A network security sensitive event joint extraction method based on a compensation path planning strategy and a hybrid neural network
By employing compensated path planning and hybrid neural network methods, the challenge of identifying nested events in complex network environments was solved, enabling real-time monitoring and early warning of the campus network environment, improving identification accuracy, and ensuring student safety.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- DALIAN VOCATIONAL & TECHNICAL COLLEGE (DALIAN OPEN UNIVERSITY)
- Filing Date
- 2025-10-22
- Publication Date
- 2026-05-29
AI Technical Summary
Existing technologies struggle to accurately and robustly identify and extract nested network security sensitive events in complex network environments, exhibiting significant performance degradation, especially in real-world scenarios.
This study employs a method based on a compensatory path planning strategy and a hybrid neural network. It preprocesses video, audio, and images using ECA-ATT neural networks and MLP-Mixer neural networks, combines TextMind to parse text and generate word vectors, and utilizes a hybrid neural network with a word-image-view attention mechanism for event recognition to achieve real-time monitoring and early warning of the campus network environment.
It effectively identifies and blocks harmful information, maintains a healthy and orderly campus network environment, protects the physical and mental health and safety of students, and improves the accuracy of identifying complex events.
Smart Images
Figure CN121350334B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of natural language processing technology, and in particular to a method for jointly extracting network security sensitive events based on a compensation path planning strategy and a hybrid neural network. Background Technology
[0002] With the widespread adoption of 5G technology and its penetration into every household, and the steady progress of 6G network research and development, information and communication technologies are reshaping the way society operates at an unprecedented pace. In this digital wave, the security of the network environment on campuses, as crucial bases for talent cultivation and scientific research innovation, not only concerns the physical and mental health and privacy rights of teachers and students, but also directly involves the security of national secrets and core data. Faced with increasingly complex network threats and attack methods, building an efficient and accurate network security incident identification and response mechanism has become an urgent need to maintain the stability of the education system and support the national cybersecurity strategy.
[0003] Currently, event extraction, a key technology in natural language processing, still faces significant challenges in its application in the field of cybersecurity. Although existing research has achieved good results in extracting simple cybersecurity sensitive events, most works focus excessively on these easily handled scenarios, neglecting the more realistic but difficult-to-handle complex events—especially the extraction of nested events. This leads to a significant performance degradation of existing methods in real-world scenarios, particularly when complex events dominate in documents. Therefore, how to achieve high-precision and robust joint extraction of sensitive events in network environments with frequent complex events has become a core technical bottleneck that urgently needs to be addressed in this field. Summary of the Invention
[0004] To address the aforementioned technical problem of insufficient accuracy in identifying nested and complex network security sensitive events in complex network environments, this invention provides a joint extraction method for network security sensitive events based on a compensatory path planning strategy and a hybrid neural network. This invention primarily utilizes ECA-ATT neural networks and MLP-Mixer neural networks for video and image classification and recognition, respectively; TextMind for text parsing; Word2Vec for word vector generation; ECA-ATT for audio and video parsing; and MLP-Mixer for image processing. This enables real-time monitoring and early warning of content on campus websites and external websites accessed by campus users, effectively identifying and blocking harmful information, maintaining a healthy and orderly campus network environment, and protecting the physical and mental health and safety of students.
[0005] The technical means employed in this invention are as follows:
[0006] A method for jointly extracting network security sensitive events based on a compensation path planning strategy and a hybrid neural network includes the following steps:
[0007] Acquire text, audio, image, and video data in the field of cybersecurity;
[0008] The text data is preprocessed, and the preprocessed text data is trained to obtain word vectors, which can link contextual semantic information.
[0009] The audio and video data are preprocessed using the ECA-ATT neural network, and the image data is preprocessed using the MLP-Mixer neural network.
[0010] The algorithm fuses word vectors, preprocessed audio data, preprocessed image data, and preprocessed video data. The fused data is then input into a hybrid neural network built on a word-graph-view attention mechanism, outputting information about cybersecurity sensitive events.
[0011] The character-image-view attention mechanism includes character-level attention mechanism, image-level attention mechanism, self-attention mechanism, and view-level attention mechanism.
[0012] Furthermore, the preprocessing steps for the image data include:
[0013] The image data is divided into multiple image blocks, and each image block is converted into a corresponding block vector;
[0014] The block vectors are input into a block-by-block fully connected layer to obtain the initial projection features;
[0015] The initial projection features are input into the MLP-Mixer module to mix information between channels and image blocks;
[0016] Perform global average pooling on the features output by the MLP-Mixer module to generate a global feature vector;
[0017] The global feature vector is input into a fully connected layer to obtain preprocessed image data.
