Network security knowledge graph construction method based on large language model and related products

Abstract

The invention discloses a network security knowledge graph construction method based on a large language model and a related product, and belongs to a computer network security and threat intelligence analysis technology. According to the network security knowledge graph construction method based on the large language model, an aligned security knowledge triple list is converted into a sub-graph, a center entity is recognized, a main graph center entity TCE is determined through a degree maximum principle, and a core association hub of a knowledge graph is determined; the method comprises the following steps: aiming at a sub-graph center entity without a direct relation edge with TCE, extracting a context containing the two from an original network threat intelligence report text, mining an implicit relation by means of logical reasoning ability of a large language model, complementing long-distance association across sub-graphs, and connecting originally dispersed sub-graph knowledge fragments into a complete threat knowledge network; therefore, the connectivity and integrity of the knowledge graph are improved, the knowledge graph can comprehensively and coherently reflect a complete association link of a network threat, and the knowledge extraction quality is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to computer network security and threat intelligence analysis technology, in particular to a network security knowledge graph construction method based on a large language model and related products. BACKGROUND

[0002] Network threat intelligence reports (such as security event analysis reports and security news published by security vendors) contain rich network threat knowledge, which is crucial for organizations to understand the rapidly evolving threat situation in a timely manner. However, current methods for automatically extracting knowledge from network threat intelligence reports and constructing network security knowledge graphs have obvious limitations. Traditional methods mainly fall into two categories: one is based on syntactic analysis, relying on fixed rules and dictionaries to parse sentence structure and extract subject-predicate-object triples; the other is based on model fine-tuning, using pre-trained models to fine-tune on annotated datasets for entity recognition and relationship extraction.

[0003] Many methods are designed for specific network security ontologies, limited to fixed entity and relationship types, and difficult to adapt to new threats and terminology. Rule-based methods require manual updates to rules and dictionaries to address new patterns, while model fine-tuning requires a large amount of annotated data to be effective for new ontologies. However, annotated data in the security field is often scarce, especially for emerging threats. Due to the special nature of security domain text and the insufficient depth of existing methods, the extracted knowledge graphs often have problems such as incompleteness, inaccuracy, and fragmentation. For example, some methods generate knowledge graphs with missing entities, incorrect boundary identification, or repeated entities due to unaligned entities, and broken relationship chains, which cannot fully reflect the overall threat picture. SUMMARY

[0004] The present application aims to provide a network security knowledge graph construction method based on a large language model and related products to overcome the problem of low knowledge extraction quality in existing technology when constructing a network security knowledge graph.

[0005] The present application solves the above technical problems through the following technical solutions: The present application provides a network security knowledge graph construction method based on a large language model, comprising the following steps: Step 1: Extracting a list of several security knowledge triples A from network threat intelligence report text Q through a large language model; Step 2: Performing coarse-grained type classification and fine-grained semantic matching on the entities of the list of several security knowledge triples A in sequence to generate a list of several aligned security knowledge triples B; Step 3: Converting the list of several security knowledge triples B into N subgraphs and identifying the center entities CE1~CE N , the center entity CEa As the central entity TCE of the main graph, if the central entity Cei and the central entity TCE do not have a direct relationship edge, wherein i is 1~N, and i≠a, then the text containing the central entity Ce i and the central entity TCE is extracted from the network threat intelligence report text Q to be generated network security knowledge graph, the implicit relationship of the central entity Ce i and the central entity TCE is obtained, and the network security knowledge graph of the network threat intelligence report text Q is generated.

[0006] The further improvement of the present application is that the several security knowledge triple lists A of the network threat intelligence report text Q are extracted by the large language model, which specifically includes the following steps: An example library containing several annotated entities and relationship network threat intelligence report texts P and their security knowledge triple lists is constructed, the semantic similarity of the network threat intelligence report text Q to be generated network security knowledge graph and each network threat intelligence report text P in the example library is calculated, the network threat intelligence report texts P are arranged in descending order according to the semantic similarity, and the first K network threat intelligence report texts P are used as example reports. The several security knowledge triple lists A of the network threat intelligence report text Q are extracted by the large language model.

[0007] The further improvement of the present application is that the semantic similarity is cosine similarity; the network threat intelligence report texts P in the example library are all in vector representation, the semantic similarity of the network threat intelligence report text Q to be generated network security knowledge graph and each network threat intelligence report text P in the example library is calculated, and the following steps are specifically included: The network threat intelligence report text Q is converted into vector representation by a pre-trained text embedding model, the semantic similarity of the network threat intelligence report text Q to be generated network security knowledge graph and each network threat intelligence report text P in the example library is calculated based on the vector representation of each network threat intelligence report text P and the vector representation of the network threat intelligence report text Q.

