch size for training. For fine-tuning the tokenizer, the learning rate can be set relatively small, such as around 1e-5, to avoid over-adjusting the pre-trained parameters. The batch size can be selected according to the hardware resources and data scale, and generally, you can start trying from 32 or 64.

[0064] Input during training: Token ID sequence: After initially tokenizing the text (using the tokenizer.tokenize() method), each token is mapped to a unique ID, forming a token ID sequence. For example, for the sentence "Network security level protection assessment is very important", after tokenization, it may get tokens such as ["Network security", "Level", "Protection", "Assessment", "Very", "Important"], and each token corresponds to an ID in the vocabulary, and combined, it is the token ID sequence input to the model. The length of this sequence depends on the actual tokenization of the text and the previously set text length processing rules.

[0065] Attention Mask: Due to operations such as truncation and padding on the text, in order to let the model know which are the real tokens in the original text and which are the padded parts, an attention mask is generated. Its length is the same as the token ID sequence. The value corresponding to the position of the original text token is 1, indicating that the model needs to pay attention; the value corresponding to the padded position is 0, indicating that the model can ignore these positions when calculating attention. For example, if the length of the token ID sequence becomes 10 after padding for the above sentence (assuming some tokens are padded), the attention mask may be [1, 1, 1, 1, 1, 1, 0, 0, 0, 0], indicating that the first 6 are the tokens of the original text.

[0066] Output during training: In the custom dataset class, for the training data, the output is mainly based on the labels corresponding to the input data (if it is a supervised learning task, for example, for a named entity recognition task, the labels may be the entity categories corresponding to each token). If it is an unsupervised learning task, the output can be set according to the specific training objective. For example, when performing a task similar to pre-training a language model, the output may be the probability distribution of predicting the next token. Taking named entity recognition as an example, the output is a label sequence of the same length as the input token ID sequence, and each position annotates the named entity category to which the token belongs (such as the numbers corresponding to categories like device name, model, etc.).

[0067] Parameters such as the number of training epochs, learning rate, and batch size. The number of training epochs: Usually, it is necessary to determine the appropriate value through experiments. You can first select a small initial value, such as 3 - 5 epochs, and then observe the changes in performance metrics (such as loss function values, accuracy, etc.) of the model on the training set and the validation set (the divided test text part can be used as the validation set). If the performance of the model on the validation set continues to improve as the number of epochs increases, and there are no signs of overfitting (such as the performance on the validation set starts to decline, etc.), you can appropriately increase the number of epochs and continue training; conversely, if overfitting occurs or the performance improvement is not obvious, you need to stop training or reduce the number of epochs, readjust the parameters, and then train again.

[0068] Learning rate: For the case of fine-tuning the tokenizer, it is mentioned in the text that it can be set relatively small, such as around 1e - 5. This is an empirical value based on the fact that the pre-trained model already has good parameter bases to avoid excessive adjustment. In practice, a learning rate adjustment strategy can also be adopted, such as using a learning rate decay strategy, gradually reducing the learning rate as the number of training epochs increases. The specific decay coefficient, etc., can be determined by comparing the model performance under different values through multiple experiments. You can also refer to existing research or practical experience in similar network security text processing tasks to determine the appropriate initial learning rate range and then further fine-tune.

[0069] Batch size: Generally, it is selected according to hardware resources (such as the size of GPU video memory, etc., if GPU acceleration is used for training) and data scale. Start trying from a small value, such as 32 or 64 mentioned in the text. If the hardware resources permit, and there are positive changes in the performance metrics during the model training process (such as the training speed increases and the performance does not decline, etc.) after increasing the batch size, the batch size can be appropriately increased. However, too large a batch size may lead to problems such as unstable model training or overfitting, so it is also necessary to observe the performance of the validation set during the training process to adjust reasonably. At the same time, you can also refer to the recommended batch size range of the deep learning framework for different scales of data and models and make a selection in combination with the actual situation.

[0070] Use the trained asset tokenizer Tokenizer to tokenize and encode the training set TXT1 in the equal protection report for input into the model. It mainly includes: loading the trained RobertaTokenizer tokenizer; reading the processed text; tokenizing and encoding. Here, encoding can be understood as converting the words tokenized by the asset tokenizer into the digital representation form that the model can accept.

[0071] Specific encoding method:

[0072] First, use the tokenizer.tokenize() method to perform preliminary tokenization on the text, splitting the text into individual tokens according to the set tokenization rules.

