Traffic network security event extraction method and system based on machine reading understanding

Abstract

The invention relates to a traffic network security event extraction method based on machine reading understanding, which performs joint training and optimization on a trigger word prediction module and an argument extraction module by sharing a coding layer of a pre-training language model, so that two tasks promote each other in a shared semantic space. Accurate context constraints are provided for argument role judgment through trigger word recognition, disambiguation of trigger word types is facilitated through argument information, and the deep interactive optimization mechanism enables the model to learn collaborative representation sensitive to the whole event structure. Therefore, the overall accuracy of event extraction and the generalization ability of the model are remarkably improved, and the inherent error propagation problem in a traditional assembly line method is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of traffic network security information, in particular to a traffic network security event extraction method and system based on machine reading comprehension. BACKGROUND

[0002] With the rapid development of intelligent transportation systems (ITS), the key infrastructures such as Internet of Vehicles, intelligent roadside units, and traffic control centers are facing increasingly severe network security threats. These threats include intrusion attacks on Internet of Vehicles platforms, malicious manipulation of roadside infrastructures, data tampering and sensitive information theft through public Internet, and remote hijacking of vehicle control systems, etc. These threats are characterized by diversity and dynamics, and the related description texts are mostly unstructured data.

[0003] With the explosive growth of traffic information data, the traditional method of relying on manual annotation to build threat databases not only has high cost and low efficiency, but also is prone to omissions and errors due to text complexity. In addition, the existing intelligence collection methods have problems such as limited data acquisition, difficult information integration, and weak model generalization ability in the field of transportation, which are difficult to meet the urgent needs of modern transportation systems for rapid and accurate threat identification and analysis. Machine reading comprehension (MRC) technology, as a core direction of natural language processing, can automatically extract key events, trigger words, and participating entities in the text through joint modeling of questions and texts. The use of pre-trained language models (such as BERT) further improves semantic understanding capabilities, enabling event extraction to be efficiently processed in an end-to-end manner, and eliminating the dependence on complex rules or handcrafted features.

[0004] However, the existing MRC event extraction methods still have the following shortcomings: (1) Most of the existing methods only focus on token-level classification, ignoring the internal structure and semantic relationship of text segments; (2) Most schemes separately train trigger word extraction and argument extraction modules, and fail to utilize the associated information between the two; (3) The question generation method mostly uses argument names directly, lacking guidance of domain semantics.

[0005] Therefore, there is a need for an event extraction technology that can combine the characteristics of the traffic network security field, have automation, high precision, and scalability, to quickly build a traffic network security threat knowledge base and significantly improve the traffic network security information processing and early warning capabilities.

[0006] It is to be understood that the information disclosed in the Background section is merely for the purpose of enhancing the understanding of the present application, and thus can include information that is not prior art to those skilled in the art. SUMMARY

[0007] The technical problem to be solved by the present application is how to provide an automated, high-precision and scalable traffic network security event extraction scheme to quickly build a traffic network security threat knowledge base and significantly improve traffic network security information processing and early warning capabilities.

[0008] To this end, the present application provides a traffic network security event extraction method and system based on machine reading comprehension to solve the above technical problems.

[0009] The technical solution adopted by the present application to solve the above technical problems is as follows.

[0010] The first aspect of the present application provides a traffic network security event extraction method based on machine reading comprehension, comprising the following steps: Obtaining unstructured text data in the field of traffic network security; Based on the preset traffic network security knowledge system, generating natural language questions corresponding to argument roles; Combining the unstructured text data and the natural language questions into a sequence, inputting the sequence into a pre-trained language model for joint encoding to obtain a context semantic vector representation of the sequence; Based on the context semantic vector representation, identifying and classifying event trigger words in the unstructured text data through a trigger word prediction module; Based on the context semantic vector representation, predicting and extracting argument roles corresponding to the event trigger words from the unstructured text data through an argument extraction module guided by the natural language questions. The trigger word prediction module and the argument extraction module share the encoding layer of the pre-trained language model and are jointly trained and optimized based on the shared semantic representation.

[0011] In some embodiments, generating natural language questions corresponding to argument roles based on the preset traffic network security knowledge system comprises the following steps: According to the argument role, selecting a template from a plurality of predefined question templates; The plurality of question templates at least include: a basic template based on the argument role name, and a semantic enhanced template generated based on attack techniques and event descriptions in the traffic network security knowledge system.

