Network security sensitive event joint extraction method based on compensation path planning strategy and hybrid neural network

Abstract

The invention relates to the technical field of natural language processing, in particular to a network security sensitive event joint extraction method based on a compensation path planning strategy and a hybrid neural network, and the method comprises the steps: obtaining text data, audio data, picture data and video data in the field of network security; the text data is preprocessed, the preprocessed text data is trained to obtain word vectors, and the word vectors can link context semantic information; an ECA-ATT neural network is utilized to preprocess the audio data and the video data, and an MLP-Mixer neural network is utilized to preprocess the picture data; and fusing the word vector, the preprocessed audio data, the preprocessed picture data and the preprocessed video data, inputting the fused data into a hybrid neural network established based on a word graph visual attention mechanism, and outputting a network security sensitive event. The website content is monitored and early warned in real time, and bad information is effectively recognized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of natural language processing, and particularly relates to a network security sensitive event joint extraction method based on a compensation path planning strategy and a hybrid neural network. BACKGROUND

[0002] With the full popularization of 5G technology and the steady progress of 6G network research and development, information communication technology is reshaping social operation at an unprecedented speed. In this digital wave, as an important base for talent training and scientific research and innovation, the security of the network environment of the campus not only concerns the physical and mental health and privacy rights and interests of the majority of teachers and students, but also directly involves the security protection of state secrets and core data. In the face of increasingly complex network threats and attack means, building an efficient and accurate network security event identification and response mechanism has become an urgent need to maintain the stability of the education system and support the national network security strategy.

[0003] Currently, event extraction, as a key technology in natural language processing, still faces significant challenges in the field of network security. Although existing research has achieved good results in the extraction of simple network security sensitive events, most of the work focuses too much on such easily handled scenarios, ignoring the more practically meaningful but difficult to break through complex events, especially the extraction of nested events. This leads to a significant performance decline in existing methods in real-world scenarios, especially when complex events dominate in the document. Therefore, how to achieve high-precision and robust sensitive event joint extraction in complex network environments has become a core technical bottleneck that needs to be solved in this field. SUMMARY

[0004] In view of the technical problem of insufficient recognition accuracy of nested and complex network security sensitive events in complex network environments, a network security sensitive event joint extraction method based on a compensation path planning strategy and a hybrid neural network is provided. The present application mainly uses ECA-ATT neural network and MLP-Mixer neural network to classify and identify videos and pictures respectively, uses TexMind to analyze text, fine-tunes Word2Vec to generate word vectors, uses ECA-ATT to analyze audio and video, and uses MLP-Mixer to process pictures, so as to realize real-time monitoring and early warning of the content of the campus website and the external website visited by the campus user, effectively identify and intercept bad information, maintain the healthy and orderly campus network environment, and protect the physical and mental health and safety of the student group.

[0005] The technical means adopted by the present application are as follows: A network security sensitive event joint extraction method based on a compensation path planning strategy and a hybrid neural network comprises the following steps: Text data, audio data, picture data and video data in the field of network security are acquired; The text data is preprocessed, and the preprocessed text data is trained to obtain a word vector, which can associate context semantic information; The audio data and video data are preprocessed by using an ECA-ATT neural network, and the picture data is preprocessed by using an MLP-Mixer neural network; The word vector, preprocessed audio data, preprocessed picture data and preprocessed video data are fused, and the fused data is input into a hybrid neural network based on a character-image-visual attention mechanism to output a network security sensitive event, The character-image-visual attention mechanism includes a character-level attention mechanism, a picture-level attention mechanism, a self-attention mechanism and a visual-level attention mechanism.

[0006] Further, the preprocessing step of the picture data includes: The picture data is divided into a plurality of image blocks, and each image block is converted into a corresponding block vector; The block vector is input into a block-by-block fully connected layer to obtain initial projection features; The initial projection features are input into an MLP-Mixer module to mix information between channels and image blocks; A global average pooling operation is performed on the features output by the MLP-Mixer module to generate a global feature vector; The global feature vector is input into a fully connected layer to obtain the preprocessed picture data.

[0007] Further, the preprocessing steps of the audio data and video data include: First, the audio data is converted into text data by using a recurrent neural network, and the text data and video data are input into an efficient channel attention mechanism neural network; Second, the input data is subjected to a global average pooling operation to obtain a channel vector; Subsequently, an adaptive one-dimensional convolution kernel is used to perform a convolution operation on the channel vector in the channel dimension, and the convolution result is substituted into a Sigmoid function to generate attention weights; Finally, the obtained attention weights are multiplied in the channel dimension to weight each channel, and the preprocessed audio data and preprocessed picture data are obtained.