[0073] Then, map these tokens to their corresponding token IDs through the tokenizer's vocabulary to form a sequence of token IDs. This is the key part of the encoding, which converts the text information into a numerical representation that the model can accept.

[0074] Meanwhile, combine the method of generating the attention mask mentioned above to generate a corresponding attention mask for the input sequence of token IDs, which is used to indicate the true content range of the text.

[0075] For labeled tasks (such as named entity recognition), it is also necessary to encode the corresponding label information of the text. Usually, different named entity categories are also mapped to numerical numbers to form a label sequence of the same length as the sequence of token IDs, so that the model can compare the prediction results and the true labels for learning during training.

[0076] Encoding results:

[0077] The obtained encoding results mainly include the sequence of token IDs, the attention mask, and the corresponding label sequence (if it is a supervised learning task). For example, for the text "The IP address of the server is 192.168.1.1, and the operating system running is Windows Server 2019" in an equal protection report, after encoding, the following results may be obtained (only for example, the actual situation depends on the vocabulary, etc.):

[0078] Sequence of token IDs: [123, 456, 789, 101, 112, 131, 145, 156, 167, 178] (each number corresponds to the number of a token in the vocabulary).

[0079] Attention mask: [1, 1, 1, 1, 1, 1, 1, 1, 1, 1] (assuming no padding in the text, all are real tokens).

[0080] Label sequence (if it is a named entity recognition task, assuming "server" belongs to the "device name" category with a number 1, "IP address" belongs to the "network information" category with a number 2, and so on): [1, 2, 0, 0, 0, 3, 0, 0, 0, 0] (0 indicates not belonging to the set labeled category, this is just a simple example). These encoding results can be used as the input data for model training.

[0081] S4. Input the tokenization result into the trained natural language processing model to obtain feature information and get the second asset information.

[0082] The encoded tokenization results are input and passed to the RoBERTa model (this model is selected as the natural language processing model in this embodiment) for processing. This step mainly includes:

[0083] The RobertaModel in the transformers library of Hugging Face can be used to obtain the output of the model; named entities of the tokens are extracted from the output sequence.

[0084] This step mainly inputs the encoded results of the tokenization results (token ID sequence and attention mask) to the RoBERTaModel (the model). Inside the model, a series of complex calculations are performed based on its pre-trained parameters and the self-attention mechanism of the Transformer architecture. Finally, a result containing two key pieces of information, the hidden state (Hidden States) and the pooled state (Pooled State), is output. The hidden state (usually in the shape of (batch_size, sequence_length, hidden_size)) contains detailed representations such as the semantic information of the input text at each position by the model. The pooled state (usually in the shape of (batch_size, hidden_size)) is a comprehensive and compressed representation of the input text. These output results will provide basic data support for subsequent steps such as extracting key information and further fine-tuning the natural language processing model.

[0085] Traverse in the order where the output result sequence corresponds one-to-one with the words (or tokens) in the input text. Taking the previously mentioned example text "The enterprise resource planning (ERP) system deployed by XX Technology Co., Ltd. successfully passed the third-level information security protection assessment. The system integrates multiple module functions such as finance, procurement, and production, providing support for the efficient operation of XX Technology." and its corresponding output sequence ["B-COMPANY","I-COMPANY","I-COMPANY","O","B-SYSTEM","I-SYSTEM","I-SYSTEM","I-SYSTEM","I-SYSTEM","O","O","O","O","O","O"] as an example:

[0086] When encountering the "B-COMPANY" tag, record the corresponding word as the beginning of the company name entity. Subsequently, as long as the "I-COMPANY" tags are continuously encountered, sequentially splice the corresponding words until a non-"COMPANY"-related tag (such as "O") is encountered. In this way, the company name entity "XX Technology Co., Ltd." can be completely extracted. Similarly, when seeing the "B-SYSTEM" tag, start recording the corresponding word as the beginning of the system name entity, and then sequentially splice the words corresponding to the consecutive "I-SYSTEM" tags to extract the system name entity "Enterprise Resource Planning (ERP) System".

[0087] After traversing the entire output sequence in this way, all the identified named entities can be extracted and transformed into an intuitively understandable Chinese expression form. After obtaining the output of the natural language processing model, this output is actually a feature representation form processed by the natural language processing model. The main task of the natural language processing model is named entity recognition. The output result of the natural language processing model is a sequence of many types of specific named entities, and then extract the required named entity types from it, such as device names, system names, etc. Extract key information from the output of the natural language processing model, such as company names, system names, platform names, device names, version numbers, etc. as part of the assets to be monitored to obtain the second asset information Final2.