[0018] Furthermore, the preprocessing steps for the audio and video data include:
[0019] First, the audio data is converted into text data using a recurrent neural network, and the text data and video data are then input into an efficient channel attention mechanism neural network.
[0020] Secondly, the input data is subjected to global average pooling to obtain the channel vector;
[0021] Subsequently, an adaptive one-dimensional convolution kernel is used to perform a convolution operation on the channel vector in the channel dimension, and the result of the convolution is substituted into the Sigmoid function to generate attention weights.
[0022] Finally, the obtained attention weights are multiplied along the channel dimension, and each channel is weighted to obtain the preprocessed audio data and preprocessed image data.
[0023] Furthermore, the Sigmoid function is:
[0024]
[0025] in, The input to the Sigmoid function is the argument. This is the output of the Sigmoid function.
[0026] The formula for calculating the attention weight is:
[0027]
[0028] in, For the input data in the computation process consisting of the sigmoid function and one-dimensional convolution operation, C1Dk(·) is the one-dimensional convolution, and σ(·) is the sigmoid function. This represents the attention weight.
[0029] Furthermore, the preprocessing of the text data, followed by training the preprocessed text data to obtain word vectors, includes:
[0030] The TextMind text parsing tool was used to dynamically parse and preprocess sensitive campus network security incident texts in the format of bank official documents;
[0031] The preprocessed text is input into a Word2Vec model that has been fine-tuned with domain text for training.
[0032] Generate word vectors that contain contextual semantic information.
[0033] Furthermore, the character-level attention mechanism, without compromising the semantic integrity of the text context, identifies similar-looking characters in the classified data and calculates the differences between these similar-looking characters.
[0034] Based on the aforementioned differences, different attention weights are assigned to different similar-looking characters in order to distinguish them at the feature representation level;
[0035] The weighted character-level features are output for use in training downstream tasks.
[0036] Furthermore, the formula for calculating the attention weight is as follows:
[0037]
[0038]
[0039]
[0040]
[0041] in, For input parameters, The transformation is the inner product of the weight vector W and the transformed feature S. Weight the attention corresponding to the i-th feature. This is the weighted feature representation. For the final feature representation, Deweighting for attention These are the original features.
[0042] Furthermore, the workflow of the hybrid neural network is as follows:
[0043] Use the BERT model to identify event trigger words in the categorized data;
[0044] For simple events, a combined model consisting of a relational convolutional neural network and a bidirectional long short-term memory network is used for identification.
[0045] For complex events, a combined model consisting of bidirectional gated recurrent units and multi-head attention mechanisms is used for identification.
[0046] By using compensated path planning, combining shortcut paths with word density, and repeatedly scanning word segments for compensated scanning, the accuracy of identifying complex and nested cybersecurity sensitive events can be improved.
[0047] The results of simple and complex event identification are processed by an exponential normalization function to output network security sensitive events.
[0048] Compared with the prior art, the present invention has the following advantages:
[0049] 1. This invention uses ECA-ATT neural network and MLP-Mixer neural network to classify and identify videos and images respectively, thereby enabling real-time monitoring and early warning of content on campus websites and external websites accessed by campus users, effectively identifying and blocking harmful information.
[0050] 2. This invention extracts network security sensitive events to monitor and alert on the content of campus websites and websites accessed by the campus, thereby maintaining normal campus order and protecting the physical and mental health of students.
[0051] Based on the above reasons, this invention can be widely applied in fields such as natural language processing. Attached Figure Description
[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0053] Figure 1 This diagram illustrates the preprocessing of audio, image, and video data in a network security sensitive event joint extraction method based on a compensation path planning strategy and a hybrid neural network, according to the present invention.
[0054] Figure 2 This is a schematic diagram illustrating the construction of word vectors in an embodiment of the present invention.
[0055] Figure 3 This is a schematic diagram illustrating the interaction of the word-image visual attention mechanism in an embodiment of the present invention. Detailed Implementation
[0056] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0057] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification and claims of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products, or devices.
[0058] This invention provides a method for jointly extracting network security sensitive events based on a compensatory path planning strategy and a hybrid neural network, the specific steps of which are as follows:
[0059] S1. Acquire text, audio, image, and video data in the field of cybersecurity.
[0060] In this embodiment, the information on sensitive events related to campus network security is extracted from the campus website and websites accessed by the campus.
[0061] S2. Preprocess the text data, train the preprocessed text data to obtain word vectors, and the word vectors can link the semantic information of the context.
[0062] Specifically, such as Figure 2 As shown, S2 includes:
[0063] S21. Use the text parsing tool TextMind to dynamically parse and preprocess sensitive campus network security event texts in bank document format.
[0064] S22. Input the preprocessed text into the Word2Vec model, which has been fine-tuned with domain text, for training.
