Semantic and syntactic fused power system threat entity relationship extraction method and system

Abstract

The invention provides a semantic and syntactic fused power system threat entity relationship extraction method and system, and the method comprises the following steps: constructing a threat intelligence graph ontology model comprising an entity type and a relationship type of a power system based on a novel power system attack behavior modeling demand; extracting an action relationship from the threat intelligence text through semantic role labeling; extracting a structural relationship from the threat intelligence text through syntactic dependency analysis; and mapping the action relationship and the structure relationship to the constructed threat intelligence graph ontology model, constructing a standardized triple structure, and providing structured entity relationship data for constructing a novel power system threat knowledge graph. According to the method, semantic analysis and syntactic analysis are fused, the power system threat entity relation is accurately extracted, the threat intelligence graph construction is directly supported through ontology model standardized mapping, data dependence reduction and generation of a standardized triple structure, and the method is suitable for data scarcity scenes.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security and natural language processing technology, and specifically to a method and system for extracting power system threat entity relationships by integrating semantics and syntax. Background Art

[0002] With the continuous development of smart grids and new power systems, the connection between cyberspace, physical space, and social space is becoming increasingly close. In this context, power systems have become a key target for complex attacks such as advanced persistent threats (APTs). Threat intelligence graphs, as a means of integrating knowledge representation and attack modeling, can effectively support attack tracing and defense analysis. Accurately extracting threat entity relationships is a key prerequisite for constructing intelligence graphs.

[0003] Currently, mainstream relationship extraction methods include template-based matching, traditional machine learning, and deep learning. Deep learning models such as BERT and BiLSTM perform well in general domains, but they rely heavily on large-scale annotated data and lack the ability to recognize non-action relationships and grammatically complex sentences. Furthermore, while syntactic analysis techniques can extract some semantic structure, they have not been fully integrated into entity relationship modeling in security contexts. Summary of the Invention

[0004] The present application provides a semantically and syntactically integrated power system threat entity relationship extraction method and system, which can solve the technical problems existing in the prior art, such as strong data dependency, insufficient recognition of non-action relationships, and limited ability to parse grammatically complex statements.

[0005] In a first aspect, the present application provides a method for extracting power system threat entity relationships by integrating semantics and syntax, comprising the following steps: Based on the requirements for modeling new power system attack behaviors, a threat intelligence graph ontology model including entity types and relationship types of the power system is constructed; Extract action relationships from threat intelligence text through semantic role annotation; Extract structural relationships from threat intelligence text through syntactic dependency analysis; Map action relationships and structural relationships to the constructed threat intelligence graph ontology model, build a standardized triple structure, and provide structured entity relationship data for building a new power system threat knowledge graph.

[0006] Furthermore, based on the modeling requirements of the new power system attack behavior, a threat intelligence graph ontology model including entity types and relationship types of the power system is constructed, which specifically includes the following steps: Based on the common entity types defined in the UCO and DNRTI datasets, the power system-specific entity types are expanded to construct entity types for power system threat intelligence analysis. Define the relationship types between entity types, including action-type relationships and non-action-type relationships, and determine the entity type constraints for each relationship; Combining entity types and relationship types between entity types, a threat intelligence graph ontology model is constructed.

[0007] Furthermore, extracting action relationships from threat intelligence text through semantic role annotation specifically includes the following steps: Perform semantic role annotation on threat intelligence text, identify the semantic roles of each entity, including agent, patient, and instrumental roles, and generate annotation results containing the core semantic structure; The subject-predicate-object triples are parsed from the annotation results, where the subject corresponds to the agent entity, the object corresponds to the recipient entity, and the predicate action corresponds to the relationship connection between entities, thereby extracting the semantic action relationship in the threat intelligence text.

[0008] Furthermore, the action relationship includes at least a usage relationship, an attack target relationship, and a purpose-driven relationship.

[0009] Furthermore, extracting structural relationships from threat intelligence text through syntactic dependency analysis specifically includes the following steps: Parse the input threat intelligence text, construct a syntactic dependency tree, and identify syntactic dependency analysis results such as coordination, modification, and prepositional phrases; Extract the syntactic structural relations in threat intelligence text from the syntactic dependency analysis results.