[0012] In some embodiments, the generation of the semantic enhanced template fuses attack stages and attack technique names in the MITRE ATT&CK Mobile matrix.

[0013] In some embodiments, arguments are predicted and extracted by an argument extraction module, and a fragment-level prediction method based on a dual affine attention mechanism is employed, including the following steps: The context semantic vector representation is reduced in dimensionality to obtain a reduced-dimensional representation of each smallest processing unit token in the text; For any candidate segment in the text, calculate the bilinear interaction score between its start position token representation and its end position token representation; By combining bilinear interaction scores and linear transformation scores, the probability of a candidate segment being the corresponding argument for a natural language problem is calculated using the softmax function.

[0014] In some embodiments, the method further includes: Calculate the relative no-answer score for extracted arguments. The relative no-answer score is defined as the difference between the sum of the start and end position probabilities of the argument fragment and the sum of the probability of the specific label position representing the argument. The relative no-answer score is compared to a dynamic threshold, and arguments whose relative no-answer scores are higher than the dynamic threshold are filtered out. The dynamic threshold is determined by grid search on the development set to optimize the overall performance of argument extraction.

[0015] In some embodiments, the method further includes: associating and assembling the successfully extracted event trigger words and arguments according to a predefined event structure to form a structured event record; and storing the structured event record in a structured knowledge base.

[0016] A second aspect of this application provides a traffic network security incident extraction system based on machine reading comprehension, comprising: a data acquisition module configured to acquire unstructured text data in the field of traffic network security; a question generation module configured to generate natural language questions corresponding to argument roles based on a preset traffic network security knowledge system; a joint encoding module configured to combine unstructured text data and natural language questions into a sequence, input it into a pre-trained language model, and obtain a contextual semantic vector representation of the sequence; a trigger word prediction module configured to identify and classify event trigger words in unstructured text data based on the contextual semantic vector representation; and an argument extraction module configured to predict and extract arguments corresponding to event trigger words from unstructured text data based on the contextual semantic vector representation and guided by natural language questions; wherein the trigger word prediction module and the argument extraction module share the output of the joint encoding module, and the system performs joint training and optimization based on the shared semantic representation.

[0017] In some embodiments, the argument extraction module employs a fragment-level prediction model based on a dual affine attention mechanism.

[0018] A third aspect of this application provides an electronic device, comprising: a memory for storing a computer program; and a processor for executing the computer program to implement the method of the first aspect of this application.

[0019] The fourth aspect of this application provides an early warning method based on traffic network security incident extraction, comprising the following steps: The method for extracting traffic network security incidents based on machine reading comprehension, as described in the first aspect of this application, is used to extract structured event records from unstructured text. Structured event records are stored in a traffic network security knowledge base; Based on event records stored in the traffic network security knowledge base, and combined with early warning rules, early warning signals are generated.

[0020] The present invention has the following beneficial effects: This application overcomes the inherent error propagation problem in traditional pipelined methods, significantly improving the overall accuracy and generalization ability of traffic network security event extraction. Specifically, this application jointly trains and optimizes the trigger word prediction module and the argument extraction module by sharing the encoding layer of a pre-trained language model, enabling the two tasks to mutually promote each other within a shared semantic space. Trigger word identification provides precise contextual constraints for argument role determination, while argument information helps disambiguate trigger word types. This deep interactive optimization mechanism allows the model to learn a collaborative representation sensitive to the overall event structure, thereby significantly improving the overall accuracy of event extraction and the model's generalization ability, overcoming the inherent error propagation problem in traditional pipelined methods.

[0021] Furthermore, this application generates semantically enhanced natural language questions through a traffic network security knowledge system (such as the MITRE ATT&CK Mobile matrix), integrating domain terminology and attack technology context into the questions. This provides the model with rich semantic guidance far beyond simple argument names, enabling the model to more accurately understand the semantics of specific events in the traffic network security domain, thereby significantly improving the accuracy and domain adaptability of argument extraction.

[0022] Furthermore, by employing a fragment-level prediction method based on a dual affine attention mechanism, this application enables the model to directly perform deep interactive computation on the start and end position representations of text fragments, thereby better capturing the semantic integrity and long-distance dependencies within arguments. Compared with traditional token-level classification methods, it can more accurately locate and extract argument fragments.