[0008] The further improvement of the present application is that the text embedding model is specifically a Sentence-BERT model.

[0009] The further improvement of the present application is that the entities of the several security knowledge triple lists A are sequentially subjected to coarse-grained type classification and fine-grained semantic matching to generate several aligned security knowledge triple lists B, which specifically includes the following steps: Perform coarse-grained type classification on all entities in several security knowledge triple lists A to obtain several sets of entity lists. Calculate the semantic similarity between each pair of entities in each set of entity lists. If the semantic similarity is not less than a preset threshold, merge the corresponding two entities into a standardized entity. Update the standardized entity to security knowledge triple list A to generate several aligned security knowledge triple lists B.

[0010] A further improvement of the present invention is that the semantic similarity is cosine similarity, and the preset threshold is 0.80~0.9.

[0011] This invention also provides a network security knowledge graph construction system based on a large language model, comprising: The first module is used to extract a list A of security knowledge triples from the network threat intelligence report text Q using a large language model; The second module is used to perform coarse-grained type classification and fine-grained semantic matching on the entities of several security knowledge triple lists A in sequence, and generate several aligned security knowledge triple lists B. The third module is used to transform a list B of security knowledge triples into N subgraphs, and to identify the central entity CE1~CE of each subgraph. N The central entity CE with the largest degree a As the central entity TCE of the main graph, if there are no direct relationship edges between the central entity Ce and the central entity TCE, where i takes values ​​from 1 to N and i ≠ a, then extract the data containing the central entity Ce from the network threat intelligence report text Q to be generated for the network security knowledge graph. i And the text of the central entity TCE, to obtain the central entity Ce i The implicit relationship with the central entity TCE is used to generate a cybersecurity knowledge graph of the network threat intelligence report text Q.

[0012] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method for constructing a network security knowledge graph based on a large language model.

[0013] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method for constructing a network security knowledge graph based on a large language model.

[0014] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method for constructing a network security knowledge graph based on a large language model.

[0015] Compared with the prior art, the positive progress effect of the present application is that: The network security knowledge graph construction method based on a large language model provided by the present application converts the aligned security knowledge triple list into a subgraph and identifies the center entity, determines the main graph center entity TCE through the degree maximum principle, and clearly defines the core associated hub of the knowledge graph; for the subgraph center entity of the edge that has no direct relationship with the TCE, the context containing the two is extracted from the original network threat intelligence report text, the logical reasoning ability of the large language model is used to mine the implied relationship, and the long-distance association across the subgraph is completed, so that the originally scattered subgraph knowledge fragments are connected into a complete threat knowledge network, thereby improving the connectivity and integrity of the knowledge graph, enabling the knowledge graph to comprehensively and coherently reflect the complete associated link of the network threat, and improving the knowledge extraction quality.

[0016] Further, by constructing a labeled example library, the large language model is provided with a professional extraction paradigm in the network security field, guiding the large language model to establish a domain-specific semantic association cognition; by calculating the semantic similarity of the to-be-processed network threat intelligence report text Q and P in the example library, the top K high-similarity example reports are screened, the recent bias of the model is utilized to effectively improve the context learning effect, guarantee the extraction quality, ensure the high matching of the example reports and the network threat intelligence report text Q, accurately identify the entities and relationships in the network threat intelligence report text Q, avoid the bias caused by general semantic understanding, thereby improving the accuracy and field adaptability of the security knowledge triple list A, and fundamentally solving the problem of unreliable extraction results due to the lack of field example support in the prior art.

[0017] Further, by means of the large language model, the entities are accurately classified, and only entities of the same type are selected as merging candidates to exclude the risk of incorrect merging of entities of different types; then, high-correlation entities are screened in the same type group through vector cosine similarity to ensure the accuracy of the merged semantics and avoid the problem of destroying the semantic logic of the triple in the prior art; the global entities are decomposed into subsets of the same type through coarse-grained grouping, and the similarity is calculated only within the subset, thereby greatly reducing the calculation range; the aligned security knowledge triple list B is generated through accurate merging, the same-concept multi-expression entities are unified into a standardized form, redundancy and ambiguity are eliminated, and data consistency is improved; high-quality data foundation is provided for downstream applications such as security knowledge reasoning, threat detection, and vulnerability retrieval, avoiding the reasoning bias and low retrieval hit rate caused by data noise in the prior art, and promoting the practical value of security knowledge. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the present application. The schematic embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation on the present application.

