Novel power system threat entity identification method and system in combination with domain knowledge

Abstract

The invention provides a novel power system threat entity recognition method and system in combination with domain knowledge, and the method comprises the following steps: collecting novel power system entity vocabularies, constructing a power system threat entity library, and generating a training corpus; the method comprises the following steps: constructing a DeBERTa-BiGRU-Att-CRF (Conditional Random Field) recognition model; and inputting a training corpus to the DeBERTa-BiGRU-Att-CRF recognition model for training, adjusting hyper-parameters through a verification set, obtaining an entity recognition model with optimal recognition performance, recognizing input power system threat intelligence to be recognized, and obtaining a named entity and an entity category. According to the method, the threat entity library special for the power system is constructed, and the DeBERTa-BiGRU-Att-CRF model is adopted for training, so that the accuracy and field adaptability of threat entity recognition are remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security technology, and specifically to a novel power system threat entity identification method and system that combines domain knowledge. Background Art

[0002] With the integration of distributed energy resources and the increasing level of intelligence in new power systems, power systems are evolving from traditional models toward a deep integration of cyber, physical, and social systems. However, this transformation has also expanded the cyber attack surface, with complex attacks, particularly those exemplified by Advanced Persistent Threats (APTs), posing a serious threat to system security. The structured representation of threat intelligence has become a crucial tool for power system security defense, with the accurate identification of threat entities fundamental to constructing threat intelligence maps.

[0003] Existing named entity recognition methods are mainly divided into three categories: domain dictionary-based methods, rule-based methods, and artificial intelligence-based methods. Artificial intelligence-based methods, such as the BERT-BiLSTM-CRF structure (BERT, Bidirectional Encoder Representations from Transformers; BiLSTM, Bidirectional Long Short-Term Memory; and CRF, Conditional Random Field), have been widely used in general security intelligence processing, but have not been optimized for entities unique to power systems, resulting in insufficient recognition accuracy. This is particularly prone to missed and misidentified terms when dealing with specialized terminology. Summary of the Invention

[0004] The present application provides a novel power system threat entity identification method and system that combines domain knowledge, which can solve the technical problems existing in the existing artificial intelligence-based methods, such as the failure to optimize for entities unique to the power system, resulting in insufficient recognition accuracy, especially prone to missed recognition and misidentification when facing proprietary terms.

[0005] In a first aspect, the present application provides a novel power system threat entity identification method incorporating domain knowledge, comprising the following steps: Collect new power system entity vocabulary, build a power system threat entity library and generate training corpus; Build the DeBERTa-BiGRU-Att-CRF recognition model; The training corpus is input into the DeBERTa-BiGRU-Att-CRF recognition model for training, and the hyperparameters are adjusted through the validation set to obtain the entity recognition model with the optimal recognition performance. The input power system threat intelligence to be identified is used to identify named entities and entity categories.

[0006] Furthermore, the collection of new power system entity vocabulary, construction of a power system threat entity library and generation of training corpus specifically includes the following steps: Collect entity vocabulary in the power system field and build an original terminology database; Classify and label the words in the original terminology database according to entity categories to form a power system threat entity database; Based on the vocabulary information in the power system threat entity database, text data containing relevant vocabulary is constructed, and the entity categories are marked using the BIO annotation method to generate training corpus.

[0007] Furthermore, the vocabulary in the original term library is categorized and labeled according to entity categories to form a power system threat entity library, which specifically includes the following steps: Crawl power system domain terminology to obtain structured data including sub-domain numbers, vocabulary numbers, English terms, and Chinese translations; The terminology in the power system field is divided into four entity categories: non-entity words, power system, power equipment and power events; The collected words are structured and organized according to entity categories, and a hierarchical database structure is established with the field number as the primary key and the word number as the foreign key to form a power system threat entity library.

[0008] Furthermore, the method of constructing text data containing relevant vocabulary based on the vocabulary information in the power system threat entity library, marking entity categories using the BIO annotation method, and generating training corpus specifically includes the following steps: Perform grammatical reconstruction on the term definition text in the power system threat entity library to obtain the grammatically reconstructed text; The sliding window algorithm is used to segment the grammatically reconstructed text to obtain a composite text; A continuous annotation strategy is used to annotate composite entities using BIO to generate training corpus.