[0023] Furthermore, this application introduces a dynamic threshold adaptive argument filtering mechanism, which filters candidate arguments based on their relative no-answer scores. This threshold is determined by grid search on the development set and can adapt to the confidence distribution of different text and event types, automatically filtering low-quality candidate answers. This improves the robustness of the system and the reliability of the extraction results in different scenarios, and avoids the subjectivity and limitations of manually setting fixed thresholds.

[0024] Furthermore, this application achieves end-to-end automated processing from raw text to structured knowledge by associating, assembling, and storing trigger words and arguments extracted from unstructured text according to a predefined event structure in a structured knowledge base. This provides a high-quality, queryable, and analyzable data foundation for traffic network security threat analysis, situational awareness, and decision support.

[0025] Other beneficial effects of the present invention will be further described below. Attached Figure Description

[0026] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a model architecture diagram related to this application, where the lines in the BERT part represent fully connected components; Figure 2 A schematic diagram illustrating the principles of building a security knowledge base; Figure 3 A schematic diagram illustrating the construction of a knowledge base for the data-type attribute portion of a security event; Figure 4 This is a diagram illustrating the construction of a security knowledge base based on SQLite.

[0027] Figure 5 This is a diagram illustrating a query based on the SQLite security knowledge base. Detailed Implementation

[0028] The embodiments of the present invention will be described in detail below. It should be emphasized that the following description is merely exemplary and not intended to limit the scope and application of the present invention.

[0029] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of the present invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0030] The embodiments of this application will be further described below with reference to the accompanying drawings.

[0031] This application proposes an innovative "Traffic Network Security Incident Extraction Method Based on Machine Reading Comprehension". Its core principle lies in transforming the unstructured traffic network security text understanding task into a precise machine reading comprehension task by generating questions guided by domain knowledge (MITRE ATT&CK matrix). Furthermore, it utilizes a span-level dual affine attention mechanism for answer reasoning and combines it with a joint training mechanism for trigger word and argument extraction. This approach avoids the inherent error propagation problem in traditional pipeline methods from the model's underlying layer and strengthens the modeling of semantic relationships within events.

[0032] The technical solution of Example 1, "A Method for Extracting Traffic Network Security Incidents Based on Machine Reading Comprehension," includes the following steps: S1. Input and Preprocessing: Input text: A real security alert - "The well-known hacker group Shadow successfully infiltrated the internal server of a city's traffic signal control company via phishing emails on Wednesday afternoon and stole some user data." Data acquisition and preprocessing: The system first cleans and segments the text, removes irrelevant symbols, and normalizes it into a standardized text format that the model can process.

[0033] S2. Problem Generation and Task Definition: Intelligent Question Template Generation: The system analyzes the text and identifies the core event as "cyberattack." Then, based on the security knowledge base (MITRE ATT&CK Mobile), it automatically generates machine reading comprehension questions targeting "phishing" techniques under the "attack" event type. For example, to extract the attack technique, the question is generated: "Initial Access.Phishing_Technique: What is the technique used?" This question template integrates domain knowledge into the question, providing the model with precise semantic guidance.

[0034] S3, Joint Encoding and Answer Prediction: Multi-task joint encoding: The generated questions and preprocessed text are combined into a standard format [CLS]question[SEP]text[SEP] and input into a shared BERT encoder. The BERT model generates a context-rich vector representation for each word in the sequence, which serves both the subsequent trigger word recognition and argument extraction subtasks.

[0035] Answer prediction based on a dual affine attention mechanism: Trigger word identification and classification: Based on the output of BERT, the trigger word prediction module identifies the core verb "intrusion" as the event trigger word and accurately classifies it as the Attack event type.

[0036] Argument Extraction: The argument extraction module begins its work. To address the "attack technique" issue, a dual affine attention mechanism is activated. This mechanism doesn't simply judge individual words, but rather scores all possible segments in the text holistically. It calculates deep feature representations of the segment's start word "phishing" and end word "email," and models the complex interaction between them, ultimately determining that the segment "phishing email" has the highest confidence as the answer. Therefore, the system identifies this segment as a "Technique" argument. This process occurs in parallel; the system can also extract arguments such as "hacker group Shadow" as an "Attacker."