[0010] Furthermore, the step of parsing the input threat intelligence text and constructing a syntactic dependency tree specifically includes the following steps: A syntactic dependency tree is constructed with the core word as the root node, where each word has one and only one parent node, and the dependency relationship between a word and its parent node word is the edge between the two.

[0011] Furthermore, the structural relationship includes at least an organizational association relationship, a feature inclusion relationship, and a geographical location relationship.

[0012] Furthermore, the mapping of action relationships and structural relationships to the constructed threat intelligence graph ontology model, constructing a standardized triple structure, and providing structured entity relationship data for constructing a new power system threat knowledge graph specifically includes the following steps: A mapping mechanism based on word vector similarity is used to calculate the vector similarity between the predicate actions extracted from semantic role annotation and the predefined relationship types in the threat intelligence graph ontology; Select the best matching relationship type that meets the entity type constraint and whose vector similarity exceeds the preset threshold, replace the original predicate action, and obtain the action relationship mapping result; Based on the syntactic dependency analysis results, combined with contextual semantics and entity type constraints, non-action structural relationships are mapped to the relationship types defined in the ontology model to obtain structural relationship mapping results; By fusing the action relationship mapping results and the structure relationship mapping results, a standardized triple structure is generated, providing structured entity relationship data for constructing a new power system threat knowledge graph.

[0013] In a second aspect, the present application provides a power system threat entity relationship extraction system that integrates semantics and syntax, including: A threat intelligence graph ontology model construction module is used to build a threat intelligence graph ontology model that includes entity types and relationship types of the power system based on the requirements of modeling new power system attack behaviors; Action relationship extraction module, used to extract action relationships from threat intelligence text through semantic role annotation; Structural relationship extraction module, used to extract structural relationships from threat intelligence text through syntactic dependency analysis; The entity relationship acquisition module is in communication with the threat intelligence graph ontology model construction module, the action relationship extraction module and the structural relationship extraction module, and is used to map the action relationship and structural relationship to the constructed threat intelligence graph ontology model, construct a standardized triple structure, and provide structured entity relationship data for constructing a new power system threat knowledge graph.

[0014] Furthermore, the threat intelligence graph ontology model construction module includes: The entity type acquisition unit is used to expand the power system-specific entity types based on the common entity types defined in the UCO and DNRTI datasets, and to construct entity types for power system threat intelligence analysis; The relationship type acquisition unit defines the relationship type between each entity type, including action-type relationships and non-action-type relationships, and determines the entity type constraints of each relationship; The threat intelligence graph ontology model construction unit is communicatively connected to the entity type acquisition unit and the relationship type acquisition unit, and is used to construct a threat intelligence graph ontology model by combining entity types and relationship types between entity types.

[0015] The beneficial effects of the technical solutions provided in the embodiments of the present application include at least: Through the integrated application of semantic role labeling and syntactic dependency analysis, comprehensive extraction of power system threat entity relationships is achieved. Among them, semantic role labeling accurately captures the explicit action relationships in the text, while syntactic dependency analysis effectively identifies implicit structural relationships. The extracted structural relationships and action relationships are standardized and mapped through the predefined threat intelligence graph ontology model, which not only ensures the accuracy of entity relationship extraction, but also significantly reduces the dependence on large-scale annotated data, avoids the dependence of intelligent relationship extraction methods on data scale, and makes up for the limitations of existing relationship extraction methods combined with syntactic analysis on non-action relationship extraction. The final generated standardized triple structure can be directly used for threat intelligence graph construction, providing reliable knowledge support for power system security analysis, especially suitable for complex security scenarios with scarce data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a method for extracting power system threat entity relationships by integrating semantics and syntax provided in an embodiment of the present application; Figure 2 This is an overall flow chart of the relationship extraction method provided in the embodiment of the present application; Figure 3 A schematic diagram of the structure of a novel power system threat intelligence graph ontology model provided in an embodiment of the present application; Figure 4 A schematic diagram of the fusion of semantic roles and syntactic dependencies provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit the "first", "second" and "third" to different types.