[0008] Further, the Sigmoid function is:

[0009] wherein, is an input to a Sigmoid function argument, is an output result of the Sigmoid function, The calculation formula of the attention weight is:

[0010] wherein, is an input data input into a calculation process composed of a Sigmoid function and a one-dimensional convolution operation, C1Dk(·) is a one-dimensional convolution, and σ(·) is a Sigmoid function, is an attention weight.

[0011] Further, the pre-processing of the text data and the training of the pre-processed text data to obtain a word vector comprise: The bank document format campus network security sensitive event text is dynamically analyzed and pre-processed by using a text analysis tool TexMind; The pre-processed text is input into a Word2Vec model fine-tuned by a domain text to perform training; A word vector containing context semantic information is generated.

[0012] Further, the character-level attention mechanism does not destroy the integrity of the text context semantics, and calculates the difference between the similar characters in the classified data text; Based on the difference, different attention weights are assigned to different similar characters to distinguish them at the feature representation level; The weighted character-level features are output for downstream task training.

[0013] Further, the calculation formula of the attention weight is as follows:

[0014]

[0015]

[0016]

[0017] wherein, is an input parameter, is an inner product transformation of a weight vector W and a transformed feature S, is an attention de-weighting corresponding to the i-th feature, is a weighted feature representation, is a final feature representation, is an attention de-weighting.

[0018] Further, the workflow of the mixed neural network is as follows: The event trigger word in the classified data is identified by using the BERT model; For simple events, a combined model composed of a relation convolutional neural network and a bidirectional long short-term memory network is used for identification; For complex events, a combined model composed of a bidirectional gated recurrent unit and a multi-head attention mechanism is used for identification; Through compensation path planning, the shortcut path and the word density are combined to interact, and the word segment is repeatedly scanned for compensation scanning, so as to improve the identification accuracy of complex and nested network security sensitive events; The simple event identification result and the complex event identification result are output through an exponential normalization function, and the network security sensitive event is output.

[0019] Compared with the prior art, the present application has the following advantages: 1、The present application classifies and identifies video and picture through ECA-ATT neural network and MLP-Mixer neural network, so as to monitor and warn in real time the content of the external website visited by the campus website and the campus user, and effectively identify and intercept bad information.

[0020] 2、The present application extracts network security sensitive events in order to monitor and alarm the content of the campus website and the website visited by the campus, maintain the normal order of the campus, and protect the physical and mental health of students.

[0021] Based on the above reasons, the present application can be widely popularized in the field of natural language processing. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0023] Figure 1 The pre-processing schematic diagram of audio data, picture data and video data in the network security sensitive event joint extraction method based on compensation path planning strategy and mixed neural network of the present application.

[0024] Figure 2 The construction schematic diagram of word vector of the embodiment of the present application.

[0025] Figure 3 The interaction schematic diagram of word graph visual attention mechanism of the embodiment of the present application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification and claims of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products, or devices.

[0028] This invention provides a method for jointly extracting network security sensitive events based on a compensatory path planning strategy and a hybrid neural network, the specific steps of which are as follows: S1. Acquire text, audio, image, and video data in the field of cybersecurity.

[0029] In this embodiment, the information on sensitive events related to campus network security is extracted from the campus website and websites accessed by the campus.

[0030] S2. Preprocess the text data, train the preprocessed text data to obtain word vectors, and the word vectors can link the semantic information of the context.

[0031] Specifically, such as Figure 2 As shown, S2 includes: S21. Use the text parsing tool TeXMind to dynamically parse and preprocess the text of sensitive campus network security incidents in the format of bank documents.

[0032] S22. Input the preprocessed text into the Word2Vec model, which has been fine-tuned with domain text, for training.

[0033] S23. Generate word vectors that contain contextual semantic information.

[0034] From a mathematical perspective, multiplication and exponentiation increase the weight of a single word vector, thereby improving recognition accuracy. From a linguistic perspective, the S2 step enhances the meaning of a word vector within its context (the same word can have different meanings in different linguistic environments), determining the specific role of the word / character in the text and thus improving the recognition rate.

[0035] S3. Use the ECA-ATT neural network to preprocess the audio and video data, and use the MLP-Mixer neural network to preprocess the image data.