[0009] Furthermore, the construction of the DeBERTa-BiGRU-Att-CRF recognition model specifically includes the following steps: The DeBERTa model is used to encode the input power system threat intelligence text to obtain a word vector representation that incorporates contextual information. Based on the bidirectional semantic dependency characteristics of power entities in text, the feature vector is input to the bidirectional gated recurrent unit to capture contextual features from both the forward and backward directions. According to the distribution characteristics of key entities in power threat intelligence, the self-attention mechanism is introduced into the context features, the correlation weights between feature vectors are calculated, and finally the DeBERTa-BiGRU-Att-CRF recognition model is constructed.

[0010] Furthermore, the input training corpus is fed into the DeBERTa-BiGRU-Att-CRF recognition model for training, and the hyperparameters are adjusted through the validation set to obtain an entity recognition model with optimal recognition performance, and the input power system threat intelligence to be identified is identified to obtain named entities and entity categories, specifically including the following steps: Input the annotated training corpus into the DeBERTa pre-training model, perform semantic vectorization on the input text through the decoupled attention mechanism and relative position encoding, and obtain a word vector sequence with semantic features of the power field; Input the word vector sequence to the BiGRU network, extract the bidirectional context dependency features of the text based on the forward and backward hidden states, and obtain the context feature vector containing temporal information; Apply a self-attention mechanism to the output context feature vector, enhance the features of key entity words in the long text based on the attention weight matrix, and obtain feature representation with local attention weighting; Input the weighted feature representation to the CRF layer, constrain the global optimal solution of the entity category sequence through the transition probability matrix, and obtain the trained entity recognition model; A validation set was used to perform grid search optimization on the hyperparameters of the trained entity recognition model. The optimal combination of batch size, learning rate, and dropout rate was selected based on the F1 value metric to obtain an entity recognition model with optimal recognition performance in the power sector. The power system threat intelligence text to be identified is input into the entity recognition model with the optimal recognition performance. It is processed in sequence through DeBERTa semantic encoding, BiGRU context modeling, attention weighting and CRF label decoding to identify and obtain named entities and entity categories.

[0011] Furthermore, the power system threat entity library also includes attack tool entities, attacker organization entities, communication protocol entities and operation behavior entities.

[0012] In a second aspect, the present application provides a novel power system threat entity identification system that combines domain knowledge, including: A training corpus generation module is used to collect new power system entity vocabulary, build a power system threat entity library, and generate training corpus; Recognition model building module, used to build the DeBERTa-BiGRU-Att-CRF recognition model; The entity recognition model construction and entity recognition module are communicated with the training corpus generation module and the recognition model construction module, and are used to input the training corpus into the DeBERTa-BiGRU-Att-CRF recognition model for training, and adjust the hyperparameters through the validation set to obtain the entity recognition model with the optimal recognition performance, identify the power system threat intelligence to be input, and obtain named entities and entity categories.

[0013] Furthermore, the training corpus generation module includes: The original terminology database construction unit is used to collect entity vocabulary in the power system field and construct the original terminology database; A power system threat entity library construction unit is in communication with the original term library construction unit and is used to classify and label the vocabulary in the original term library according to entity categories to form a power system threat entity library; The training corpus generation unit is communicatively connected to the power system threat entity library construction unit and is used to construct text data containing relevant vocabulary based on the vocabulary information in the power system threat entity library, and mark entity categories using the BIO annotation method to generate training corpus.

[0014] In a third aspect, the present application provides a computer-readable storage medium, on which is stored a new power system threat entity identification program that combines domain knowledge. When the new power system threat entity identification program that combines domain knowledge is executed by a processor, the steps of the new power system threat entity identification method that combines domain knowledge as described above are implemented.

[0015] The beneficial effects of the technical solutions provided in the embodiments of the present application include at least: This application uses a structured entity library built based on the unique entity vocabulary of the power system, which effectively solves the problem of insufficient recognition of professional terms such as power equipment and attack technology by traditional methods; The DeBERTa pre-trained model combines BiGRU and self-attention mechanisms to enhance the model's ability to extract features from long text and complex semantic relationships in power system threat intelligence. The complete recognition rate of multi-word entities is improved by globally optimizing the entity boundaries through the CRF layer. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a novel power system threat entity identification method combined with domain knowledge provided in an embodiment of the present application; Figure 2 A novel method for constructing a power system entity library provided in an embodiment of the present application; Figure 3 This is a structural block diagram of the DeBERTa-BiGRU-Att-CRF model provided in the embodiment of this application. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit the "first", "second" and "third" to different types.