[0037] S4. Result Filtering and Structured Output: Dynamic thresholding adaptive argument filtering: The system does not retain all candidate answers. The dynamic thresholding algorithm evaluates the confidence score of each candidate argument (such as "phishing email") and automatically filters out low-confidence results, ensuring that the final output arguments have high reliability.

[0038] Event structure reconstruction: The system associates and assembles the successfully identified trigger word "intrusion" with various filtered arguments (such as attacker, attack technique, and attack target) to form a complete structured event record.

[0039] Security Knowledge Base Construction: This complete structured event record is automatically stored in the knowledge base. Its storage format is as follows: Event type: Attack.Phishing; Trigger word: Intrusion; Attacker: The hacker group Shadow; Attack technique: Phishing emails; Attack target: Internal servers of a traffic signal control company; Quoted text: The well-known hacker group Shadow... stole some user data.

[0040] S5. Subsequent Applications and Iterations: Multi-dimensional visualization: Data stored in the knowledge base can be displayed through a visualization interface in the form of charts and other formats to show the distribution of attack types, time trends, etc., to assist in security analysis.

[0041] System integration and optimization: The system can collect new data samples and continuously optimize the model through incremental learning to adapt to new threats.

[0042] In Example 1, the "data acquisition and preprocessing" step S1 is explained as follows: Problem Solving: Addressing the heterogeneity and noise issues of the original data.

[0043] Solution Overview: Unstructured text data is collected from multiple sources (including traffic accident reports, safety warnings, highway news, etc.), and the data undergoes unified preprocessing operations, including text cleaning, sentence segmentation, format standardization, and terminology normalization (e.g., unifying "DDoS attack" and "distributed denial-of-service attack" into a standard expression), to provide high-quality input for subsequent model calculations and semantic reasoning.

[0044] Invention points: Innovative data synchronization algorithms and preprocessing processes ensure efficient fusion of data from different sources and types.

[0045] Raw, unstructured text data is obtained from various channels, including traffic accident reports, safety alerts, news articles, public opinion information, and technical blogs. This step ensures comprehensive coverage of data sources and diverse information types, providing a sufficient input foundation for subsequent event extraction.

[0046] It mainly includes the following parts: 1. Multi-source traffic network security text collection: Obtain raw, unstructured text data from various channels such as traffic accident reports, safety alerts, news information, public opinion information, and technical blogs. This step ensures comprehensive coverage of data sources and diversity of information types, providing a sufficient input foundation for subsequent event extraction.

[0047] 2. Text Structure Reading and Unified Format Conversion: Unified conversion of data from different sources and file formats (such as HTML, PDF, plain text, text returned by news API, etc.) to remove format differences and enable them to be stored in the text data pool in a unified string format.

[0048] 3. Text noise cleaning and redundant information filtering: The text is cleaned, including: (1) removing HTML tags, emoticons, and special symbols; (2) deleting webpage template segments, repeated paragraphs, and advertising fragments; (3) filtering out irrelevant information (such as navigation buttons, copyright information, etc.). This process aims to retain the core semantic content related to traffic network security incidents.

[0049] 4. Sentence Segmentation and Text Reorganization: Long texts are segmented into short sentences or sentence fragments according to semantic logic, ensuring that each sentence is a logically independent unit of information. This step provides subsequent machine reading comprehension models with directly input, well-structured text paragraphs.

[0050] 5. Terminology normalization in the field of traffic network security: Standardize terms with the same semantics but different expressions. This normalization process ensures that the model can reduce semantic confusion and improve recognition consistency in subsequent extraction.

[0051] 6. Named entity standardization and normalization of numbers, symbols, and characters: This includes standardized conversion of organization names, system names, threat names, etc., to avoid recognition errors caused by inconsistencies in capitalization or abbreviations. It also standardizes punctuation, number formats, date formats, and unit expressions in text to ensure consistent and standardized text input.

[0052] 7. Text Structure Validation and Consistency Check: The preprocessed text undergoes a consistency review to ensure uniform character encoding, no abnormal truncation, complete text paragraphs, and the absence of illegal characters or garbled text that the model struggles to parse. Finally, all cleaned, segmented, and normalized text is compiled into a standardized text dataset that the model can directly use, serving as the foundational input for subsequent problem template generation and joint encoding.

[0053] In Example 1, the "intelligent generation of problem templates" in step S2 is explained as follows: Problem Solving: Traditional event extraction systems are not capable of capturing complex semantics in traffic network security events, which seriously affects the accuracy and generalization ability of trigger word and argument extraction.