[0019] Figure 1A flowchart of a network security knowledge graph construction method based on a large language model according to an embodiment of the present application.

[0020] Figure 2 A flowchart of a certain embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0022] In the description of the present application, it should be understood that the terms “include” and “contain” indicate the existence of described features, whole, steps, operations, elements and / or components, but do not exclude the existence or addition of one or more other features, whole, steps, operations, elements, components and / or sets thereof.

[0023] It should also be understood that the terms used in the specification of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and the appended claims of the present application, unless otherwise clear from the context, the singular forms “a”, “an” and “the” are intended to include the plural forms.

[0024] It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the present application to describe the preset ranges, etc., these preset ranges should not be limited to these terms. These terms are only used to distinguish the preset ranges from each other. For example, the first preset range can also be referred to as the second preset range, and similarly, the second preset range can also be referred to as the first preset range without departing from the scope of the embodiments of the present application.

[0025] Depending on the context, the word “if” as used herein can be interpreted as meaning “when” or “while” or “in response to determining” or “in response to detecting”. Similarly, depending on the context, the phrase “if determined” or “if detecting (a stated condition or event)” can be interpreted as “when determined” or “in response to determining” or “when detecting (a stated condition or event)” or “in response to detecting (a stated condition or event)”.

[0026] The present application will be further described below in conjunction with the drawings and specific embodiments, which are an explanation of the present application rather than a limitation.

[0027] Reference Figure 1A method for constructing a cybersecurity knowledge graph based on a large language model includes the following steps: Step 1: Extract a list A of security knowledge triples from the network threat intelligence report text Q using a large language model; Step 2: Perform coarse-grained type classification and fine-grained semantic matching on the entities in several security knowledge triple lists A in sequence to generate several aligned security knowledge triple lists B; Step 3: Transform the list B of several security knowledge triples into N subgraphs, and identify the central entity CE1~CE in each subgraph. N The central entity CE with the largest degree a As the central entity TCE of the main graph, if there are no direct relationship edges between the central entity Ce and the central entity TCE, where i takes values ​​from 1 to N and i ≠ a, then extract the data containing the central entity Ce from the network threat intelligence report text Q to be generated for the network security knowledge graph. i And the text of the central entity TCE, to obtain the central entity Ce i The implicit relationship with the central entity TCE is used to generate a cybersecurity knowledge graph of the network threat intelligence report text Q.

[0028] The aligned list of security knowledge triples is transformed into a subgraph and the central entity is identified. The main graph's central entity, TCE, is determined based on the principle of maximum degree, clarifying the core connection hub of the knowledge graph. For subgraph central entities with no direct relationship to TCE, context containing both is extracted from the original network threat intelligence report text. Implicit relationships are mined using the logical reasoning capabilities of a large language model, completing long-distance connections across subgraphs. This connects the originally scattered subgraph knowledge fragments into a complete threat knowledge network, thereby improving the connectivity and completeness of the knowledge graph. This enables the knowledge graph to comprehensively and coherently reflect the complete connection links of network threats, improving the quality of knowledge extraction.

[0029] Preferably, the step of extracting a list A of security knowledge triples from the network threat intelligence report text Q using a large language model specifically includes the following steps: Construct an example library containing several network threat intelligence report texts P with labeled entities and relationships, along with a list of security knowledge triples. Calculate the semantic similarity between the network threat intelligence report text Q to be generated for the network security knowledge graph and each network threat intelligence report text P in the example library. Sort the network threat intelligence report texts P in descending order of semantic similarity, and use the top K network threat intelligence report texts P as example reports. Extract a list A of several security knowledge triples from the network threat intelligence report text Q using a large language model.

[0030] By constructing an annotated example library, a professional extraction paradigm for cybersecurity is provided for large language models, guiding them to establish domain-specific semantic association cognition. By calculating the semantic similarity between the network threat intelligence report text Q to be processed and P in the example library, the top K high-similarity example reports are selected. Utilizing the model's recent bias, the context learning effect is effectively improved, ensuring extraction quality and guaranteeing a high degree of matching between the example reports and the network threat intelligence report text Q. This accurately identifies entities and relationships in the network threat intelligence report text Q, avoiding biases caused by general semantic understanding. Consequently, the accuracy and domain adaptability of the security knowledge triple list A are improved, fundamentally solving the problems of existing technologies lacking domain example support and unreliable extraction results.

