Cybersecurity domain named entity recognition method and system

Abstract

The application provides a network space security field named entity recognition method and system, and relates to the technical field of network space security.The original data is marked by using an improved BIO marking rule, wherein the improved BIO marking rule introduces two indexes X and Y in the existing BIO, X represents that the current "affected component name" is the affected component in the vulnerability description, and Y represents the corresponding affected version of the current "affected component name";by introducing the X and Y indexes and combining a strict matching rule, the application solves the problem that the existing named entity recognition technology cannot process complex many-to-many association, ensures that each version or version range can be uniquely and accurately attributed to the corresponding component, significantly improves the accuracy and consistency of extracting component information from the vulnerability description, greatly reduces the workload of manual data cleaning and matching in the vulnerability management system, and improves the automation level.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to a named entity recognition method and system in the field of cyberspace security. Background Technology

[0002] With the continuous evolution of information technology and the frequent occurrence of cybersecurity incidents, extracting valuable information from the rapidly growing security samples has become a core research topic. Named entity recognition (NAME) in the cybersecurity field, as a domain-specific NAME recognition technology, aims to accurately identify various types of entities, such as malware, hacker organizations, vulnerabilities, and malicious filenames, from massive amounts of security samples. This technology not only provides a solid foundation for the subsequent construction of cybersecurity knowledge graphs but also effectively reduces the human cost of manually screening sample information.

[0003] While numerous studies exist on Named Entity Recognition (NER) techniques, they still have limitations when processing vulnerability description samples. For example, although existing NER techniques can extract meaningful entities from samples, such as component names and version numbers, they cannot accurately map these related entities. Specifically, when a vulnerability description contains one or more affected components, and at least one component corresponds to one or more versions (including single versions and version ranges), existing techniques cannot explicitly associate each component with all its corresponding affected versions (whether a specific value or a range). Summary of the Invention

[0004] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a named entity recognition method and system in the field of cyberspace security, which solves the technical problem that existing technologies cannot explicitly associate each component with all its corresponding affected versions.

[0005] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, the present invention provides a named entity recognition method in the field of cyberspace security, comprising: The raw data in the field of cyberspace security is obtained, and the raw data is annotated using an improved BIO annotation rule to obtain a dataset. The improved BIO annotation rule introduces two indices, X and Y, into the existing BIO. X represents the number of affected components in the vulnerability description of the current "affected component name", and Y represents the number of affected versions corresponding to the current "affected component name". The DeBERTa model was trained using a dataset to obtain a named entity recognition model for the cyberspace security field.

[0006] Preferably, before annotating the original data using improved BIO annotation rules, the cyberspace security domain named entity recognition method further includes: Reorder the CPE information set in the original data.

[0007] Preferably, the reordering includes sorting according to the following two cases: Scenario 1: When the CPE information set contains only the names of affected components, extract each affected component name from the CPE information set and sort the CPE information set according to the index size of the first appearance of each affected component name in the vulnerability description. Scenario 2: When the CPE information set contains the names and versions of affected components, first sort the affected component names in the manner described in Scenario 1; if the same affected component name contains multiple versions, sort them directly according to the index size of the versions appearing in the vulnerability description.

[0008] Preferably, the DeBERTa model is an improved DeBERTa model. In the improved DeBERTa model, wordpiece is used to convert each sample in the labeled dataset into a token. During the conversion process, words that have been segmented into multiple tokens by WordPiece are specially marked.

[0009] Preferably, during the training process, the improved DeBERTa model performs a padding operation on each sample to ensure that its length is consistent.

[0010] Secondly, the present invention provides a named entity recognition system in the field of cyberspace security, comprising: The data acquisition and annotation module is used to acquire raw data in the field of cyberspace security, and to annotate the raw data using an improved BIO annotation rule to obtain a dataset. The improved BIO annotation rule introduces two indices, X and Y, into the existing BIO, where X represents the number of affected components in the vulnerability description of the current "affected component name", and Y represents the number of affected versions corresponding to the current "affected component name". The training module is used to train the DeBERTa model using a dataset to obtain a named entity recognition model for the cyberspace security domain.