[0088] Among them, the training process of the natural language processing model includes:

[0089] A1. Obtain the equal protection report training data. In this embodiment, a part of the equal protection report obtained above is selected as the equal protection report training data. It can be understood that a part is selected from the equal protection report as the label data for training the natural language processing model.

[0090] A2. Use the trained asset tokenizer to tokenize the equal protection report training data to obtain the tokenized result training data.

[0091] A3. Input the tokenized result training data into the natural language processing model to obtain feature information, and obtain the second asset information training data; the bottom layer of the natural language processing model is frozen; a fully connected layer is connected after the last layer of the natural language processing model; an activation function is added after the fully connected layer.

[0092] A4. Compare the second asset information training data with the equal protection report training data to obtain model adjustment information; the model adjustment information includes: accuracy information, F1 score information, and mean average precision information.

[0093] In this embodiment, various evaluation metrics are used to evaluate the output results of the model. They mainly include:

[0094] The model is evaluated using evaluation metrics such as accuracy, F1 score, and mean average precision (mAP), and iterative optimization is performed based on the evaluation results to ensure continuous improvement of the model performance.

[0095] Accuracy: Accuracy refers to the proportion of the number of samples correctly predicted by the model (including correctly identified entities and cases correctly judged as non-entities) to the total number of samples. In the scenario where the RoBERTa model is used for named entity recognition, it can intuitively reflect the overall correct prediction ability of the model. For example, in a sample set of 100 samples that need to be recognized for named entities, if the model correctly identifies the named entities in 70 samples and correctly judges that there are no named entities in the other 30 samples, then the accuracy is 70%.

[0096]

[0097] F1 Score: The harmonic mean of precision and recall, which comprehensively considers precision and recall.

[0098]

[0099] Example: If the precision is 0.8 and the recall is 0.75, then the F1 score is 0.774.

[0100] Among them: TP (True Positives): True positive examples, that is, the number of entities correctly identified by the model. For example, in the asset security monitoring application, it is the number of actual asset names that are correctly identified as asset names by the model. TN (True Negatives): True negative examples, that is, the number of cases where the model correctly judges as not being an entity. For example, for the part of the text that is not a named entity, the number of cases where the model correctly does not identify it as a named entity. FP (False Positives): False positive examples, that is, the number of non-entities misidentified as entities by the model. For example, the number of ordinary text contents misidentified as asset names. FN (False Negatives): False negative examples, that is, the number of entities misidentified as non-entities by the model. For example, the actual asset model number that the model fails to identify. Mean Average Precision (mAP): In the multi-class named entity recognition task, mean average precision is an effective evaluation metric. It first calculates the average precision (AP) for each class (such as different types of asset information classes), and then takes the average of all classes to obtain mAP. Average precision takes into account the area under the precision-recall curve and can comprehensively evaluate the precision performance of the model at different recall rate levels.

[0101] For a single class c, where P c (r) is the precision of class c at recall rate r.

[0102]

[0103] where N is the total number of classes.

[0104] A5. Adjust the parameters of the natural language processing model according to the model adjustment information to obtain a trained natural language processing model.

[0105] Fine-tune the model according to the model adjustment information (evaluation metric) to make the output result better, such as adding a specific task layer and adjusting the model parameters. It can also be organized into a custom dataset and use this dataset to retrain the RoBERTa model to improve the performance of the model in this field. It mainly includes:

[0106] Adjusting the RoBERTa model when the accuracy is low: Observe whether the model is too complex and overfitting. If so, the model architecture can be appropriately simplified. For the RoBERTa model, consider reducing the number of fine-tuned layers (e.g., only fine-tuning the last few layers) or decreasing the dimension of the hidden layer. At the same time, add regularization terms to prevent the model from overfitting the training data. During the fine-tuning process, control the complexity of the model by adjusting the regularization parameters to improve the accuracy. In addition, the learning rate and batch size can also be adjusted: Try different combinations of learning rates and batch sizes. A smaller learning rate may cause the model to converge too slowly but helps avoid skipping the optimal solution; a larger learning rate may lead to model instability. You can start with a smaller learning rate (such as 5e-5) and observe the change in the accuracy of the model on the validation set and gradually adjust. The batch size also affects the stability and speed of model training. By experimenting with different batch sizes (such as 16, 32, 64, etc.), find the combination that is most suitable for model training to improve the accuracy.