[0019] In the description of the embodiments of the present application, the words "exemplary," "for example," or "for example" are used as examples, illustrations, or explanations. Any embodiment or design described in the embodiments of the present application as "exemplary," "for example," or "for example" should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary," "for example," or "for example" is intended to present the relevant concepts in a concrete manner.

[0020] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0021] In some processes described in the embodiments of the present application, multiple operations or steps are included that appear in a specific order. However, it should be understood that these operations or steps may not be performed in the order in which they appear in the embodiments of the present application or may be performed in parallel. The sequence numbers of the operations are only used to distinguish between different operations, and the sequence numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations or steps may be performed in sequence or in parallel, and these operations or steps may be combined.

[0022] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0023] First, please refer to Figure 1 , this application provides a new power system threat entity identification method combined with domain knowledge, including the following steps: Step S1: Collect new power system entity vocabulary, build a power system threat entity library and generate training corpus; Step S2: Build the DeBERTa-BiGRU-Att-CRF recognition model; Step S3: Input the training corpus to the DeBERTa-BiGRU-Att-CRF recognition model for training, and adjust the hyperparameters through the validation set to obtain the entity recognition model with the optimal recognition performance. The input power system threat intelligence to be identified is identified to obtain named entities and entity categories.

[0024] A structured entity library built based on the power system's unique entity vocabulary effectively solves the problem of traditional methods' inadequate recognition of specialized terms such as power equipment and attack techniques. The DeBERTa pre-trained model combines BiGRU and self-attention mechanisms to enhance the model's ability to extract features from long text and complex semantic relationships in power system threat intelligence. The complete recognition rate of multi-word entities is improved by globally optimizing the entity boundaries through the CRF layer.

[0025] In one embodiment, step S1: collecting new power system entity vocabulary, building a power system threat entity library and generating training corpus, specifically includes the following steps: Step S11: By crawling IEC60050 standard documents and power system security reports, collect entity vocabulary in the power system field such as APT attack behavior, power equipment, and communication protocols, and build an original terminology database; Step S12: Manually clean, categorize, and label the vocabulary in the original terminology library by entity category to form a power system threat entity library. Specifically, manually label the vocabulary in the original terminology library and classify it into entity categories such as attack tools, attack organizations, power equipment, and event actions. Four labels, System / Device / Event / Other, are defined to form a structured power system threat entity library. Step S13: Based on the vocabulary information in the power system threat entity library, text data containing relevant vocabulary is constructed. Entity categories are labeled using the BIO annotation method to generate training data. Specifically, based on the vocabulary information in the power system threat entity library, text data containing relevant vocabulary is constructed. Lexical definitions are connected using the term "is" to establish a subject-predicate relationship, and examples are enumerated using the term "such as." Entity categories are labeled using the BIO annotation method to generate training data containing text-label pairs. This process ensures the matching of professional terminology with context through standardization, providing high-quality domain-adapted data for subsequent model training.

[0026] In one embodiment, step S12: classifying and labeling the words in the original term library by entity category to form a power system threat entity library specifically includes the following steps: Step S121: Crawl power system domain terminology to obtain structured data including sub-domain numbers, vocabulary numbers, English terms, and Chinese translations to ensure the authority and integrity of the terminology source; Step S122: Using an expert annotation method, the power system domain terms are divided into four entity categories: non-entity words (Other), power system (System), power equipment (Device), and power events (Event). Power equipment is further subdivided into subcategories such as power generation equipment, transmission equipment, and distribution equipment. Step S123: The collected terms are structured and organized by entity category (e.g., attack tools, attacker organizations, power equipment, event actions, etc.). A hierarchical database structure is established, with domain numbers as primary keys and term numbers as foreign keys. This forms a power system threat entity library, enabling standardized storage and efficient retrieval of terminology data. Ultimately, a power system threat entity library with complete semantic relationships and a classification system is formed. This entity library supports multi-dimensional queries and dynamic expansion, providing precise domain knowledge support for subsequent entity identification.