[0011] Preferably, before annotating the original data using improved BIO annotation rules, the cyberspace security domain named entity recognition method further includes: Reorder the CPE information set in the original data.

[0012] Preferably, the reordering includes sorting according to the following two cases: Scenario 1: When the CPE information set contains only the names of affected components, extract each affected component name from the CPE information set and sort the CPE information set according to the index size of each affected component name appearing in the vulnerability description. Scenario 2: When the CPE information set contains the names and versions of affected components, first sort the affected component names in the manner described in Scenario 1; if the same affected component name contains multiple versions, sort them directly according to the index size of the versions appearing in the vulnerability description.

[0013] Thirdly, the present invention provides a computer-readable storage medium storing a computer program for named entity recognition in the field of cyberspace security, wherein the computer program causes a computer to execute the named entity recognition method in the field of cyberspace security as described above.

[0014] Fourthly, the present invention provides an electronic device, comprising: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing domain-specific named entity recognition methods for cyberspace security as described above.

[0015] (III) Beneficial Effects This invention provides a named entity recognition method and system in the field of cyberspace security. Compared with existing technologies, it has the following advantages: This invention, by introducing X and Y indexes and combining them with strict matching rules, solves the problem that existing named entity recognition technologies cannot handle complex many-to-many relationships. It ensures that each version or version range can be uniquely and accurately attributed to its corresponding component, significantly improving the accuracy and consistency of extracting component information from vulnerability descriptions. It also greatly reduces the workload of manual data cleaning and matching in vulnerability management systems and improves the level of automation. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a block diagram of a named entity recognition method in the field of cyberspace security, according to an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are described clearly and completely. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] This application provides a named entity recognition method and system in the field of cyberspace security, which solves the technical problem that the prior art cannot explicitly associate each component with all its corresponding affected versions. By introducing X and Y indexes and combining strict matching rules, it ensures that each version or version range can be uniquely and accurately attributed to its corresponding component.

[0020] The technical solution in this application is to solve the above-mentioned technical problems, and the general idea is as follows: Existing named entity recognition technologies face the following two core problems when processing vulnerability description samples: 1. When a vulnerability description contains one or more affected components, and at least one component corresponds to one or more versions (including a single version and a version range), existing technologies cannot explicitly associate each component with all its corresponding affected versions (whether a specific value or a range). For example, for "Wireshark 3.4.0 and 3.2.0 to 3.2.8", existing technologies may identify entities such as "Wireshark", "3.4.0", "3.2.0", and "3.2.8", but cannot explicitly state that "3.4.0" and "3.2.0 to 3.2.8" both belong to "Wireshark". This problem exists because existing NER methods focus on identifying individual entities and lack the ability to model complex relationships between entities.

[0021] 2. Existing technologies, especially when using word segmenters like WordPiece, introduce problems such as inconsistent token and label lengths and loss of semantic information during sample preprocessing. WordPiece segments English words into multiple sub-words (tokens), for example, segmenting "Antivirus" into "Anti ##virus". To ensure a one-to-one correspondence between tokens and labels in a sentence, existing methods typically only use the first token of each word to calculate cross-entropy. However, this approach results in the token failing to represent the complete meaning of the original word and may lead to different words receiving the same word vector. For example, "Antivirus" and "Anti-malware" would both be represented as "Anti" because only the first token is used, causing model confusion.

[0022] To address the aforementioned issues, this invention provides a named entity recognition method in the field of cyberspace security, which enables each influencing component to be matched one-to-one with its corresponding influencing version (whether the version is a specific value or a range).

[0023] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0024] This invention provides a named entity recognition method in the field of cyberspace security, such as... Figure 1 As shown, it includes: S1. Obtain raw data in the field of cyberspace security, and use an improved BIO annotation rule to annotate the samples in the raw data to obtain a dataset. The improved BIO annotation rule introduces two indices, X and Y, into the existing BIO, where X represents the nth affected component in the vulnerability description for the current "affected component name," and Y represents the nth affected version corresponding to the current "affected component name." S2. Train the DeBERTa model using the dataset to obtain a named entity recognition model for the cyberspace security field.