[0031] Preferably, the semantic similarity is cosine similarity; the network threat intelligence report texts P in the example library are all vector representations. Calculating the semantic similarity between the network threat intelligence report text Q to be generated for the network security knowledge graph and each network threat intelligence report text P in the example library specifically includes the following steps: The network threat intelligence report text Q is transformed into a vector representation using a pre-trained text embedding model. Based on the vector representations of each network threat intelligence report text P and the network threat intelligence report text Q, the semantic similarity between the network threat intelligence report text Q to be generated in the network security knowledge graph and each network threat intelligence report text P in the example library is calculated using the k-nearest neighbor algorithm.

[0032] In a specific embodiment of the present invention, the text embedding model is specifically the Sentence-BERT model.

[0033] Preferably, the step of sequentially performing coarse-grained type classification and fine-grained semantic matching on entities in a plurality of security knowledge triple lists A to generate a plurality of aligned security knowledge triple lists B specifically includes the following steps: Perform coarse-grained type classification on all entities in several security knowledge triple lists A to obtain several sets of entity lists. Calculate the semantic similarity between each pair of entities in each set of entity lists. If the semantic similarity is not less than a preset threshold, merge the corresponding two entities into a standardized entity. Update the standardized entity to security knowledge triple list A to generate several aligned security knowledge triple lists B.

[0034] This approach leverages a large language model for precise entity classification, limiting merging to entities of the same type to eliminate the risk of erroneous merging of entities of different types. Within each type group, highly correlated entities are further filtered using vector cosine similarity to ensure semantic accuracy during merging and avoid the semantic logic issues of triples that exist in existing technologies. Coarse-grained grouping decomposes global entities into subsets of the same type, calculating similarity only within subsets, significantly reducing the computational scope. Precise merging generates an aligned list B of security knowledge triples, unifying entities with multiple expressions of the same concept into a standardized form, eliminating redundancy and ambiguity, and improving data consistency. This provides a high-quality data foundation for downstream applications such as security knowledge reasoning, threat detection, and vulnerability retrieval, avoiding inference bias and low retrieval hit rates caused by data noise in existing technologies, and promoting the practical value of security knowledge.

[0035] In a specific embodiment of the present invention, the semantic similarity is cosine similarity, and the preset threshold is 0.80~0.9.

[0036] In a specific embodiment of the present invention, a method for constructing a cybersecurity knowledge graph based on a large language model includes three main stages executed sequentially. The input is a cybersecurity threat intelligence report text, and the final output is a cybersecurity knowledge graph. See [link to relevant documentation]. Figure 2 .

[0037] (1) Extraction of safety ternary set To fully leverage the ICL capabilities of LLM, a prompt needs to be constructed that includes a task description, a sample example, and a report to be analyzed. Specifically, this includes: A sample library is pre-built, where each entry contains a network threat intelligence report text annotated with entities and relationships, along with its corresponding security knowledge triples conforming to a specified ontology, in the form of <head entity, relationship, tail entity>. For the current input single network threat intelligence report text, a pre-trained text embedding model, such as Sentence-BERT, is used to convert it into a vector representation. The k-nearest neighbor (kNN) algorithm is used to calculate the semantic similarity between the current report vector and all report vectors in the sample library, typically using cosine similarity. The top k reports with the highest semantic similarity are selected as example reports. These selected k example reports are then sorted from highest to lowest similarity to the input single network threat intelligence report text, i.e., the most similar ones. Examples are placed close to the input text to be analyzed to leverage the "recency bias" effect of LLM to improve learning performance. Hints are assembled according to a specific template, including [task instructions] (explicitly requiring the extraction of which types of entities and relations, output format such as JSON or list), [k sequentially arranged example texts] (each example containing a fragment of the original text and its corresponding list of triples), and [the report text to be analyzed]. The assembled hints are input into a large language model, such as DeepSeek-R1. Based on the task instructions and example reports in the hints, LLM directly outputs a list of all structured security knowledge triples that conform to the specified ontology extracted from the input report through a single inference process.

[0038] In a specific embodiment of the present invention, the assembly instructions are as follows: [Task Instructions] Instruction: You are a cybersecurity knowledge extraction expert. Please carefully read the following cybersecurity report text and extract all entity relationship triples that conform to the following cybersecurity ontology.