[0036] In S3, the introduction of audio and video data essentially means converting audio and video into word vectors, which are then concatenated with text word vectors to enrich the contextual semantics, increase the weight of word vectors, and provide important support for downstream classification tasks.

[0037] like Figure 1 As shown, the preprocessing steps for image data include: The first step is to divide the image data into multiple image blocks and convert each image block into a corresponding block vector.

[0038] The second step is to input the block vectors into the block-by-block fully connected layer to obtain the initial projected features.

[0039] The third step is to input the initial projection features into the MLP-Mixer module to mix information between channels and image blocks.

[0040] The fourth step is to perform global average pooling on the features output by the MLP-Mixer module to generate a global feature vector.

[0041] Step 5: Input the global feature vector into the fully connected layer to obtain the preprocessed image data.

[0042] like Figure 1 As shown, the preprocessing steps for audio and video data include: First, a recurrent neural network is used to convert audio data into text data, and then the text data and video data are input into an efficient channel attention mechanism neural network. Secondly, the input data is subjected to global average pooling to obtain the channel vector; Subsequently, an adaptive one-dimensional convolution kernel is used to perform convolution operation on the channel vector in the channel dimension, and the result of the convolution is substituted into the Sigmoid function to generate attention weights; Finally, the obtained attention weights are multiplied along the channel dimension, and each channel is weighted to obtain the preprocessed audio data and preprocessed image data.

[0043] Furthermore, the Sigmoid function is:

[0044] in, The input to the Sigmoid function is the argument. This is the output of the Sigmoid function.

[0045] The formula for calculating attention weights is:

[0046] in, For the input data in the computation process consisting of the sigmoid function and one-dimensional convolution operation, C1Dk(·) is the one-dimensional convolution, and σ(·) is the sigmoid function. For attention weights.

[0047] Specifically, the efficient channel attention mechanism neural network (ECA-ATT) with the sigmoid method is combined with the attention mechanism to analyze relevant illegal videos frame by frame through a method of non-dimensionality reduction local channels and adaptive selection of one-dimensional convolution kernel size.

[0048] S4. The word vectors, preprocessed audio data, preprocessed image data, and preprocessed video data are fused together. The fused data is then input into a hybrid neural network built on a word-graph-view attention mechanism to output network security sensitive events.

[0049] Specifically, word-image-view attention mechanisms include character-level attention mechanisms, image-level attention mechanisms, self-attention mechanisms, and view-level attention mechanisms. For example... Figure 3 As shown, the character-level attention mechanism, image-level attention mechanism, and view-level attention mechanism respectively add weights to the three types of word vectors to improve the recognition rate in the later stage.

[0050] The character-level attention mechanism, without compromising the semantic integrity of the text context, identifies similar-looking characters in the classified data and calculates the differences between them. Based on these differences, different attention weights are assigned to different similar-looking characters to distinguish them at the feature representation level. The weighted character-level features are then output for use in training downstream tasks.

[0051] Image-level attention and view-level attention are fine-tuning of the parameters of the self-attention mechanism. The self-attention mechanism further increases the weights to improve accuracy.

[0052] Furthermore, the formula for calculating attention weights is as follows:

[0053]

[0054]

[0055]

[0056] in, For input parameters, W t S is the inner product of the weight vector W and the transformed feature S. For the attention deweighting corresponding to the i-th feature, here B i and h i Multiply the two products and then sum them (note that this is an element-wise or dimension-wise weighted sum) to obtain the weighted r. i , This refers to the original features (or hidden state). This is a weighted feature representation (highlighting important features and suppressing irrelevant features to the greatest extent possible). To apply the tanh activation function to the weighted features r i The final feature representation is obtained by performing a nonlinear transformation. , Deweight attention.

[0057] Specifically, the workflow of a hybrid neural network is as follows: The first step is to use the BERT model to identify event trigger words in the categorized data.

[0058] The second step is to use a combined model consisting of a relational convolutional neural network (ReCNN) and a bidirectional long short-term memory network (BiLSTM) for identification of simple events.

[0059] The third step is to use a combined model consisting of a bidirectional gated recurrent unit (BiGRU) and a multi-head attention mechanism for identification of complex events.

[0060] The fourth step involves using compensated path planning, combining shortcut paths with word density, and repeatedly scanning word segments for compensated scanning to improve the accuracy of identifying complex and nested cybersecurity sensitive events.