[0054] Solution Overview: The system automatically constructs question templates based on traffic network security event types, attack technology structures, Mobile Matrix (security knowledge system), and the semantic features of the text itself, enabling the model to understand the event ontology in a question-and-answer format and improve semantic accuracy.

[0055] Invention points: This invention introduces the Mobile Matrix semantic system for the first time into event extraction to generate question templates, enabling questions to include semantic information such as attack phase and technical path. It unifies trigger word and argument extraction for MRC question answering tasks, achieving semantic-driven event understanding and automatically generating questions based on event types, thus solving the problem of traditional templates relying on manual design.

[0056] The specific steps are as follows: 1. Construct four types of trigger word question templates: Four templates: “what is the trigger”, “trigger”, “action”, and “verb”. These templates are used to ask which word in the text triggered the event, directly using a fixed verb phrase as the question.

[0057] Purpose: To provide a unified input for trigger word extraction, avoiding reliance on manual rules.

[0058] 2. Based on argument type, construct a basic argument template: Based on argument role types (Who / What / Where), standardized argument templates are constructed. For example, questions about attackers and victims are questions about people, so "Who"-guided questions are designed; questions about locations are questions about places, so "Where"-guided questions are designed; and questions about tools are questions about methods or items, so "What"-guided questions are designed. The third type of template combines the description of each event type to generate questions, which can include more semantic information and is more specific and detailed.

[0059] Table 2.1 Examples of Three Question Templates

[0060] 3. Construct semantically enhanced question templates: The Mobile Matrix in the security field is a matrix for mobile platforms provided by MITRE ATT&CK® (Adversarial Tactics, Techniques, and Common Knowledge). It describes techniques related to device access and network effects that can be exploited by adversaries without device access. This matrix provides information on various techniques attackers might utilize. This patent chose this matrix as the basis for generating problem templates because key components of modern intelligent transportation systems—in-vehicle infotainment systems, intelligent roadside terminals, and mobile traffic management applications—are essentially built on mobile platforms such as Android or iOS. Therefore, the attack patterns and techniques used by attackers against these intelligent transportation systems are highly similar to those used against ordinary mobile devices. Choosing the MITRE ATT&CK Mobile Matrix accurately covers the theoretical framework describing attack behaviors against these mobile components in intelligent transportation systems, ensuring that the generated problem templates directly correspond to the real-world cybersecurity threats faced by current intelligent transportation systems.

[0061] Based on event type names, semantically enhanced questions are constructed, such as "What attack methods are associated with a certain event?" This allows the model to directly understand the mapping relationship from event semantics to argument roles. This paper chooses to design question templates that combine descriptions of potential threat behaviors and attack techniques encountered on mobile devices from this matrix, rather than using general templates for ordinary events. The templates cover 12 attack types and 80 attack techniques to ensure breadth and inclusivity. A template for "Phishing" is designed as an example: Table 2.2 Design Template Examples

[0062] 4. Input sequence unified encoding format: BERT input sequence construction formula: (2.1) Wherein, [CLS] represents the global start marker of the entire input sequence, used to aggregate the overall semantic representation; t is the input question text; [SEP] is used to separate the question from the text; p is the original text segment from which event information needs to be extracted through reading comprehension; and [SEP] at the end of the sequence is used to identify the termination position of the input sequence.

[0063] Technical meaning: t represents the question the model needs to answer, while p represents the textual context related to the question; [CLS] is used to aggregate the overall semantic representation, and [SEP] is responsible for marking the boundaries of different text segments in the encoding structure. This formula reflects the input method of constructing "question-text" into a unified sequence, enabling the model to understand both simultaneously in the same attention space and establish the association between the question and the answer.

[0064] In Example 1, the "multi-task joint encoding" in step S3 is explained as follows: Problem solved: Enables two key subtasks to learn synchronously, share semantic representations, and jointly optimize.

[0065] Solution Overview: In this step, the system uses the pre-trained language model BERT to uniformly encode the "question + text" combination sequence, generating a shared hidden layer. By sharing the semantic space, the model can simultaneously capture the intrinsic relational structure between trigger words and arguments.