[0027] Figure 2This paper demonstrates a novel power system entity library construction method, including IEC 60050 web crawling and entity library construction. To crawl the IEC 60050 website, all domain numbers are first obtained from the IEC 60050 website and combined with the domain page URL to obtain a list of all domain terms and their numbers. Then, the word code is combined with the word page URL to obtain detailed information about the corresponding word. To construct the entity library, the domain number is used as the primary key, and the subdomain table uses the domain number as the table name. The detailed information for all terms in the domain is listed, including the subdomain, word number, word, Chinese name, detailed information, and tags. The word number is used as the primary key, and the tags are manually annotated and divided into four types: non-entity words (Other), power system (System), power system equipment (Device), and power system event (Event).

[0028] In one embodiment, the power system threat entity library further includes entities of the following subcategories: Attack tool entities: These include malware (such as "BlackEnergy") and vulnerability exploitation tools (such as "Metasploit"), used to identify specific network attack methods; Attacker organization entities: These include known APT organizations (such as "APT29") and hacker groups, used to identify threat sources. Communication protocol entities: These include power system-specific protocols (such as IEC 61850) and industrial control protocols, used to identify potential attack surfaces. Operational behavior entities: include attack behaviors (such as "credential theft"), system operations (such as "circuit breaker operation"), etc., used to describe the threat activity process.

[0029] Through the power system threat entity library with a multi-dimensional classification system, comprehensive coverage of various key entities in power system threat intelligence is achieved, providing refined domain knowledge support for subsequent entity identification.

[0030] In one embodiment, step S13: constructing text data containing relevant vocabulary based on vocabulary information in the power system threat entity library, and marking entity categories using the BIO annotation method to generate training corpus, specifically includes the following steps: Step S131: Perform grammatical reconstruction on the term definition text in the power system threat entity library. Using the standardized "subject-verb-object" sentence structure, connectives (such as "is" and "such as") are added to construct semantically coherent complete sentences to ensure that the text conforms to natural language grammar standards. The grammatically reconstructed text is then obtained. Specifically, for the Explain part, "is" is used to connect the term to it; for the Example part, "such as" is used to connect it to the previous text; and for the Note part, the term is directly added to the text. Step S132: Segment the grammatically reconstructed text using a sliding window algorithm, setting the window size to 5-8 words and the step length to 3 words. Composite entities containing contextual information are generated through overlapping sampling, effectively solving the problem of entity recognition in long texts. Step S133: A continuous labeling strategy is used to perform BIO labeling on composite entities, where the B-label represents the entity start word, the I-label represents the entity follow-up word, and the O-label represents the non-entity word. For multi-word entities (such as "smart meter terminal equipment"), a mandatory continuous labeling rule is implemented to ensure the integrity of entity boundaries and labeling consistency, and finally generate standardized CRF model training corpus.

[0031] In one embodiment, the step 2: constructing a DeBERTa-BiGRU-Att-CRF recognition model specifically includes the following steps: Step S21: The DeBERTa model is used to encode the input power system threat intelligence text. Through its decoupled attention mechanism and enhanced masking strategy, a dynamic word vector representation is obtained that integrates the contextual information of professional terminology in the power field, especially optimizing the modeling capability of long-distance dependencies. Step S22: Based on the unique bidirectional semantic dependency characteristics of power entities in the text, the feature vector output by DeBERTa is input into a bidirectional gated recurrent unit (BiGRU). The forward GRU and backward GRU are used to capture the temporal contextual features of entities such as power equipment names and attack behaviors, respectively, to enhance the ability to identify the boundaries of power system proper nouns. Step S23: Based on the distribution characteristics of key entities in power threat intelligence (such as advanced persistent threat attack organizations and vulnerability numbers), a multi-head self-attention mechanism is introduced on the contextual features output by the BiGRU. By calculating the correlation weights between feature vectors, the importance of key entities in the power security field is highlighted. Finally, a CRF layer is used to globally optimize the entity category sequence, constructing a DeBERTa-BiGRU-Att-CRF recognition model with power sector adaptability. Through multi-level feature fusion, this model significantly improves the recognition accuracy of complex threat entities in the power system.