[0107] Adjusting the RoBERTa model when the F1 Score is low: The RoBERTa model can be fine-tuned at a deeper level by adding additional feature extraction layers (such as multi-head attention layers), enabling the model to better capture the semantic and context features of entities, thereby improving the recall rate while also ensuring the accuracy, and thus enhancing the F1 score.

[0108] Adjusting the RoBERTa model when the mean average precision (mAP) is low: Adjust the loss function and output layer: During the fine-tuning process of the RoBERTa model, use a loss function suitable for multi-class classification, such as the multi-class cross-entropy loss function. At the same time, adjust the dimension of the output layer according to the number of entity categories to ensure that the model can output a reasonable class probability distribution. Some auxiliary modules, such as a Softmax layer, can be added after the output layer to handle the multi-class probability output, enabling the model to more accurately predict entities in each category and improve the mAP.

[0109] Freeze some layers: Freeze the first few layers (usually the bottom layers) of the pre-trained model and only train the last few layers. This can retain the general feature extraction ability of the model while adapting to the requirements of specific tasks.

[0110] Construct a fully connected layer: Add a fully connected layer after the last layer of the RoBERTa model. Taking the identification of N named entity categories such as asset name, model number, serial number, usage status, etc. as an example, the input dimension of the fully connected layer should match the hidden layer dimension output by the RoBERTa model, and the output dimension is set to N. Assuming that the hidden layer dimension output by the RoBERTa model is d, the parameter matrix W of the fully connected layer has a shape of d×N, and the bias vector b has a length of N. For the RoBERTa output vector x corresponding to each word in the input sequence, the calculation of the fully connected layer is y = Wx + b, where y is a vector with a length of N, representing the prediction scores of the word belonging to N named entity categories.

[0111] Select an activation function: Add an appropriate activation function after the fully connected layer. For example, for a multi-class classification task, use the softmax activation function. The softmax function can convert the scores output by the fully connected layer into a probability distribution for each category. That is, for the output vector y = [y1, y2, y3, y4], the probability vector p = [p1, p2, p3, p4] obtained after being processed by the softmax function, where In this way, p i represents the probability that the word belongs to the i-th named entity category

[0112] S5. Input the second asset information into the asset mapping platform for asset sorting to obtain the third asset information.

[0113] In this embodiment, the extracted second asset information Final2 is expanded, such as company name, application name, etc., and is input into the asset mapping platform according to the classification for comprehensive asset sorting, mainly including:

[0114] Extract the API interfaces of the four major asset mapping platforms, such as Fofa, Hunter, Zoomeye, and Shadon.

[0115] The asset information, the second asset information Final2, extracted from the model output is classified and transmitted to the mapping platform. These API interfaces are the proprietary interfaces of the four major asset mapping platforms. Users can query asset information through these API interfaces. Just like searching for "xx company" on Baidu, Baidu returns all the Web sites of "xx company", which is a manual operation, but it can be called through the API interface, and the script automatically executes the operation to obtain the desired return information, which is the required asset information.

[0116] Obtain the return result of the mapping platform, the third asset information Final3. Similar to the above example, it is to call the platform interface according to the search syntax of the four mapping platforms and the rules of platform API calls to obtain the return result. These return results are the asset information Final3, mainly asset information such as ip, port, and url, which is an expansion of the number of assets to be monitored; the acquisition form is mainly to construct a data packet according to the API interface rules and send it to the mapping platform, and the mapping platform returns the data packet, which contains additional asset information.

[0117] S6. Merge and deduplicate the first asset information, the second asset information, and the third asset information to obtain the merged asset information.

[0118] S7. Input the merged asset information into the vulnerability scanning platform; the vulnerability scanning platform is used to perform regular scanning and change monitoring on the merged asset information.

[0119] In this embodiment, the integrated text regular matching data, the first asset information Final1, the model extraction data, the second asset information Final2, and the mapping platform data, the third asset information Final3 are the final asset sorting data FinalData. The main steps include:

[0120] Read the first asset information Final1 of the text regular matching data, the second asset information Final2 of the model extraction data, and the third asset information Final3 of the mapping platform data.

[0121] Merge, deduplicate, and convert it into CSV (Comma-Separated Values) data for storage.