[0025] The embodiments of this invention, by introducing X and Y indexes and combining them with strict matching rules, solve the problem that existing named entity recognition technologies cannot handle complex many-to-many relationships. This ensures that each version or version range can be uniquely and accurately attributed to its corresponding component, significantly improving the accuracy and consistency of extracting component information from vulnerability descriptions. It also greatly reduces the workload of manual data cleaning and matching in vulnerability management systems and improves the level of automation.

[0026] The following is a detailed description of each step: In one embodiment, S1, raw data in the cyberspace security field is obtained, and samples are labeled using an improved BIO annotation rule to obtain a dataset. The improved BIO annotation rule introduces two indices, X and Y, into the existing BIO, where X represents the nth affected component in the vulnerability description for the current "affected component name," and Y represents the nth affected version corresponding to the current "affected component name." The specific implementation process is as follows: The original data for the named entity recognition task—a cyberspace security task—to be completed in this embodiment of the invention is obtained. A dataset is constructed based on the obtained data, and samples are labeled using a BIO three-dimensional annotation: BX represents the beginning of entity X, IX represents the interior or end of entity X, and O represents not belonging to any entity. According to the task requirements, the sample labels are divided into six categories: name, version, start_version, start_ex_version, end_version, and end_ex_version, representing the affected component name, version (single numerical value), the starting version of the affected range (including the current version), the starting version of the affected range (excluding the current version), the ending version of the affected range (including the current range), and the ending version of the affected range (excluding the current range), respectively.

[0027] The raw data used in this embodiment of the invention all come from vulnerability description samples and related affected components and affected version information, i.e., CPE information sets (cpe_infos in the dictionary below), crawled from the NVD vulnerability database. Each entry is written in dictionary form, for example: {"description": "An improper access control vulnerability CWE-284 in FortiManager 7.2 , 7 through 7.0.3 , 6.4 through 6.4.7 , 6.2 through 6.2.9 , 6 through 6.0.11 and FortiAnalyzer 7.2 , 7 through 7.0.3 ,6.4 through 6.4.8 , 6.2 through 6.2.10 , 6 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information .", "cpe_infos": [{"name": "fortianalyzer", "version": "*", "start_version": "6","start_ex_version": "*", "end_version": "6.0.12", "end_ex_version": "*"}, {"name": "fortianalyzer", "version": "*", "start_version": "6.2", "start_ex_version": "*", "end_version": "6.2.10", "end_ex_version": "*"}, {"name": "fortianalyzer", "version": "*", "start_version": "6.4", "start_ex_version":"*", "end_version": "6.4.8", "end_ex_version": "*"}, {"name": "fortianalyzer", "version": "*", "start_version": "7", "start_ex_version":"*", "end_version": "7.0.3", "end_ex_version": "*"}, {"name": "fortianalyzer", "version": "7.2", "start_version": "*", "start_ex_version":"*", "end_version": "*", "end_ex_version": "*"}, {"name": "fortimanager", "version": "*", "start_version": "6", "start_ex_version": "*", "end_version":"6.0.11", "end_ex_version": "*"}, {"name": "fortimanager", "version": "*", "start_version": "6.2", "start_ex_version": "*", "end_version": "6.2.9", "end_ex_version": "*"}, {"name": "fortimanager", "version": "*", "start_version":"6.4", "start_ex_version": "*", "end_version": "6.4.7", "end_ex_version":"*"}, {"name": "fortimanager", "version": "*", "start_version": "7", "start_ex_version": "*", "end_version": "7.0.3", "end_ex_version": "*"}, {"name": "fortimanager", "version": "7.2", "start_version": "*", "start_ex_version":"*", "end_version": "*", "end_ex_version": "*"}]}。.