[0032] Figure 3 The DeBERTa-BiGRU-Att-CRF model architecture is presented, comprising DeBERTa, BiGRU, a self-attention mechanism, and a conditional random field. DeBERTa builds on BERT by introducing three major improvements: a decoupled attention mechanism, an enhanced mask decoder, and optimized relative position encoding, significantly enhancing its performance in handling long-range dependencies and complex semantic relationships. Within the DeBERTa-BiGRU-Att-CRF model, DeBERTa is used to generate text vectors, supporting further entity recognition. Considering that threat intelligence, as specialized cybersecurity knowledge, contains extensive terminology and complex attack chain descriptions, DeBERTa possesses stronger long-range dependency modeling capabilities than models like BERT and RoBERTa, enabling it to better extract feature information from cybersecurity-related text and form text feature vectors. For example, in novel power system threat intelligence, proprietary equipment, attack technique names, malware families, and CVE vulnerability numbers often appear within long text. DeBERTa, through its decoupled attention mechanism, enhanced masking strategy, and relative position encoding, can more accurately represent sentence vectors and thus extract these key entities.

[0033] The self-attention mechanism calculates the correlation between each element in the sequence and other elements to obtain global dependencies within the sequence, thereby improving model performance in extracting long-distance dependencies. In DeBERTa-BiGRU-Att-CRF, the sequence model BiGRU output further performs self-attention calculations, which can assign weight information to different positions in the input, thereby increasing the importance of specific positions and providing better data support for subsequent label sequence annotation.

[0034] Conditional Random Fields (CRF) is a probabilistic model for sequence labeling tasks. It uses global optimization of contextual information to solve the label bias problem and has been widely used in natural language processing tasks such as entity recognition. In entity recognition of new power system threat intelligence, the boundaries of named entities often have a certain degree of contextual relevance. Traditional labeling methods tend to ignore this dependency. CRF can model the sequence through global normalization, thereby optimizing the labeling results and effectively improving the accuracy of named entity recognition, making it more consistent with contextual logic. For example, entities such as hacker organization names and malware names in threat intelligence may contain multiple words. If independent labeling is used, some of these words may be identified as other types of entities. Using CRF can reduce such errors and thus improve the contextual consistency of entity types.

[0035] In one embodiment, step S3: inputting training corpus to the DeBERTa-BiGRU-Att-CRF recognition model for training, adjusting hyperparameters through a validation set, obtaining an entity recognition model with optimal recognition performance, identifying the input power system threat intelligence to be identified, and obtaining named entities and entity categories, specifically includes the following steps: Step S31: Input the annotated training corpus into the DeBERTa pre-training model, use its decoupled attention mechanism to separate content and position information processing, capture the long-range dependencies between power professional terms through relative position encoding, and output a dynamic word vector sequence with specific semantic features in the power field; Step S32: Input the word vector sequence to the Bidirectional Gated Recurrent Unit (BiGRU) network. The forward GRU captures the positive semantic evolution features of the power entity in the text. The backward GRU reversely extracts the subsequent contextual features of the entity. Finally, the bidirectional hidden states are concatenated to form a contextual feature vector containing complete temporal information. Step S33: Apply a self-attention mechanism to the context feature vector output by the BiGRU. By calculating the correlation scores between feature vectors, an attention weight matrix is ​​constructed to focus on enhancing the feature representation of key entities in the power system (such as "smart meter terminal" and "IEC 60870-5-104 protocol") and suppress the interference of irrelevant words. Step S34: Input the weighted feature representation to the CRF layer, combine it with the Viterbi algorithm decoding to obtain the globally optimal entity category sequence, obtain the trained entity recognition model, and ensure that the output entity boundaries and categories conform to the grammatical and semantic rules of the power field text; Step S35: Use the validation set to perform grid search optimization on the hyperparameters of the trained entity recognition model, focusing on adjusting the batch size (16 / 32 / 64), the initial learning rate (2e -5 to 5e -5 ) and dropout rate (0.1-0.3), and use the entity-level F1 value as the evaluation indicator to select the optimal parameter combination to ensure the best generalization performance of the model in the power threat intelligence scenario and obtain the entity recognition model with the best recognition performance in the power field; Step S36: Input the power system threat intelligence text to be identified into the entity recognition model with optimal recognition performance, and sequentially process it through DeBERTa semantic encoding, BiGRU context modeling, attention weighting, and CRF label decoding to identify and obtain named entities and entity categories, including fine-grained entity categories such as attack tools, power equipment, and attack behaviors.

[0036] In a second aspect, the present application provides a novel power system threat entity identification system that combines domain knowledge, including: A training corpus generation module is used to collect new power system entity vocabulary, build a power system threat entity library, and generate training corpus; Recognition model building module, used to build the DeBERTa-BiGRU-Att-CRF recognition model; The entity recognition model construction and entity recognition module are communicated with the training corpus generation module and the recognition model construction module, and are used to input the training corpus into the DeBERTa-BiGRU-Att-CRF recognition model for training, and adjust the hyperparameters through the validation set to obtain the entity recognition model with the optimal recognition performance, identify the power system threat intelligence to be input, and obtain named entities and entity categories.