[0066] Invention points: Trigger word and argument extraction share the same BERT representation, avoiding redundant modeling and improving efficiency. Trigger word information helps in argument localization, and argument information in turn feeds back into trigger word judgment, making the model's overall semantic understanding ability stronger; by unifying the loss function, end-to-end optimization of the two sub-tasks is achieved, significantly enhancing extraction accuracy and stability.

[0067] In this step, the system uses the pre-trained language model BERT to encode the preprocessed text and the generated question. The innovation lies in employing a joint learning framework, allowing the model to simultaneously learn two closely related subtasks: "trigger word recognition" and "argument extraction." By sharing underlying parameters, the model can better understand the intrinsic connections between trigger words and arguments, improving its overall comprehension ability.

[0068] Specific steps: 1. BERT-based input encoding: The sequence format of the input data is: (3.1) In the input encoding layer, X is input into the BERT pre-trained model, and then BERT is used. Tr and BERT Arg The context representation of each token for trigger word detection and argument extraction is obtained. Finally, the embedding vector matrix corresponding to the token sequence is obtained via BERT. This paper uses a BERT model consisting of a 12-layer Transformer encoder, with the encoding output E of the last layer used as the vector representation of X.

[0069] 2. Encoding layer processing: Trigger word and argument extraction share the same BERT encoded representation. For the input sequence used for trigger word detection... : (3.2) For the input sequence used for argument span extraction : (3.3) in, ∈ Represents token The corresponding embedding vector, is the dimension of the embedded vector. and These represent two versions of the BERT model with the same architecture after fine-tuning. and The encoded outputs of the last layer of BERT obtained on their respective input sequences can all be collectively referred to as... .

[0070] 3. Task-level prediction mechanism: Trigger word prediction based on softmax: Trigger words are keywords or phrases (nouns or verbs) that describe the occurrence of an event and serve to evoke the semantics of the event. Trigger word extraction involves two sub-tasks: (1) Trigger word identification: Identify which words are trigger words; (2) Trigger word classification: Identify the event type corresponding to the trigger word.

[0071] Construct the trigger word classification parameter matrix: Where H=768 is the size of the hidden layers in the Transformer model. Let T be the dimension of the matrix. T represents the number of event types, the value of which is determined by the task definition and the dataset (e.g., when training and evaluating on the ACE 2005 standard dataset, which defines 33 time types, including Attack, Transport, Meet, Die, etc.), and the tags for non-trigger words are also considered. To determine each tag (e.g....), For the type of (), it is necessary to calculate the probability distribution of trigger words. By applying the softmax normalization function to the parameter matrix You can get The value of is the probability distribution of the T event types.

[0072] (3.4) in, E This represents the hidden layer representation of the input sequence after BERT encoding. It is the trigger word classification parameter matrix defined above; Softmax is used to transform the event type score of each tag into an interpretable probability distribution.

[0073] The Softmax function is a commonly used activation function, typically used in the output layer of multi-class classification problems. It transforms a set of arbitrary real numbers into a probability distribution, where each value represents the probability of the corresponding class, with probability values ​​between 0 and 1, and the sum of the probabilities of all classes is 1. The Softmax function is defined as follows: (3.5) in, This represents the i-th element in the original input vector, and N represents the length of the vector.

[0074] Predictive Argument: Argument extraction requires identifying the start and end positions of a segment, thus its prediction complexity is higher than that of trigger word prediction.

[0075] Construct the argument start and end parameter matrix: Where H=768 is the hidden layer size of the Transformer model. Similar to trigger word prediction, the hidden layer size is determined by the input labeled sequence (e.g., The softmax normalization function is applied to calculate the probability that each token is selected as the start and end of an argument span. This yields the probability distribution of each token as the start and end of an argument span.

[0076] Starting position probability: (3.6) End position probability: (3.7) in, Indicates the sequence number The encoding of each token, and It is the argument start and end parameter matrix defined above.

[0077] Argument candidate span collection: Algorithm 1 generates candidate fragments through the following steps: 1. Enumerate all possible (start, end); 2. Check if it is within the sentence's scope; 3. Check if the maximum length constraint is met; 4. Determine if the probability is higher than that of the [CLS] position, regardless of the original probability; 5. Calculate the relative no-answer score: no_ans_score = (Ps([CLS]) + Pe([CLS])) - (Ps(start) + Pe(end)), where no_ans_score is defined as the relative difference between the candidate argument and the "no-answer" prediction. Physically, it represents the increase in confidence relative to the "no-answer" position represented by [CLS]. Since a larger score indicates that the fragment is more likely to be a true argument, a smaller no_ans_score indicates that the fragment is better than the no-answer prediction and should be retained.