[0122] Then, use the PoC in the vulnerability library to perform regular scanning and change monitoring on the asset data. It mainly consists of the following parts:

[0123] Upload the CSV asset data to the vulnerability scanning platform to perform vulnerability scanning for specific versions of vulnerabilities, and start the asset vulnerability scanning twice a day. The vulnerability scanning platform is an abbreviation for a class of tools. Here, it refers to a self-developed vulnerability scanning platform, which has various types of vulnerability detection scripts for various objects, such as detection scripts for sql vulnerabilities of xxx systems, detection scripts for xxe vulnerabilities of xxx systems, and detection scripts for cors vulnerabilities of xxxx platforms. Input all the Web assets or ip server host assets (Final3) that can be collected by a certain company obtained above into the vulnerability scanning platform, and the platform calls all scripts to scan these platforms and returns the result of whether there is a certain vulnerability.

[0124] Hash the core web files, regularly monitor the changes in the hash values, and if there are any changes, send an alarm in a timely manner and automatically send an alarm email to relevant security personnel.

[0125] In this embodiment, it can be pushed to the email of the security administrator of the vulnerability scanning platform and the email of the asset owner, so that it can be pushed to the person who has a vulnerability in a certain company; the core web files of the website can be judged by oneself or specified by the security administrator of a certain company. Usually, it may be the pages of party and government publicity, notices and announcements, etc.

[0126] Hashing is to calculate a file using a hashing algorithm to obtain a digest value. If the file changes, the calculated digest value will change.

[0127] Use the training text to train the model until the evaluation metrics of the large model reach an ideal level. After the large model fine-tuning is completed, the large model can be called to extract assets from the test text and then perform asset security monitoring.

[0128] This embodiment is compared with the current research work, and its innovative points are reflected in the following two aspects:

[0129] (1) The research / technology on large model fine-tuning mainly focuses on question answering systems and text generation. There is still a lack of relevant research / technology on assets that use large models for logical reasoning and judgment based on natural language understanding.

[0130] (2) The research / technology on large models in the field of network security mainly uses pre-trained models directly, lacking research / technology on fine-tuning large models to adapt to vertical tasks.

[0131] In another exemplary embodiment, please refer to Figure 3 , a method for asset security monitoring is given, and the process of building a large model for detecting the quality of the equal protection report is as follows:

[0132] (1) Convert the equal protection report detection requirements into a standard process.

[0133] (2) Extract relevant documents from the local storage database, unify the documents and convert them into txt text. Preprocess the text and divide it into training text and test text. To ensure that the number of data in different categories is relatively balanced, some data are manually reconstructed for categories with less data.

[0134] (3) Use the training set and add a vocabulary to train the analyzer.

[0135] (4) Use the training set to train the large model. After model fine-tuning and model evaluation, the model is repeatedly optimized according to the evaluation results.

[0136] (5) Deliver the extracted assets to the asset mapping platform for asset mapping and build comprehensive asset information.

[0137] (6) Monitor the vulnerabilities of asset information and the tampering of important pages, and send email alerts.

[0138] Among them, as a specific implementation, the following specific steps may be included:

[0139] 1. Use the python-docx library or docx2txt library of Python to complete text conversion.

[0140] 2. Use the re library of Python to perform regular expression processing on the converted text.

[0141] 3. Use the tokenizer of RoBERTa to tokenize and encode the text for input into the model.

[0142] 4. Some data can be manually constructed to balance the data volume of each category, and then the training set and test set are randomly divided.

[0143] 5. Fine-tune the RoBERTa model using the training set.

[0144] 6. Use the test set to evaluate the fine-tuned large model, and repeatedly optimize the model according to the results of the evaluation metrics until the evaluation metrics reach the expected level.

[0145] 7. Construct the equal protection report to be tested, input it to the large model for determination, and then check whether there are errors in the detection data according to the output result of the model.

[0146] 8. Classify the assets extracted from the report, including IP addresses, URLs, and ICONs, and input them to different asset mapping platforms, such as Fofa, Hunter, Zoomeye, etc. for secondary asset collection.

[0147] 9. Summarize the results of the text regular matching data Final1, the model extraction data Final2, and the mapping platform data Final3, and perform deduplication and classification.

[0148] 10. Upload the CSV assets for regular vulnerability scanning.

[0149] 11. Anti-tampering verification of important pages.

[0150] 12. Email alerts for abnormal information.

[0151] In an exemplary embodiment, a computer device is provided. The computer device can be a server or a terminal, and its internal structure diagram can be as Figure 4As shown in the figure. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O), and a communication interface. Among them, the processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it implements a method for asset security monitoring.

[0152] Those skilled in the art can understand that Figure 4 the structure shown in the figure is only a block diagram of some structures related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0153] In an exemplary embodiment, a computer device is further provided, including a memory and a processor. A computer program is stored in the memory, and when the processor executes the computer program, the steps in the above method embodiments are implemented.