[0028] As illustrated by the examples above, a vulnerability description can contain multiple affected components, and each affected component can correspond to multiple version numbers. While ensuring that the label of each named entity is unique, it is also necessary to ensure that the affected component corresponds to its corresponding affected version. Therefore, this embodiment of the invention designs six categories of labels: B-SOFT-X-0-0-0-0-0 (I-SOFT-X-0-0-0-0-0), B-VER-XY-0-0-0-0, B-SV-X-0-Y-0-0-0, B-SEV-X-0-0-Y-0-0, B-EV-X-0-0-0-Y-0, and B-EEV-X-0-0-0-0-0-Y. Here, VER, SV, SEV, EV, and EEV are abbreviations for version, start_version, start_ex_version, end_version, and end_ex_version, respectively. X indicates which affected component the name corresponds to in the vulnerability description. Since the affected version cannot appear independently of the name, each version number label will contain X, while Y indicates which affected version corresponds to the name. According to the cpe_infos (Common Platform Enumeration (CPE) information set), fortianalyzer (a security information and event management solution from Fortinet) should be labeled as B-SOFT-1-0-0-0-0-0. However, fortimanager (Fortinet's centralized security device management platform) is the first name to appear in the description, and it should be labeled as B-SOFT-1-0-0-0-0-0. For the named entity recognition model to be trained, the order of the name labels also needs to follow the order in which they appear in the description (the order is the index size of the first appearance of the name in the description); otherwise, the entire task will be unpredictable. Therefore, in this embodiment of the invention, the names in cpe_infos must first be reordered (that is, before sample labeling, the original data "cpe_infos" (containing component names and version information) must be reordered to ensure that the order in which the names appear is consistent with the description. At the same time, for each name, if there are multiple version numbers corresponding to it, their order must also be consistent with the description.After successful sorting, the tags corresponding to the vulnerability descriptions are marked as "OOOOO OO B-SOFT-1-0-0-0-0-0 B-VER-1-1-0-0-0-0 O B-SV-1-0-1-0-0-0 O B-EV-1-0-0-0-1-0O B-SV-1-0-2-0-0-0 O B-EV-1-0-0-0-2-0 O B-SV-1-0-3-0-0-0 O B-EV-1-0-0-0-3-0 OB-SV-1-0-4-0-0-0 O B-EV-1-0-0-0-4-0 O B-SOFT-2-0-0-0-0-0 B-VER-2-1-0-0-0-0 OB-SV-2-0-1-0-0-0 O B-EV-2-0-0-0-1-0 O B-SV-2-0-2-0-0-0 O B-EV-2-0-0-0-2-0 OB-SV-2-0-3-0-0-0 O B-EV-2-0-0-0-3-0 O B-SV-2-0-4-0-0-0 O B-EV-2-0-0-0-4-0 O OO OOOOOOOOOOOOOOOOOOOOO OO ". In this way, a match can be made as long as the X in the version tag matches the X in the name tag. When the version affected by the name is a range, such as start_version and end_version, then the X and Y in B-SV-X-0-Y-0-0-0 and B-EV-X-0-0-0-0-Y-0 must match. It should be noted that in the rules of this embodiment, a name with a version tag cannot have the other four tags. SV and SEV can correspond to EV or EEV, but cannot exist independently, because the range of influence cannot have only a beginning and no end. Based on the above examples, the matching terms for B-SOFT-1-0-0-0-0-0 include B-VER-1-1-0-0-0-0, B-SV-1-0-1-0-0-0 and B-EV-1-0-0-0-1-0, B-SV-1-0-2-0-0-0 and B-EV-1-0-0-0-2-0, B-SV-1-0-3-0-0-0 and B-EV-1-0-0-0-3-0, and so on for B-SOFT-2-0-0-0-0-0. In actual production, after the user inputs a vulnerability description, the model will provide predicted labels. This embodiment of the invention matches the corresponding labels according to the above rules to achieve the correspondence between the vulnerable component and the corresponding version.

[0029] The reordering of "cpe_infos" in the original data mentioned above includes two specific scenarios.

[0030] Scenario 1: When the CPE information set contains only the names of affected components, extract each affected component name from the CPE information set and sort the CPE information set according to the index of each affected component name appearing in the vulnerability description. Specifically: Scenario 1: If cpe_infos contains only name but no version and the name length is 1, then simply extract the name from cpe_infos and sort it by the index size of its first appearance in the vulnerability description. For cases where there is only name but no version and the name length exceeds 1, first record the range of its first index, such as (4, 7), take the minimum value of 4 as the index value, and then sort by index size.