[0019] In the description of the embodiments of this application, the words "exemplary," "for example," or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary," "for example," or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary," "for example," or "for example" is intended to present the relevant concepts in a concrete manner.

[0020] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0021] In some processes described in the embodiments of the present application, multiple operations or steps are included that appear in a specific order. However, it should be understood that these operations or steps may not be performed in the order in which they appear in the embodiments of the present application or may be performed in parallel. The sequence numbers of the operations are only used to distinguish between different operations, and the sequence numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations or steps may be performed in sequence or in parallel, and these operations or steps may be combined.

[0022] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0023] First, as Figure 1-Figure 2 As shown, the present application provides a semantic and syntactic fusion power system threat entity relationship extraction method, comprising the following steps: Step S1: Based on the modeling requirements of new power system attack behaviors, a threat intelligence graph ontology model including entity types and relationship types of the power system is constructed; Step S2: Extract action relations from threat intelligence text through semantic role annotation; Step S3: Extracting structural relationships from threat intelligence text through syntactic dependency analysis; Step S4: Map the action relationship and structural relationship to the constructed threat intelligence graph ontology model, build a standardized triple structure, and provide structured entity relationship data for building a new power system threat knowledge graph.

[0024] This application achieves comprehensive extraction of entity relationships of power system threats through the integrated application of semantic role labeling and syntactic dependency analysis. Semantic role labeling accurately captures explicit action relationships in text, while syntactic dependency analysis effectively identifies implicit structural relationships. The extracted structural relationships and action relationships are standardized and mapped through a predefined threat intelligence graph ontology model. This not only ensures the accuracy of entity relationship extraction, but also significantly reduces the dependence on large-scale annotated data, solving the data dependency and relationship omission problems of existing relationship extraction methods. The resulting standardized triple structure can be directly used for threat intelligence graph construction, providing reliable knowledge support for power system security analysis, and is particularly suitable for complex security scenarios with scarce data.

[0025] In one embodiment, step S1: constructing a threat intelligence graph ontology model including entity types and relationship types of the power system based on the new power system attack behavior modeling requirements, specifically includes the following steps: Step S11: Based on the common entity types defined in the UCO and DNRTI datasets, we extend the power system-specific entity types to construct entity types for power system threat intelligence analysis, such as attackers, targets, and means. Specifically, based on UCO and combined with the DNRTI dataset, we define the entity types included in the threat intelligence graph. Considering the potential for unique entity types in the new power system, we further introduce the power system entity types System, Device, and Event stored in the new power system knowledge base, resulting in 15 entity types, as shown in Table 1.

[0026] Table 1 Entity types and their meanings

[0027] Step S12: Define the relationship types between each entity type, including action-based and non-action-based relationships such as attack, trigger, communication, and impact, as shown in Table 2. Entity type constraints are also determined for each relationship, and the legal subject and object types of all relationships are clearly defined. This structured constraint not only conforms to the possible relationships between different threat entities within the threat intelligence graph but also avoids relationship matching errors caused by entity type ambiguity. In subsequent relationship extraction, entity type constraints can be used to restrict the relationships between threat entities to a certain subset of entity relationships, thereby reducing the possible relationship categories and better matching the relationships between threat entities, as shown in Table 3. Table 2 Relationship types and meanings

[0028] Table 3 Subject type and object type constraints of entity relationships

[0029] Step S13: Combine entity types and relationship types between entity types to construct a threat intelligence graph ontology model, such as Figure 3 shown.

[0030] In one embodiment, after step S1 of constructing a threat intelligence graph ontology model including entity types and relationship types of the power system based on the new power system attack behavior modeling requirements, the following steps are further included: The threat intelligence text of the power system is obtained and preprocessed to obtain the preprocessed threat intelligence text for subsequent extraction of action relationships and structural relationships based on steps S2 and S3.

[0031] Figure 4 The relationship extraction method based on semantic role labeling and syntactic dependency analysis is demonstrated, corresponding to steps S2 and S3 respectively.