[0039] Ontology definition: Entity Types: [Lists allowed entity types, such as: Attacker, Malware, Vulnerability, Target, Tool, etc.] Relationship Types: [Lists allowed relationship types, such as: Exploits, Attacks, IsA, Uses, Impacts, Targets, etc.] Output requirements: Output a list in JSON format, where each item is a dictionary {'head': head entity, 'relation': relation type, 'tail': tail entity}. Only output relationships that are explicitly stated or strongly implied in the report.

[0040] [Example] (Sorted by similarity from highest to lowest) Example report text 1: [Report text snippet 1] Corresponding triple 1: [{'head':'Entity A','relation':'Relation X','tail':'Entity B'},{'head':'Entity C','relation':'Relation Y','tail':'Entity D'},...] Example report text 2: [Report text snippet 2] Corresponding triple 2: [{'head':'Entity E','relation':'Relation Z','tail':'Entity F'},...] Example report text k: [Report text fragment k] Corresponding triple k: [...] [Report text to be analyzed] Report text: [Complete input report text to be processed] Input the assembled prompts into DeepSeek-R1. Based on contextual learning, it understands the task requirements (from the ontology definition), mimics the format of the example report, extracts all the triples that meet the requirements from the input report text to be analyzed at once, and outputs them in the specified JSON format.

[0041] (2) Hierarchical entity alignment The list of triples extracted from (1) security triples (containing potentially redundant or inconsistent entity references) is used as input for coarse-grained entity type grouping and fine-grained semantic merging. The coarse-grained entity type grouping specifically includes the following steps: Constructing an entity type annotation hint, including: [Task Instruction] (listing all entity types and definitions defined in the ontology), [Several Examples] (each example provides a <head entity, relation, tail entity> triple, and annotates the type labels of the head entity and tail entity), and [List of Triples to be Annotated] (i.e., all triples output in the first stage). This hint is input into the LLM. Based on ICL capabilities, the LLM predicts the entity type to which each entity reference in the triple list belongs, and groups all entity references according to the predicted entity type. This step ensures that subsequent merging only occurs between entity references of the same type, avoiding incorrect merging of entities of different types due to similar names.

[0042] In a specific embodiment of the present invention, the coarse-grained entity type grouping is carried out in the following manner: Input the list of triples (<mention 1, relation, mention 2> list) output by the secure triple extraction module, and construct the following hint: [Task Instructions] Instruction: You are an entity type annotation tool. Please annotate the type of the head and tail entities in each triple in the list below, based on the following network security ontology definition.

[0043] Ontology definition: Entity Type: [List of types defined in the security triple extraction module, such as: Attacker, Malware, ...] Output requirements: For each triple, output a dictionary: {'head':'Entity mention','head_type':'Entity type','relation':'Relation type','tail':'Entity mention','tail_type':'Entity type'}. Keep the original entity mention text unchanged.

[0044] [Example] Input triple: {'head':'APT29','relation':'Uses','tail':'WellMail'} Output annotation: {'head':'APT29','head_type':'Attacker','relation':'Uses','tail':'WellMail','tail_type':'Malware'} Input triple: {'head':'CVE-2023-1234','relation':'Impacts','tail':'ExchangeServer'} Output annotation: {'head':'CVE-2023-1234','head_type':'Vulnerability','relation':'Impacts','tail':'ExchangeServer','tail_type':'Target'} (Assuming the target type includes software products) [List of triplets to be labeled] [Triplet 1, Triplet 2, Triplet 3, ...] The prompt will lead to LLM. LLM predicts and labels the type of the head and tail entity mentions for each triple in the input list. It collects all labeled triples and groups all entity mentions (regardless of whether they are head or tail) by type based on head_type and tail_type. For example, all mentions of type "Malware" are put into one group, and all mentions of type "Attacker" are put into another group.

[0045] Fine-grained semantic merging specifically includes the following steps: using a pre-trained entity embedding model (such as BERT) to convert the text of each entity mention into a vector representation; calculating the semantic similarity (such as cosine similarity) between all entity mention vectors within a group; setting a similarity threshold θ; and merging entity mention pairs with similarity exceeding the threshold into the same standard entity. The merging strategy can be to select the most complete representation as the standard form or to create a new unified identifier; the standardized entity set after type grouping and merging of the same type; and the updated list of triples (in which entity mentions have been replaced with the corresponding standardized entities).