[0031] Scenario 2: When the CPE information set contains the names and versions of affected components, first sort the affected component names as in Scenario 1; if the same affected component name contains multiple versions, sort them directly by the index of the version in the vulnerability description. Specifically: When `cpe_infos` contains both `name` and `version`, the `name` is first sorted as in Case 1. If the same `name` contains multiple `version`s, the `version`s also need to be sorted, simply by their index in the description. Special handling: If the same `version` appears multiple times, only the first occurrence is recorded (unlike `name`, which can be repeated). This is because `version` usually follows the corresponding `name`, and different `name`s may correspond to the same `version`. If each repeated `version` is recorded, the correspondence between some `name`s and `version`s will become chaotic, leading to inaccurate matching. For example, in the sentence "An issue was discovered in FoxitReader before 5, 6 and PhantomPDF before 6, 7...", the version "6" corresponding to the first and second `name`s will both be marked as `B-EEV-1-0-0-0-0-1` when generating the dataset.

[0032] In particular, there are a few vulnerability descriptions where multiple names correspond to a single version (but the vulnerability description only contains one affected version or affected version range), such as: "An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing." In this case, the names are still labeled according to the rules mentioned above, while the versions are labeled as DS-VER, DS-SV, DS-EV, DS-SEV, and DS-EEV, respectively. Because in this situation, the vulnerability description will only contain one affected version or affected version range, it is only necessary to distinguish between the five types of version numbers, without considering the issue of one name corresponding to multiple version numbers or version ranges. The obtained version tags can be combined with the multiple names respectively. Therefore, the tags corresponding to the above vulnerability description are "OOOOO B-SOFT-1-0-0-0-0-0 I-SOFT-1-0-0-0-0-0 O B-SOFT-2-0-0-0-0-0 O DS-EEV OOOOOOOOOOOOO, and the obtained matching items are: {"name":FoxitReader, "end_ex_version":9.7} and {"name":PhantomPDF, "end_ex_version":9.7}.

[0033] In one embodiment, S2, the DeBERTa model is trained using a dataset to obtain a named entity recognition model for the cyberspace security domain. The specific implementation process is as follows: It should be noted that the DeBERTa model in this embodiment uses wordpiece to convert each sample in the labeled dataset into a token. Furthermore, to address the issues of inconsistent token-label lengths and semantic loss caused by WordPiece segmentation, this embodiment specially marks words segmented into multiple tokens by WordPiece to identify token groups belonging to the same original word. Subsequently, for these words segmented into n tokens, their corresponding "n*dim" tensors (where "dim" is the word vector dimension) are flattened into a "1*dim" tensor by averaging the elements in each column. Unsegmented words are already "1*dim" tensors and do not require flattening.

[0034] For example, the tokens transformed from the sample "GNU Mailman from 2 to 2.1.33 allows arbitrary content injection" are ['GNU',' Mail','man',' from',' 2',' to',' 2','.','1','.','33',' allows',' arbitrary',' content',' injection']. The original sample length is 10 (sequence_length), and the length after segmentation is 15 (token_sequence_length). The number of tokens with underscores ("_") is the same as the number of words in the original sample. These tokens represent the original word after wordpiece processing or the first sub-word unit after the original word is segmented into several tokens. Discarding tokens without underscores allows for a quick one-to-one correspondence between tokens and sample labels. However, the transformed tokens from the original sample are "GNU Mail from 2 to 2 allows arbitrary content injection", which clearly differs from the meaning expressed by the original sample.