[0065] S23. Generate word vectors that contain contextual semantic information.
[0066] From a mathematical perspective, multiplication and exponentiation increase the weight of a single word vector, thereby improving recognition accuracy. From a linguistic perspective, the S2 step enhances the meaning of a word vector within its context (the same word can have different meanings in different linguistic environments), determining the specific role of the word / character in the text and thus improving the recognition rate.
[0067] S3. Use the ECA-ATT neural network to preprocess the audio and video data, and use the MLP-Mixer neural network to preprocess the image data.
[0068] In S3, the introduction of audio and video data essentially means converting audio and video into word vectors, which are then concatenated with text word vectors to enrich the contextual semantics, increase the weight of word vectors, and provide important support for downstream classification tasks.
[0069] like Figure 1 As shown, the preprocessing steps for image data include:
[0070] The first step is to divide the image data into multiple image blocks and convert each image block into a corresponding block vector.
[0071] The second step is to input the block vectors into the block-by-block fully connected layer to obtain the initial projected features.
[0072] The third step is to input the initial projection features into the MLP-Mixer module to mix information between channels and image blocks.
[0073] The fourth step is to perform global average pooling on the features output by the MLP-Mixer module to generate a global feature vector.
[0074] Step 5: Input the global feature vector into the fully connected layer to obtain the preprocessed image data.
[0075] like Figure 1 As shown, the preprocessing steps for audio and video data include:
[0076] First, a recurrent neural network is used to convert audio data into text data, and then the text data and video data are input into an efficient channel attention mechanism neural network.
[0077] Secondly, the input data is subjected to global average pooling to obtain the channel vector;
[0078] Subsequently, an adaptive one-dimensional convolution kernel is used to perform convolution operation on the channel vector in the channel dimension, and the result of the convolution is substituted into the Sigmoid function to generate attention weights;
[0079] Finally, the obtained attention weights are multiplied along the channel dimension, and each channel is weighted to obtain the preprocessed audio data and preprocessed image data.
[0080] Furthermore, the Sigmoid function is:
[0081]
[0082] in, The input to the Sigmoid function is the argument. This is the output of the Sigmoid function.
[0083] The formula for calculating attention weights is:
[0084]
[0085] in, For the input data in the computation process consisting of the sigmoid function and one-dimensional convolution operation, C1Dk(·) is the one-dimensional convolution, and σ(·) is the sigmoid function. This represents the attention weight.
[0086] Specifically, the efficient channel attention mechanism neural network (ECA-ATT) with the sigmoid method is combined with the attention mechanism to analyze relevant illegal videos frame by frame through a method of non-dimensionality reduction local channels and adaptive selection of one-dimensional convolution kernel size.
[0087] S4. The word vectors, preprocessed audio data, preprocessed image data, and preprocessed video data are fused together. The fused data is then input into a hybrid neural network built on a word-graph-view attention mechanism to output network security sensitive events.
[0088] Specifically, word-image-view attention mechanisms include character-level attention mechanisms, image-level attention mechanisms, self-attention mechanisms, and view-level attention mechanisms. For example... Figure 3 As shown, the character-level attention mechanism, image-level attention mechanism, and view-level attention mechanism respectively add weights to the three types of word vectors to improve the recognition rate in the later stage.
[0089] The character-level attention mechanism, without compromising the semantic integrity of the text context, identifies similar-looking characters in the classified data and calculates the differences between them. Based on these differences, different attention weights are assigned to different similar-looking characters to distinguish them at the feature representation level. The weighted character-level features are then output for use in training downstream tasks.
[0090] Image-level attention and view-level attention are fine-tuning of the parameters of the self-attention mechanism. The self-attention mechanism further increases the weights to improve accuracy.
[0091] Furthermore, the formula for calculating attention weights is as follows:
[0092]
[0093]
[0094]
[0095]
[0096] in, For input parameters, W t S is the inner product of the weight vector W and the transformed feature S. For the attention deweighting corresponding to the i-th feature, here B i and h i Multiply the two products and then sum them (note that this is an element-wise or dimension-wise weighted sum) to obtain the weighted r. i , This refers to the original features (or hidden state). This is a weighted feature representation (highlighting important features and suppressing irrelevant features to the greatest extent possible). To apply the tanh activation function to the weighted features r i The final feature representation is obtained by performing a nonlinear transformation. , Deweight attention.
[0097] Specifically, the workflow of a hybrid neural network is as follows:
[0098] The first step is to use the BERT model to identify event trigger words in the categorized data.
[0099] The second step is to use a combined model consisting of a relational convolutional neural network (ReCNN) and a bidirectional long short-term memory network (BiLSTM) for identification of simple events.
[0100] The third step is to use a combined model consisting of a bidirectional gated recurrent unit (BiGRU) and a multi-head attention mechanism for identification of complex events.