[0046] In a specific embodiment of the present invention, the similarity threshold θ is a configurable hyperparameter, for example, 0.85, the optimal value of which can be determined experimentally. A clustering algorithm (such as hierarchical clustering or DBSCAN) or an iterative merging strategy is used: all mention pairs are traversed, and if the similarity is ≥ θ, the two mentions are merged into the same normalized entity. During merging, the most complete or most normalized mention text within the group is typically selected as the representative name of the normalized entity, or a new unique identifier (ID) is created. All mentions within the group are mapped to this normalized entity; finally, the original triplet list is traversed, and the entity mentions are replaced with the corresponding normalized entities to generate the final aligned triplet list.

[0047] (3) Long-distance relationship prediction The entity-aligned triple list (which constitutes a preliminary knowledge graph and may contain multiple connected subgraphs) output from (2) is used as input for central entity identification: The current list of triples is constructed into a knowledge graph, with standardized entities as nodes and relationships as edges. Connected components are identified in the graph, and the degree of each node in each connected component is calculated, which is the number of edges connected to that node. The node with the highest degree is selected as the core entity of that component. Among the core entities of all components, the core entity with the highest degree is selected as the thematic core entity of the entire report's knowledge graph, which usually represents the core discussion object of the report (such as the main attacker or critical vulnerability).

[0048] For each combination of subgraph central entity and topic central entity, implicit relationship reasoning is performed: if there is no direct relationship edge between them, a relationship reasoning hint is constructed, including: [task instruction] (requiring inference of the potential relationship between two given entities), [context] (extracting key text fragments related to these two entities from the original input report as the basis for reasoning), and [demonstration example] (demonstrating how to infer the relationship between two entities based on context and outputting triples). The assembled hint is input into LLM. LLM analyzes the provided context clues based on ICL capabilities and predicts the possible relationship type between the central entity pair. If LLM predicts a valid relationship (not "no relationship"), the corresponding triple <subgraph central entity, predicted relationship, topic central entity> or <topic central entity, predicted relationship, subgraph central entity> is output. Finally, a final triple list supplementing the implicit long-distance relationship triples is output.

[0049] In a specific embodiment of the present invention, the central entity is identified in the following manner: Construct a graph structure G from the input list of triples: nodes = normalized entities, edges = relations. Use graph theory algorithms to identify all connected subgraphs {C1, C2, ..., CN} in graph G. Calculate the degree of each node in each connected subgraph Ci. Select the node with the highest degree in Ci as the central entity Cei of that subgraph. If multiple nodes with the same highest degree exist, one can be chosen at random or selected based on other centrality indicators (such as betweenness centrality). Among all subgraph central entities {CE1, CE2, ..., CEN}, select the central entity with the highest degree as the subject central entity TCE of the entire report. If TCE is already the central entity of a subgraph, there is no need to select it again.

[0050] In a specific embodiment of the present invention, the implicit relationship reasoning for the combination of each subgraph central entity and topic central entity is performed as follows: if CEi == TCE, then skip it, assuming there is no relationship; otherwise, check whether there is a direct relationship edge between CEi and TCE in the current knowledge graph. If there is no direct relationship, extract paragraphs or sentences containing CEi and TCE from the original input report text as the context for reasoning. If the text is too long, key parts can be truncated.

[0051] Construction hints: [Task Instructions] Instruction: You are a cybersecurity relationship reasoning expert. Based on the following cyber threat intelligence report excerpt (context), infer what kind of direct relationship (if it exists) might exist between entity [Entity A] and entity [Entity B].

[0052] Ontology relation constraints: Only consider the following relation types: [List allowed relation types, such as Exploits, Attacks, IsA, Uses, Impacts, Targets]. If none of these relations can be inferred from the context, output "No relation".

[0053] Output requirements: If a relation exists, output a dictionary of triples: {'head':'[entity A or entity B]','relation':'relation type','tail':'[another entity]'}. If no relation exists, output "no relation".

[0054] [Example] Context: [Example 1 of report snippet, which mentions entity X and entity Y, but does not explicitly state their relationship] Entity A: Entity X Entity B: Entity Y Inference result: {'head':'Entity X','relation':'Use','tail':'Entity Y'} / / or "No relation" Context: [Report snippet example 2...] Entity A:... Entity B:... Inference result:... [Current Task Context] Context: [Text snippets involving CEi and TCE extracted from the original report] Entity A: [The normalized entity name of CEi] Entity B: [TCE's standardized entity name] The assembled prompt is input into the LLM. The LLM analyzes the provided context, combines cybersecurity knowledge and ontology constraints, and predicts the possible direct relationship between CEi and TCE. If the LLM outputs a valid triple (not "no relationship"), the triple is added to the final triple list.