[0035] Typically, during training, the model first processes the input samples and labels into tensors of size `batch_size * sequence_length * dim`, where `batch_size` is the number of samples in a batch, `sequence_length` is the sample length, and `dim` is the dimension of the word vector for each word in the sample. However, because `wordpiece` results in a tensor of size `batch_size * token_sequence_length * dim`, where `token_sequence_length` is greater than or equal to `token_sequence_length` because a word may be split into multiple tokens, this makes the tensor dimension different from that of the label tensor. To ensure a one-to-one correspondence between tokens and labels without losing the original semantics, all words in the sample that are split into multiple (let's say n) tokens are specially labeled. Then, the tensor of n tokens with dimension `dim` (i.e., n * dim) is flattened into a single tensor of size `1 * dim`. This transforms the `batch_size * token_sequence_length * dim` tensor into the standard input required by the model. To distinguish which tokens in `token_squence_length` need to be flattened, each word that has been split into multiple tokens is specially marked. For example, "mySCADA myPRO versions prior to 8.20" will be split into ['my', 'SC', 'ADA', 'my', 'PRO', 'versions', 'prior', 'to', '8', '.', '20'], marked as 1,2,3,1,2,1,1,1,1,2,3. Here, `mySCADA`, `myPRO`, and `8.20` are marked as "1,2,3", "1,2", and "1,2,3" respectively, indicating that their token counts after splitting are 3, 2, and 3, respectively, and they require tensor flattening. `versions`, `prior`, and `to` are not split and are represented by the character "1", and do not require tensor flattening.

[0036] Meanwhile, in the DeBERTa model, each sample is padded (to ensure consistent sample length for batch processing) and then concatenated to obtain a tensor of batch_size * sequence_padding_length * dim. The batch_size refers to the size of the dataset; when tens of thousands of data points are sent to the model for training, it cannot process all the data at once and must process it batch by batch.

[0037] By dividing the dataset into training, testing, and validation sets, the DeBERTa model is trained, tested, and validated to obtain a named entity recognition model for the cyberspace security field.

[0038] It should be noted that DeBERTa mainly improves the BERT model through two new technologies: decoupling the attention mechanism and enhancing the mask interpreter.

[0039] One key feature is the decoupled attention mechanism. In BERT's input layer, each word is represented by a vector, which is the sum of the word (content) embedding and the position embedding. Unlike BERT, in DeBERTa, each word is encoded by two vectors: its content and its position. The attention weights between words are calculated based on their content and relative position, respectively, using a decoupling matrix. This approach is chosen because it has been observed that the attention weights of a pair of words depend not only on their content but also on their relative position.

[0040] 2. Enhanced Mask Decoder – BERT uses the standard Masked Language Model (MLM) task, randomly selecting a subset of words and replacing them with [MASK], then having the model predict the masked words. DeBERTa borrows from ELECTRA's approach, employing discriminative pre-training. Instead of directly predicting the masked words, it allows the model to determine whether each word in the input sentence has been replaced. Specifically, a generator model (usually smaller than the discriminator model) generates the replacement words, and then the discriminator model (DeBERTa itself) distinguishes which words are original and which have been replaced by the generator. This approach allows the model to learn richer contextual information because it needs to consider the entire sentence to determine whether each word has been replaced, not just predict the masked words. Compared to MLM, discriminative pre-training typically utilizes computational resources more effectively, achieving better performance with the same computational cost. Furthermore, it has significant advantages over BERT in terms of training strategy, model size, and performance.

[0041] This invention also provides a named entity recognition system in the field of cyberspace security, comprising: The data acquisition and annotation module is used to acquire raw data in the field of cyberspace security, and to annotate the raw data using an improved BIO annotation rule to obtain a dataset. The improved BIO annotation rule introduces two indices, X and Y, into the existing BIO, where X represents the nth affected component in the vulnerability description for the current "affected component name," and Y represents the nth affected version corresponding to the current "affected component name." The training module is used to train the DeBERTa model using a dataset to obtain a named entity recognition model for the cyberspace security domain.

[0042] It is understood that the Named Entity Recognition System for Cyberspace Security provided in this embodiment of the invention corresponds to the Named Entity Recognition Method for Cyberspace Security described above. The explanations, examples, and beneficial effects of the relevant content can be referred to the corresponding content in the Named Entity Recognition Method for Cyberspace Security, and will not be repeated here.

[0043] This invention also provides a computer-readable storage medium storing a computer program for named entity recognition in the field of cyberspace security, wherein the computer program causes a computer to execute the named entity recognition method for cyberspace security as described above.

[0044] This invention also provides an electronic device, including: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing the domain-specific named entity recognition method for cyberspace security as described above.