[0061] Step 5: The results of simple event identification and complex event identification are normalized by an exponential function to output network security sensitive events.

[0062] The hybrid neural network described above adopts a strategy of independent modeling, that is, it designs a special training process for the different characteristics of simple events and complex events, which can effectively optimize model performance.

[0063] Different neural networks correspond to different data types. ReCNN is mainly trained on multiple videos (where video can undergo frame processing) and graphs, while BILSTM is trained on text and speech (where speech can be converted into text). For complex events, the parameters were fine-tuned, but no structural or sequential adjustments were made. The purpose of this fine-tuning step is to make the neural network more suitable for our task.

[0064] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security sensitive event joint extraction method based on a compensation path planning strategy and a hybrid neural network, characterized in that, The method comprises the following steps: obtaining text data, audio data, picture data and video data in the field of network security; preprocessing the text data, training the preprocessed text data to obtain word vectors, and the word vectors can associate context semantic information; using a high-efficiency channel attention mechanism neural network to preprocess the audio data and video data, and using an MLP-Mixer neural network to preprocess the picture data; fusing the word vectors, preprocessed audio data, preprocessed picture data and preprocessed video data, inputting the fused data into a hybrid neural network based on a character-graph-visual attention mechanism, and outputting network security sensitive events, the character-graph-visual attention mechanism comprises a character-level attention mechanism, a picture-level attention mechanism, a self-attention mechanism and a visual-level attention mechanism.

2. The method of claim 1, wherein, The preprocessing step of the picture data comprises: segmenting the picture data into multiple image blocks, and converting each image block into a corresponding block vector; inputting the block vector into a block-by-block fully connected layer to obtain initial projection features; inputting the initial projection features into an MLP-Mixer module to mix the information between channels and image blocks; performing a global average pooling operation on the features output by the MLP-Mixer module to generate a global feature vector; inputting the global feature vector into a fully connected layer to obtain the preprocessed picture data.

3. The method of claim 1, wherein, The preprocessing step of the audio data and video data comprises: first, converting the audio data into text data using a recurrent neural network, and inputting the text data and video data into a high-efficiency channel attention mechanism neural network; second, performing a global average pooling operation on the input data to obtain a channel vector; then, using an adaptive one-dimensional convolution kernel to perform a convolution operation on the channel vector in the channel dimension, and substituting the convolution result into a Sigmoid function to generate an attention weight; finally, multiplying the obtained attention weight in the channel dimension to weight each channel, and obtaining the preprocessed audio data, preprocessed picture data.

4. The method of claim 3, wherein, The Sigmoid function is: wherein, is the input to the Sigmoid function argument, is the output result of the Sigmoid function, The calculation formula of the attention weight is: wherein, is the input data to the computation process consisting of a Sigmoid function and a one-dimensional convolution operation, C1Dk(·) is a one-dimensional convolution, σ(·) is a Sigmoid function, is the attention weight.

5. The method of claim 1, wherein, The preprocessing of the text data and the training of the preprocessed text data to obtain the word vectors comprise: using a text analysis tool TexMind to dynamically analyze and preprocess the campus network security sensitive event text in the format of bank documents; inputting the preprocessed text into a Word2Vec model fine-tuned by the field text to train; generating word vectors containing context semantic information.

6. The method of claim 1, wherein, The character-level attention mechanism, without destroying the integrity of the text context semantics, calculates the difference between the homographic characters in the classified text and assigns different attention weights to different homographic characters to distinguish them at the feature representation level. The calculation formula of the attention weight is as follows: The workflow of the hybrid neural network is:

7. The method of claim 6, wherein, ​ wherein, is an input parameter, is an inner product transformation of the weight vector W and the transformed feature S, is the attention de-weighting corresponding to the i-th feature, is the weighted feature representation, is the final feature representation, is the attention de-weighting.

8. The method of claim 1, wherein, ​ The event trigger word in the classified data is identified by using a BERT model; For simple events, a combined model composed of a relation convolutional neural network and a bidirectional long short-term memory network is used for identification; For complex events, a combined model composed of a bidirectional gated recurrent unit and a multi-head attention mechanism is used for identification; Through compensation path planning, the shortcut path and the word density are combined to interact with each other, and the word segment is repeatedly scanned for compensation scanning, so as to improve the identification accuracy of complex and nested network security sensitive events; The simple event identification result and the complex event identification result are output through an exponential normalization function, and a network security sensitive event is output.

Images