[0055] This method effectively improves the construction quality of cybersecurity knowledge graphs by organically combining contextual learning from large language models with hierarchical post-processing strategies, while reducing data dependence and increasing flexibility. Specifically, it integrates all triples obtained from the three stages (original extraction, entity alignment, and supplementary long-distance relationships) to construct a complete, high-quality cybersecurity knowledge graph, including standardized entity and relationship sets, supporting subsequent visualization and intelligent analysis applications. Through the organic combination of these three stages, a complete pipeline from raw text to a high-quality knowledge graph is formed, enabling deep analysis and knowledge fusion of cybersecurity texts.

[0056] With only a small number (k) of high-quality labeled samples provided in the example library as examples, LLM can learn new extraction patterns through prompts. When it is necessary to adapt to new cybersecurity ontology (adding / modifying entity / relationship types) or to address emerging threat terminology, there is no need to retrain or fine-tune the LLM model itself. Only the example cases in the example library (containing annotations under the new ontology definition) and the ontology description in the task instructions need to be updated. This greatly reduces the dependence on large-scale labeled data and enables rapid ontology migration and terminology updates, overcoming the problems of traditional rule-based methods requiring frequent manual rule updates and fine-tuning methods requiring retraining with a large amount of new labeled data.

[0057] Based on the same inventive concept, this invention also provides a network security knowledge graph construction system based on a large language model, comprising: The first module is used to extract a list A of security knowledge triples from the network threat intelligence report text Q using a large language model; The second module is used to perform coarse-grained type classification and fine-grained semantic matching on the entities of several security knowledge triple lists A in sequence, and generate several aligned security knowledge triple lists B. The third module is used to transform a list B of security knowledge triples into N subgraphs, and to identify the central entity CE1~CE of each subgraph. N The central entity CE with the largest degree a As the central entity TCE of the main graph, if there are no direct relationship edges between the central entity Ce and the central entity TCE, where i takes values ​​from 1 to N and i ≠ a, then extract the data containing the central entity Ce from the network threat intelligence report text Q to be generated for the network security knowledge graph. i And the text of the central entity TCE, to obtain the central entity Ce i The implicit relationship with the central entity TCE is used to generate a cybersecurity knowledge graph of the network threat intelligence report text Q.

[0058] Based on the same inventive concept, this application provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of a method for constructing a network security knowledge graph based on a large language model. The memory may include main memory, such as high-speed random access memory, or it may also include non-volatile memory, such as at least one disk storage device. The processor, network interface, and memory are interconnected via an internal bus, which may be an industry-standard architecture bus, a peripheral component interconnection standard bus, an extended industry-standard architecture bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory is used to store the program; specifically, the program may include program code, which includes computer operation instructions. The memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0059] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the method for constructing a network security knowledge graph based on a large language model. Specifically, the computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. The volatile memory may include RAM (Random Access Memory) and / or cache memory, etc. The non-volatile memory may include ROM (Read-Only Memory), hard disk, flash memory, optical disk, magnetic disk, etc.

[0060] Based on the same inventive concept, this application provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer device, cause the computer device to perform the steps of the above-described method for constructing a network security knowledge graph based on a large language model.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM (Compact Disc Read-Only Memory), optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] Finally, it should be noted that the embodiments listed above are merely one or more specific manifestations of the technical solution of this invention. Their purpose is to clearly illustrate the concept, principle, and application of this invention through specific examples, and is by no means intended to limit the scope of protection of this invention to these specific embodiments. In fact, the true value of this invention lies in its proposed technical ideas and innovations, rather than its manifestations or implementation methods.

[0066] For those skilled in the art, after thoroughly reading and understanding the technical solution of this invention, they are fully capable of making various changes, modifications, or equivalent substitutions to the specific implementation of the invention based on their own professional knowledge and skills. These changes may include, but are not limited to: adjusting the range of technical parameters, optimizing the algorithm flow to improve efficiency, and replacing some technical components to achieve better compatibility or reduce costs. As long as these modified technical solutions substantially retain the technical features claimed by the original invention, that is, they can still achieve the core functions and effects of this invention, then these changes should be considered to fall within the scope of protection of the pending claims of this invention.

[0067] Furthermore, with the continuous progress and development of technology, new technical means and methods are constantly emerging, which provides ample space for further improvement and perfection of this invention. Therefore, the scope of protection of this invention should also include reasonable and foresightful improvements and extensions based on existing technology. As long as these improvements and extensions do not depart from the basic principles and core concepts of this invention, they should be considered equivalents of this invention and are equally protected by patent rights.