[0045] In summary, compared with existing technologies, it has the following beneficial effects: 1. By introducing X and Y indexes and combining them with strict matching rules, this invention solves the problem that existing named entity recognition technologies cannot handle complex many-to-many relationships. It ensures that each version or version range can be uniquely and accurately attributed to its corresponding component, significantly improving the accuracy and consistency of extracting component information from vulnerability descriptions. It also greatly reduces the workload of manual data cleaning and matching in vulnerability management systems and improves the level of automation.

[0046] 2. In this embodiment of the invention, words that have been segmented into multiple tokens by WordPiece are specially labeled, so that the length of the tensor input to the model (in units of the original words) is consistent with the length of the label sequence, thus solving the problem of dimension mismatch. At the same time, the overall semantics of the original words are preserved through averaging, avoiding semantic loss and confusion caused by taking only the first token.

[0047] 3. The embodiments of the present invention use samples from the same batch for filling, which ensures the uniformity of the input tensor size during batch processing.

[0048] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0049] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A named entity recognition method in the field of cyberspace security, characterized in that, include: The raw data in the field of cyberspace security is obtained, and the raw data is labeled using an improved BIO labeling rule to obtain a dataset. The improved BIO labeling rule introduces two indices, X and Y, into the existing BIO. X represents the number of affected components in the vulnerability description of the current "affected component name", and Y represents the number of affected versions corresponding to the current "affected component name". The DeBERTa model was trained using a dataset to obtain a named entity recognition model for the cyberspace security field. The cyberspace security domain named entity recognition method further includes, before annotating the original data using the improved BIO annotation rules, reordering the CPE information set in the original data. The reordering includes sorting according to the following two cases: Scenario 1: When the CPE information set contains only the names of affected components, extract each affected component name from the CPE information set and sort the CPE information set according to the index size of the first appearance of each affected component name in the vulnerability description. Scenario 2: When the CPE information set contains the names and versions of affected components, first sort the affected component names in the manner described in Scenario 1; if the same affected component name contains multiple versions, sort them directly according to the index size of the versions appearing in the vulnerability description. The DeBERTa model is an improved version of the DeBERTa model. In the improved DeBERTa model, wordpiece is used to convert each sample in the labeled dataset into a token. During the conversion process, words that are segmented into multiple tokens by WordPiece are specially marked. During training, the improved DeBERTa model performs a padding operation on each sample to ensure that its length is consistent.

2. A named entity recognition system for the field of cyberspace security, characterized in that, include: The data acquisition and annotation module is used to acquire raw data in the field of cyberspace security, and to annotate the raw data using an improved BIO annotation rule to obtain a dataset. The improved BIO annotation rule introduces two indices, X and Y, into the existing BIO, where X represents the number of affected components in the vulnerability description of the current "affected component name", and Y represents the number of affected versions corresponding to the current "affected component name". The training module is used to train the DeBERTa model using a dataset to obtain a named entity recognition model for the cyberspace security field. Before annotating the original data using the improved BIO annotation rules, the cyberspace security domain named entity recognition system is also used to: reorder the CPE information set in the original data; The reordering includes sorting according to the following two cases: Scenario 1: When the CPE information set contains only the names of affected components, extract each affected component name from the CPE information set and sort the CPE information set according to the index size of the first appearance of each affected component name in the vulnerability description. Scenario 2: When the CPE information set contains the names and versions of affected components, first sort the affected component names in the manner described in Scenario 1; if the same affected component name contains multiple versions, sort them directly according to the index size of the versions appearing in the vulnerability description. The DeBERTa model is an improved version of the DeBERTa model. In the improved DeBERTa model, wordpiece is used to convert each sample in the labeled dataset into a token. During the conversion process, words that are segmented into multiple tokens by WordPiece are specially marked. During training, the improved DeBERTa model performs a padding operation on each sample to ensure that its length is consistent.

3. A computer-readable storage medium, characterized in that, It stores a computer program for named entity recognition in the field of cyberspace security, wherein the computer program causes a computer to perform the named entity recognition method in the field of cyberspace security as described in claim 1.

4. An electronic device, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing the cyberspace security domain named entity recognition method as described in claim 1.

Images