[0154] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by the processor, the steps in the above method embodiments are implemented.

[0155] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by the processor, the steps in the above method embodiments are implemented.

[0156] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant regulations.

[0157] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, database, or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memories. Non-volatile memories can include read-only memory (ROM), magnetic tapes, floppy disks, flash memories, optical memories, high-density embedded non-volatile memories, resistive random access memories (ReRAM), magnetoresistive random access memories (MRAM), ferroelectric random access memories (FRAM), phase change memories (PCM), graphene memories, etc. Volatile memories can include random access memory (RAM) or external cache memories, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0158] The databases involved in the embodiments provided in the present application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., without limitation. The processors involved in the embodiments provided in the present application can be general-purpose processors, central processors, graphics processors, digital signal processors, programmable logics, data processing logics based on quantum computing, etc., without limitation.

[0159] The technical features of the above embodiments can be combined arbitrarily. For the sake of concise description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0160] Specific examples are used in this article to elaborate on the principles and implementation manners of the present application. The descriptions of the above embodiments are only used to help understand the method and its core idea of the present application; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to the present application.

Claims

1. A method for asset security monitoring, characterized in that The method for asset security monitoring includes: Obtaining an equal protection report; Extracting asset information from the equal protection report by means of a regular expression method to obtain first asset information; Using the trained asset tokenizer to tokenize the equal protection report to obtain a tokenization result; Inputting the tokenization result into the trained natural language processing model to obtain feature information and getting second asset information; Inputting the second asset information into an asset mapping platform for asset sorting to obtain third asset information; Merging and deduplicating the first asset information, the second asset information and the third asset information to obtain merged asset information; Inputting the merged asset information into a vulnerability scanning platform; the vulnerability scanning platform is used for regularly scanning and change monitoring of the merged asset information.

2. The method for asset security monitoring according to claim 1, characterized in that The training process of the natural language processing model includes: Obtaining equal protection report training data; Using the trained asset tokenizer to tokenize the equal protection report training data to obtain tokenization result training data; Inputting the tokenization result training data into the natural language processing model to obtain feature information and getting second asset information training data; the underlying layer of the natural language processing model is frozen; a fully connected layer is connected after the last layer of the natural language processing model; an activation function is added after the fully connected layer; Comparing the second asset information training data with the equal protection report training data to obtain model adjustment information; the model adjustment information includes: accuracy information, F1 score information and mean average precision information; Adjusting the parameters of the natural language processing model according to the model adjustment information to obtain the trained natural language processing model.

3. The method for asset security monitoring according to claim 1, wherein, Inputting the second asset information into an asset mapping platform for asset sorting to obtain third asset information, specifically including: Obtaining the API interfaces of four major asset mapping platforms; Classifying and inputting the second asset information into the API interfaces for asset information expansion to obtain third asset information.

4. The method for asset security monitoring according to claim 1, wherein, Inputting the merged asset information into a vulnerability scanning platform for regular scanning and change monitoring, specifically including: Converting the merged asset information into a CSV data format to obtain format-converted asset information; Inputting the format-converted asset information into the vulnerability scanning platform for regular asset vulnerability scanning; Regularly calculating the hash value of the web page files in the format-converted asset information; When the hash value of the web page file changes, sending an alarm message to the email of the corresponding asset owner; the information of the corresponding asset owner of the web page file is included in the merged asset information.

5. The method for asset security monitoring according to claim 1, characterized in that, The training process of the asset tokenizer includes: Obtaining a network security term dictionary and equal protection report tokenization training data; Storing the network security term dictionary into the vocabulary of the tokenizer; Combining the network security term dictionary and using the equal protection report tokenization training data to train the tokenizer to obtain an asset tokenizer.

6. The method for asset security monitoring according to claim 1, wherein, The extracting of the asset information from the equal protection report by means of a regular expression method specifically includes: Converting the table content in the equal protection report into text lines separated by a specific delimiter to obtain a text equal protection report; Filter the noise information in the text equal protection report by using a preset definition rule to obtain a noise-free equal protection report; Extract the asset information in the noise-free equal protection report by means of a regular expression method.

7. The method for asset security monitoring according to claim 6, wherein The filtering of the noise information in the text equal protection report by using a preset definition rule to obtain a noise-free equal protection report specifically includes: Use regular expressions to match and delete legal clause references, chart numbers, and annotations in a specific format.

8. A computer device, comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the asset security monitoring method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the asset security monitoring method according to any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the asset security monitoring method according to any one of claims 1-7.

Images