[0032] In one embodiment, step S2: extracting action relationships from threat intelligence text through semantic role annotation specifically includes the following steps: Step S21: By determining the region where the threat entity is located, a practical role annotation tool (such as the PropBank model) is used to perform semantic role annotation on the threat intelligence text. The semantic roles of each entity in the threat intelligence text, including agent, patient, and instrumental roles, are identified, and an annotation result containing the core semantic structure is generated. Step S22: Parse the subject-verb-object triples from the annotation results. The subject corresponds to the agent entity, the object corresponds to the recipient entity, and the predicate-action corresponds to the relationship connection between the entities. This extracts the semantic action relationships within the threat intelligence text. These action relationships include at least usage relationships, attack target relationships, and purpose-driven relationships, such as an attacker launching an attack on a target or a tool achieving a certain goal. If an entity pair is located on the agent and recipient sides of an action, they can be considered to be connected by a predicate-action, thereby obtaining a threat entity pair and the action relationship between them.

[0033] In one embodiment, step S3: extracting structural relationships from the threat intelligence text through syntactic dependency analysis specifically includes the following steps: Step S31: Use a syntactic dependency analysis tool to parse the input threat intelligence text, construct a syntactic dependency tree, identify parallelism, modifiers, and prepositional phrases in the threat intelligence text, perform relationship chain matching, and extract syntactic dependency analysis results. The process of parsing the input threat intelligence text and constructing the syntactic dependency tree specifically includes the following steps: Syntactic dependency analysis is a sentence analysis method based on syntactic structure. It analyzes sentence structure by identifying the relationship between each word in the sentence and constructs a syntactic dependency tree with the core word as the root node. Each word has only one parent node, which represents the subject to which the word belongs. The dependency relationship between a word and its parent node is the edge between the two. The dependency relationship includes the relationship between subject, object, adjective modification, etc. Step S32: Extract the structural relationship of the syntax in the threat intelligence text from the syntactic dependency analysis results. The structural relationship includes at least organizational association relationship, feature inclusion relationship and geographic location relationship, to make up for the shortcomings of action relationship and identify structural dependency relationships of non-explicit relationships such as "control relationship between attackers and malware" and "connection relationship between system components".

[0034] In one embodiment, relationship mapping and conflict resolution are performed based on a predefined power system threat intelligence ontology model to ultimately generate standardized triples without redundancy. Step S4: mapping action relationships and structural relationships to the constructed threat intelligence graph ontology model, constructing a standardized triple structure, and providing structured entity relationship data for constructing a new power system threat knowledge graph specifically includes the following steps: Step S41: Using a mapping mechanism based on word vector similarity, calculate the vector similarity between the predicate action extracted from the semantic role annotation and the predefined relationship types (such as "attack", "control", "use", etc.) in the threat intelligence graph ontology. Select the best matching relationship type that meets the entity type constraint and whose vector similarity exceeds the preset threshold, and replace the original predicate action to obtain the action relationship mapping result; Step S42: Based on the syntactic dependency analysis results, combined with contextual semantics and entity type constraints, the non-action structural relationships are mapped to the relationship types defined in the ontology model to obtain structural relationship mapping results; Step S43: The action relationship mapping results and the structure relationship mapping results are integrated to generate non-redundant standardized triples (such as (APT organization, usage, vulnerability CVE-2023-XXX)), providing structured entity relationship data for constructing a new power system threat knowledge graph.

[0035] In a second aspect, the present application provides a power system threat entity relationship extraction system that integrates semantics and syntax, including: A threat intelligence graph ontology model construction module is used to build a threat intelligence graph ontology model that includes entity types and relationship types of the power system based on the requirements of modeling new power system attack behaviors; Action relationship extraction module, used to extract action relationships from threat intelligence text through semantic role annotation; Structural relationship extraction module, used to extract structural relationships from threat intelligence text through syntactic dependency analysis; The entity relationship acquisition module is in communication with the threat intelligence graph ontology model construction module, the action relationship extraction module and the structural relationship extraction module, and is used to map the action relationship and structural relationship to the constructed threat intelligence graph ontology model, construct a standardized triple structure, and provide structured entity relationship data for constructing a new power system threat knowledge graph.