Claims

1. A method for constructing a cybersecurity knowledge graph based on a large language model, characterized in that, Includes the following steps: Step 1: Extract a list A of security knowledge triples from the network threat intelligence report text Q using a large language model; Step 2: Perform coarse-grained type classification and fine-grained semantic matching on the entities in several security knowledge triple lists A in sequence to generate several aligned security knowledge triple lists B; Step 3: Transform the list B of several security knowledge triples into N subgraphs, and identify the central entity CE1~CE in each subgraph. N The central entity CE with the largest degree a As the central entity TCE of the main graph, if there are no direct relationship edges between the central entity Ce and the central entity TCE, where i takes values ​​from 1 to N and i ≠ a, then extract the data containing the central entity Ce from the network threat intelligence report text Q to be generated for the network security knowledge graph. i And the text of the central entity TCE, to obtain the central entity Ce i The implicit relationship with the central entity TCE is used to generate a cybersecurity knowledge graph of the network threat intelligence report text Q.

2. The method for constructing a network security knowledge graph based on a large language model according to claim 1, characterized in that, The extraction of a list A of security knowledge triples from the network threat intelligence report text Q using a large language model specifically includes the following steps: Construct an example library containing several network threat intelligence report texts P with labeled entities and relationships, along with a list of security knowledge triples. Calculate the semantic similarity between the network threat intelligence report text Q to be generated for the network security knowledge graph and each network threat intelligence report text P in the example library. Sort the network threat intelligence report texts P in descending order of semantic similarity, and use the top K network threat intelligence report texts P as example reports. Extract a list A of several security knowledge triples from the network threat intelligence report text Q using a large language model.

3. The method for constructing a network security knowledge graph based on a large language model according to claim 2, characterized in that, The semantic similarity is cosine similarity; the network threat intelligence report texts P in the example library are all vector representations. The semantic similarity between the network threat intelligence report text Q to be generated for the network security knowledge graph and each network threat intelligence report text P in the example library is calculated, specifically including the following steps: The network threat intelligence report text Q is transformed into a vector representation using a pre-trained text embedding model. Based on the vector representations of each network threat intelligence report text P and the network threat intelligence report text Q, the semantic similarity between the network threat intelligence report text Q to be generated in the network security knowledge graph and each network threat intelligence report text P in the example library is calculated using the k-nearest neighbor algorithm.

4. The method for constructing a network security knowledge graph based on a large language model according to claim 3, characterized in that, The text embedding model is specifically the Sentence-BERT model.

5. The method for constructing a network security knowledge graph based on a large language model according to claim 1, characterized in that, The process of sequentially performing coarse-grained type classification and fine-grained semantic matching on entities in a list of security knowledge triples A to generate a list of aligned security knowledge triples B includes the following steps: Perform coarse-grained type classification on all entities in several security knowledge triple lists A to obtain several sets of entity lists. Calculate the semantic similarity between each pair of entities in each set of entity lists. If the semantic similarity is not less than a preset threshold, merge the corresponding two entities into a standardized entity. Update the standardized entity to security knowledge triple list A to generate several aligned security knowledge triple lists B.

6. The method for constructing a network security knowledge graph based on a large language model according to claim 5, characterized in that, The semantic similarity is cosine similarity, with a preset threshold of 0.80~0.

9.

7. A network security knowledge graph construction system based on a large language model, characterized in that, include: The first module is used to extract a list A of security knowledge triples from the network threat intelligence report text Q using a large language model; The second module is used to perform coarse-grained type classification and fine-grained semantic matching on the entities of several security knowledge triple lists A in sequence, and generate several aligned security knowledge triple lists B. The third module is used to transform a list B of security knowledge triples into N subgraphs, and to identify the central entity CE1~CE of each subgraph. N The central entity CE with the largest degree a As the central entity TCE of the main graph, if there are no direct relationship edges between the central entity Ce and the central entity TCE, where i takes values ​​from 1 to N and i ≠ a, then extract the data containing the central entity Ce from the network threat intelligence report text Q to be generated for the network security knowledge graph. i And the text of the central entity TCE, to obtain the central entity Ce i The implicit relationship with the central entity TCE is used to generate a cybersecurity knowledge graph of the network threat intelligence report text Q.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the network security knowledge graph construction method based on a large language model as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method for constructing a network security knowledge graph based on a large language model as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the method for constructing a network security knowledge graph based on a large language model as described in any one of claims 1 to 6.

Images