[0037] In one embodiment, the training corpus generation module includes: The original terminology database construction unit is used to collect entity vocabulary in the power system field and construct the original terminology database; A power system threat entity library construction unit is in communication with the original term library construction unit and is used to classify and label the vocabulary in the original term library according to entity categories to form a power system threat entity library; The training corpus generation unit is communicatively connected to the power system threat entity library construction unit and is used to construct text data containing relevant vocabulary based on the vocabulary information in the power system threat entity library, and mark entity categories using the BIO annotation method to generate training corpus.

[0038] Among them, the functional implementation of each module in the above-mentioned new power system threat entity identification system combined with domain knowledge corresponds to the various steps in the above-mentioned embodiment of the new power system threat entity identification method combined with domain knowledge, and their functions and implementation processes will not be repeated here one by one.

[0039] On the third aspect, an embodiment of the present application provides a new power system threat entity identification device that combines domain knowledge. The new power system threat entity identification device that combines domain knowledge can be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0040] Communication interfaces include input / output (I / O), physical, and logical interfaces, which interconnect components within the new power system threat entity identification device that incorporates domain knowledge, as well as interfaces that interconnect the device with other devices (such as other computing devices or user devices). Physical interfaces can include Ethernet, fiber, and ATM interfaces; user devices can include displays and keyboards.

[0041] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0042] The processor may be a general-purpose processor that can invoke a new power system threat entity identification program that incorporates domain knowledge and is stored in a memory and execute the new power system threat entity identification method that incorporates domain knowledge provided in the embodiments of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The methods executed when the new power system threat entity identification program that incorporates domain knowledge is invoked can be referenced in the various embodiments of the new power system threat entity identification method that incorporates domain knowledge and is not further described here.

[0043] In a fourth aspect, an embodiment of the present application also provides a readable storage medium.

[0044] The readable storage medium of the present application stores a new power system threat entity identification program that combines domain knowledge, wherein when the new power system threat entity identification program that combines domain knowledge is executed by a processor, the steps of the new power system threat entity identification method that combines domain knowledge as described above are implemented.

[0045] Among them, the method implemented when the new power system threat entity identification program combined with domain knowledge is executed can refer to the various embodiments of the new power system threat entity identification method combined with domain knowledge in this application, and will not be repeated here.

[0046] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0047] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above and includes a number of instructions for enabling a terminal device to execute the methods described in each embodiment of this application.

[0048] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A novel power system threat entity identification method combining domain knowledge, characterized by: The following steps are involved: Collect new power system entity vocabulary, build a power system threat entity library and generate training corpus; Build the DeBERTa-BiGRU-Att-CRF recognition model; The training corpus is input into the DeBERTa-BiGRU-Att-CRF recognition model for training, and the hyperparameters are adjusted through the validation set to obtain the entity recognition model with the optimal recognition performance. The input power system threat intelligence to be identified is used to identify named entities and entity categories.

2. The novel power system threat entity identification method combining domain knowledge as claimed in claim 1 is characterized in that: The process of collecting new power system entity vocabulary, building a power system threat entity library, and generating training corpus specifically includes the following steps: Collect entity vocabulary in the power system field and build an original terminology database; Classify and label the words in the original terminology database according to entity categories to form a power system threat entity database; Based on the vocabulary information in the power system threat entity database, text data containing relevant vocabulary is constructed, and the entity categories are marked using the BIO annotation method to generate training corpus.

3. The novel power system threat entity identification method combining domain knowledge as claimed in claim 2 is characterized in that: The method of classifying and labeling the words in the original terminology library according to entity categories to form a power system threat entity library specifically includes the following steps: Crawl power system domain terminology to obtain structured data including sub-domain numbers, vocabulary numbers, English terms, and Chinese translations; The terminology in the power system field is divided into four entity categories: non-entity words, power system, power equipment and power events; The collected words are structured and organized according to entity categories, and a hierarchical database structure is established with the field number as the primary key and the word number as the foreign key to form a power system threat entity library.