[0101] The fourth step involves using compensated path planning, combining shortcut paths with word density, and repeatedly scanning word segments for compensated scanning to improve the accuracy of identifying complex and nested cybersecurity sensitive events.
[0102] Step 5: The results of simple event identification and complex event identification are normalized by an exponential function to output network security sensitive events.
[0103] The hybrid neural network described above adopts a strategy of independent modeling, that is, it designs a special training process for the different characteristics of simple events and complex events, which can effectively optimize model performance.
[0104] Different neural networks correspond to different data types. ReCNN is mainly trained on multiple videos (where video can undergo frame processing) and graphs, while BILSTM is trained on text and speech (where speech can be converted into text).
[0105] For complex events, the parameters were fine-tuned, but no structural or sequential adjustments were made. The purpose of this fine-tuning step is to make the neural network more suitable for our task.
[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for jointly extracting network security sensitive events based on a compensation path planning strategy and a hybrid neural network, characterized in that, Includes the following steps: Acquire text, audio, image, and video data in the field of cybersecurity; The text data is preprocessed, and the preprocessed text data is trained to obtain word vectors, which can link contextual semantic information. The audio and video data are preprocessed using an efficient channel attention mechanism neural network, and the image data is preprocessed using an MLP-Mixer neural network. The algorithm fuses word vectors, preprocessed audio data, preprocessed image data, and preprocessed video data. The fused data is then input into a hybrid neural network built on a word-graph-view attention mechanism, outputting information about network security sensitive events. The character-image view attention mechanism includes character-level attention, image-level attention, self-attention, and view-level attention. The workflow of the hybrid neural network is as follows: Use the BERT model to identify event trigger words in the categorized data; For simple events, a combined model consisting of a relational convolutional neural network and a bidirectional long short-term memory network is used for identification. For complex events, a combined model consisting of bidirectional gated recurrent units and multi-head attention mechanisms is used for identification. By using compensated path planning, combining shortcut paths with word density, and repeatedly scanning word segments for compensated scanning, the accuracy of identifying complex and nested cybersecurity sensitive events can be improved. The results of simple and complex event identification are processed by an exponential normalization function to output network security sensitive events.
2. The method according to claim 1, characterized in that, The preprocessing steps for the image data include: The image data is divided into multiple image blocks, and each image block is converted into a corresponding block vector; The block vectors are input into a block-by-block fully connected layer to obtain the initial projection features; The initial projection features are input into the MLP-Mixer module to mix information between channels and image blocks; Perform global average pooling on the features output by the MLP-Mixer module to generate a global feature vector; The global feature vector is input into a fully connected layer to obtain preprocessed image data.
3. The method according to claim 1, characterized in that, The preprocessing steps for the audio and video data include: First, the audio data is converted into text data using a recurrent neural network, and the text data and video data are then input into an efficient channel attention mechanism neural network. Secondly, the input data is subjected to global average pooling to obtain the channel vector; Subsequently, an adaptive one-dimensional convolution kernel is used to perform a convolution operation on the channel vector in the channel dimension, and the result of the convolution is substituted into the Sigmoid function to generate attention weights. Finally, the obtained attention weights are multiplied along the channel dimension, and each channel is weighted to obtain the preprocessed audio data and the preprocessed video data.
4. The method according to claim 3, characterized in that, The Sigmoid function is: in, The input to the Sigmoid function is the argument. This is the output of the Sigmoid function. The formula for calculating the attention weight is: in, For the input data in the computation process consisting of the sigmoid function and one-dimensional convolution operation, C1Dk(·) is the one-dimensional convolution, and σ(·) is the sigmoid function. This represents the attention weight.
5. The method according to claim 1, characterized in that, The preprocessing of text data, followed by training the preprocessed text data to obtain word vectors, includes: The TextMind text parsing tool was used to dynamically parse and preprocess sensitive campus network security incident texts in the format of bank official documents; The preprocessed text is input into a Word2Vec model that has been fine-tuned with domain text for training. Generate word vectors that contain contextual semantic information.
6. The method according to claim 1, characterized in that, The character-level attention mechanism, without compromising the semantic integrity of the text context, identifies similar-looking characters in the classified data and calculates the differences between these similar-looking characters. Based on the aforementioned differences, different attention weights are assigned to different similar-looking characters in order to distinguish them at the feature representation level; The weighted character-level features are output for use in training downstream tasks.
7. The method according to claim 6, characterized in that, The formula for calculating the attention weight is as follows: in, For input parameters, The transformation is the inner product of the weight vector W and the transformed feature S. Weight the attention corresponding to the i-th feature. This is the weighted feature representation. For the final feature representation, Deweighting for attention These are the original features.