[0036] In one embodiment, the threat intelligence graph ontology model construction module includes: The entity type acquisition unit is used to expand the power system-specific entity types based on the common entity types defined in the UCO and DNRTI datasets, and to construct entity types for power system threat intelligence analysis; The relationship type acquisition unit defines the relationship type between each entity type, including action-type relationships and non-action-type relationships, and determines the entity type constraints of each relationship; The threat intelligence graph ontology model construction unit is communicatively connected to the entity type acquisition unit and the relationship type acquisition unit, and is used to construct a threat intelligence graph ontology model by combining entity types and relationship types between entity types.

[0037] Among them, the functional implementation of each module in the above-mentioned semantic and syntactic fusion power system threat entity relationship extraction system corresponds to the various steps in the above-mentioned semantic and syntactic fusion power system threat entity relationship extraction method embodiment, and their functions and implementation processes will not be repeated here one by one.

[0038] In a third aspect, an embodiment of the present application provides a semantically and syntactically integrated power system threat entity relationship extraction device. The semantically and syntactically integrated power system threat entity relationship extraction device can be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0039] Communication interfaces include input / output (I / O), physical, and logical interfaces, used to interconnect components within the power system threat entity relationship extraction device, achieving semantic and syntactic fusion. They also connect the device to other devices (such as other computing devices or user devices), achieving semantic and syntactic fusion. Physical interfaces can include Ethernet, fiber, or ATM interfaces; user devices can include displays and keyboards.

[0040] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0041] The processor may be a general-purpose processor that can invoke a semantically and syntactically integrated power system threat entity relationship extraction program stored in a memory and execute the semantically and syntactically integrated power system threat entity relationship extraction method provided in the embodiments of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the semantically and syntactically integrated power system threat entity relationship extraction program is invoked can be found in the various embodiments of the semantically and syntactically integrated power system threat entity relationship extraction method of the present application and will not be further described here.

[0042] In a fourth aspect, an embodiment of the present application also provides a readable storage medium.

[0043] The readable storage medium of the present application stores a semantically and syntactically integrated power system threat entity relationship extraction program, wherein when the semantically and syntactically integrated power system threat entity relationship extraction program is executed by a processor, the steps of the semantically and syntactically integrated power system threat entity relationship extraction method as described above are implemented.

[0044] Among them, the method implemented when the semantic and syntactic fusion power system threat entity relationship extraction program is executed can refer to the various embodiments of the semantic and syntactic fusion power system threat entity relationship extraction method of this application, and will not be repeated here.

[0045] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0046] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above and includes a number of instructions for enabling a terminal device to execute the methods described in each embodiment of this application.

[0047] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A semantic and syntactic fusion power system threat entity relationship extraction method, characterized by: The following steps are involved: Based on the requirements for modeling new power system attack behaviors, a threat intelligence graph ontology model including entity types and relationship types of the power system is constructed; Extract action relationships from threat intelligence text through semantic role annotation; Extract structural relationships from threat intelligence text through syntactic dependency analysis; Map action relationships and structural relationships to the constructed threat intelligence graph ontology model, build a standardized triple structure, and provide structured entity relationship data for building a new power system threat knowledge graph.

2. The semantic and syntactic fusion power system threat entity relationship extraction method according to claim 1 is characterized in that: The construction of a threat intelligence graph ontology model including entity types and relationship types of the power system based on the new power system attack behavior modeling requirements specifically includes the following steps: Based on the common entity types defined in the UCO and DNRTI datasets, the power system-specific entity types are expanded to construct entity types for power system threat intelligence analysis. Define the relationship types between entity types, including action-type relationships and non-action-type relationships, and determine the entity type constraints for each relationship; Combining entity types and relationship types between entity types, a threat intelligence graph ontology model is constructed.