4. The novel power system threat entity identification method combining domain knowledge as claimed in claim 2 is characterized in that: The method of constructing text data containing relevant vocabulary based on vocabulary information in the power system threat entity library, marking entity categories using the BIO annotation method, and generating training corpus specifically includes the following steps: Perform grammatical reconstruction on the term definition text in the power system threat entity library to obtain the grammatically reconstructed text; The sliding window algorithm is used to segment the grammatically reconstructed text to obtain a composite text; A continuous annotation strategy is used to annotate composite entities using BIO to generate training corpus.

5. The novel power system threat entity identification method combining domain knowledge as claimed in claim 2 is characterized in that: The construction of the DeBERTa-BiGRU-Att-CRF recognition model specifically includes the following steps: The DeBERTa model is used to encode the input power system threat intelligence text to obtain a word vector representation that incorporates contextual information. Based on the bidirectional semantic dependency characteristics of power entities in text, the feature vector is input to the bidirectional gated recurrent unit to capture contextual features from both the forward and backward directions. According to the distribution characteristics of key entities in power threat intelligence, the self-attention mechanism is introduced into the context features, the correlation weights between feature vectors are calculated, and finally the DeBERTa-BiGRU-Att-CRF recognition model is constructed.

6. The novel power system threat entity identification method combining domain knowledge as claimed in claim 1 is characterized in that: The input training corpus is trained on the DeBERTa-BiGRU-Att-CRF recognition model, and the hyperparameters are adjusted through the validation set to obtain the entity recognition model with the optimal recognition performance, and the input power system threat intelligence to be identified is identified to obtain the named entity and entity category, specifically including the following steps: Input the annotated training corpus into the DeBERTa pre-training model, perform semantic vectorization on the input text through the decoupled attention mechanism and relative position encoding, and obtain a word vector sequence with semantic features of the power field; Input the word vector sequence to the BiGRU network, extract the bidirectional context dependency features of the text based on the forward and backward hidden states, and obtain the context feature vector containing temporal information; Apply a self-attention mechanism to the output context feature vector, enhance the features of key entity words in the long text based on the attention weight matrix, and obtain feature representation with local attention weighting; Input the weighted feature representation to the CRF layer, constrain the global optimal solution of the entity category sequence through the transition probability matrix, and obtain the trained entity recognition model; A validation set was used to perform grid search optimization on the hyperparameters of the trained entity recognition model. The optimal combination of batch size, learning rate, and dropout rate was selected based on the F1 value metric to obtain an entity recognition model with optimal recognition performance in the power sector. The power system threat intelligence text to be identified is input into the entity recognition model with the optimal recognition performance. It is processed in sequence through DeBERTa semantic encoding, BiGRU context modeling, attention weighting and CRF label decoding to identify and obtain named entities and entity categories.

7. The novel power system threat entity identification method combining domain knowledge as claimed in claim 1 is characterized in that: The power system threat entity library also includes attack tool entities, attacker organization entities, communication protocol entities and operation behavior entities.

8. A new power system threat entity identification system combined with domain knowledge, characterized by: include: A training corpus generation module is used to collect new power system entity vocabulary, build a power system threat entity library, and generate training corpus; Recognition model building module, used to build the DeBERTa-BiGRU-Att-CRF recognition model; The entity recognition model construction and entity recognition module are communicated with the training corpus generation module and the recognition model construction module, and are used to input the training corpus into the DeBERTa-BiGRU-Att-CRF recognition model for training, and adjust the hyperparameters through the validation set to obtain the entity recognition model with the optimal recognition performance, identify the power system threat intelligence to be input, and obtain named entities and entity categories.

9. The novel power system threat entity identification system combined with domain knowledge as claimed in claim 8 is characterized in that: The training corpus generation module includes: The original terminology database construction unit is used to collect entity vocabulary in the power system field and construct the original terminology database; A power system threat entity library construction unit is in communication with the original term library construction unit and is used to classify and label the vocabulary in the original term library according to entity categories to form a power system threat entity library; The training corpus generation unit is communicatively connected to the power system threat entity library construction unit and is used to construct text data containing relevant vocabulary based on the vocabulary information in the power system threat entity library, and mark entity categories using the BIO annotation method to generate training corpus.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a new power system threat entity identification program that combines domain knowledge, wherein when the new power system threat entity identification program that combines domain knowledge is executed by a processor, the steps of the new power system threat entity identification method that combines domain knowledge as described in any one of claims 1 to 7 are implemented.

Images