3. The semantic and syntactic fusion power system threat entity relationship extraction method according to claim 1 is characterized in that: Extracting action relationships from threat intelligence text through semantic role annotation specifically includes the following steps: Perform semantic role annotation on threat intelligence text, identify the semantic roles of each entity, including agent, patient, and instrumental roles, and generate annotation results containing the core semantic structure; The subject-predicate-object triples are parsed from the annotation results, where the subject corresponds to the agent entity, the object corresponds to the recipient entity, and the predicate action corresponds to the relationship connection between entities, thereby extracting the semantic action relationship in the threat intelligence text.

4. The semantic and syntactic fusion power system threat entity relationship extraction method according to claim 3 is characterized in that: The action relationship includes at least a usage relationship, an attack target relationship, and a purpose-driven relationship.

5. The semantic and syntactic fusion power system threat entity relationship extraction method according to claim 1 is characterized in that: Extracting structural relationships from threat intelligence text through syntactic dependency analysis specifically includes the following steps: Parse the input threat intelligence text, construct a syntactic dependency tree, and identify syntactic dependency analysis results such as coordination, modification, and prepositional phrases; Extract the syntactic structural relations in threat intelligence text from the syntactic dependency analysis results.

6. The semantic and syntactic fusion power system threat entity relationship extraction method according to claim 5 is characterized in that: The step of parsing the input threat intelligence text and constructing a syntactic dependency tree specifically includes the following steps: A syntactic dependency tree is constructed with the core word as the root node, where each word has one and only one parent node, and the dependency relationship between a word and its parent node word is the edge between the two.

7. The semantic and syntactic fusion power system threat entity relationship extraction method according to claim 6 is characterized in that: The structural relationship includes at least an organizational association relationship, a feature inclusion relationship, and a geographical location relationship.

8. The semantic and syntactic fusion power system threat entity relationship extraction method according to claim 1 is characterized in that: The mapping of action relationships and structural relationships to the constructed threat intelligence graph ontology model, constructing a standardized triple structure, and providing structured entity relationship data for constructing a new power system threat knowledge graph specifically includes the following steps: A mapping mechanism based on word vector similarity is used to calculate the vector similarity between the predicate actions extracted from semantic role annotation and the predefined relationship types (such as "attack", "control", "use", etc.) in the threat intelligence graph ontology; Select the best matching relationship type that meets the entity type constraint and whose vector similarity exceeds the preset threshold, replace the original predicate action, and obtain the action relationship mapping result; Based on the syntactic dependency analysis results, combined with contextual semantics and entity type constraints, non-action structural relationships are mapped to the relationship types defined in the ontology model to obtain structural relationship mapping results; By fusing the action relationship mapping results and the structure relationship mapping results, a standardized triple structure is generated, providing structured entity relationship data for constructing a new power system threat knowledge graph.

9. A semantic and syntactic fusion power system threat entity relationship extraction system, characterized by: include: A threat intelligence graph ontology model construction module is used to build a threat intelligence graph ontology model that includes entity types and relationship types of the power system based on the requirements of modeling new power system attack behaviors; Action relationship extraction module, used to extract action relationships from threat intelligence text through semantic role annotation; Structural relationship extraction module, used to extract structural relationships from threat intelligence text through syntactic dependency analysis; The entity relationship acquisition module is in communication with the threat intelligence graph ontology model construction module, the action relationship extraction module and the structural relationship extraction module, and is used to map the action relationship and structural relationship to the constructed threat intelligence graph ontology model, construct a standardized triple structure, and provide structured entity relationship data for constructing a new power system threat knowledge graph.

10. The semantic and syntactic fusion power system threat entity relationship extraction system according to claim 9, characterized in that: The threat intelligence graph ontology model building module includes: The entity type acquisition unit is used to expand the power system-specific entity types based on the common entity types defined in the UCO and DNRTI datasets, and to construct entity types for power system threat intelligence analysis; The relationship type acquisition unit defines the relationship type between each entity type, including action-type relationships and non-action-type relationships, and determines the entity type constraints of each relationship; The threat intelligence graph ontology model construction unit is communicatively connected to the entity type acquisition unit and the relationship type acquisition unit, and is used to construct a threat intelligence graph ontology model by combining entity types and relationship types between entity types.

Images