[0078] 6. Add the segments that meet the criteria to the candidate set.

[0079] Algorithm 1: Argument Fragment Collection Algorithm

[0080] The labeled dataset is divided into three parts proportionally: a training set, a development set, and a test set. Each sample in the development set is input into the trained model, and Algorithm 1 is run to generate a set of candidate argument fragments and their corresponding no_ans_scores for each sentence in the development set. The set of these fragments is dev_candidates. Similarly, the test set is processed to obtain test_candidates.

[0081] Argument filtering: Algorithm 2 is used to filter candidate arguments using a dynamic threshold, best_thresh. Essentially, Algorithm 2 is a grid search performed on the development set. It tries all possible no_ans_scores as boundaries, searching for the line that best distinguishes between "correct arguments" and "non-arguments." The final best_thresh is a scalar that can be applied to all candidate segments on the test set; this boundary is the global threshold.

[0082] 1. Find the optimal threshold on the development set; 2. Keep the segments where no_ans_score ≤ best_thresh 3. Finally, we obtain the set of valid fragments of argument roles.

[0083] Algorithm 2 Filtering Algorithm

[0084] Joint loss function design: To train the models (BERT_QA_Trigger and BERT_QA_Arg), a negative log-likelihood loss function is used to minimize the training error, and the parameters are updated during training. For the argument extraction module, the loss consists of two parts: the loss for the start label and the loss for the end label.

[0085] (3.8) in, The negative log-likelihood loss represents the trigger word classification. Indicate the starting position of the argument to predict the loss; The loss is predicted by indicating the end position of the argument.

[0086] Technical meaning: This represents the model's understanding of "what the event is"; and This represents the model's ability to locate where event arguments begin and end. The three loss terms work together to simultaneously optimize semantic and structural recognition. Gradients are backpropagated to BERT from all three losses, enabling the model to improve its argument-learning ability when learning trigger words, and vice versa. Ultimately, this achieves overall optimization of event type, event triggering, and argument localization. The joint loss makes the entire event extraction task a unified end-to-end system, improving stability, generalization ability, and extraction accuracy.

[0087] Model construction and implementation: like Figure 1The model structure of this invention includes: a word segmentation encoding module, a BERT semantic encoding module, a trigger word prediction module, an argument extraction module, and a dual affine classification module.

[0088] The trigger word prediction model (BERT_QA_Trigger) and the two argument extraction modules (BERT_QA_Arg and BERT_QA_Arg_Thresh) together constitute the core event extraction unit of this invention. They share the same BERT encoding layer, but each constructs an independent feature projection layer and a dual affine classifier at the prediction end. This model adopts a shared encoder and task decoupling architecture, consisting of a shared encoder and two parallel and independent prediction heads.

[0089] The trigger word prediction module identifies key verbs or nouns in the text that indicate the occurrence of an event, and is the first subtask of event extraction. In this invention, this module uses the context vector output by BERT, performs feature transformation through a feedforward neural network (FFNN), and further uses a dual affine classifier to predict the probability of the event type. The model can score each tag and output whether it constitutes a trigger word and the event category it belongs to.

[0090] The argument extraction module is used to identify entities or semantic roles associated with an event, such as the victim, attacker, attack method, and time of occurrence.

[0091] This invention designs two argument extraction modules: 1. BERT_QA_Arg model: This model is based on a dual affine attention mechanism, which calculates the probability of each tag being the start and end point of an argument, and determines the span of candidate arguments by combining the start and end positions.

[0092] The BERT_QA_Arg_Thresh model, building upon the BERT_QA_Arg model, introduces a dynamic threshold mechanism to automatically filter invalid arguments based on the confidence level of candidate spans. This allows the model to adapt to different text scenarios, improving the robustness and generalization performance of extraction. Both models use the same BERT encoding representation as the trigger word prediction module, but their feature projection layer and dual affine classifier are independent structures.

[0093] In Example 1, the "answer prediction based on dual affine attention mechanism" in step S3 is explained as follows: Problem Solving: This step aims to address the semantic ambiguity and unclear target priorities during traffic event extraction, ensuring that the system can accurately focus on core tasks and reduce interference from irrelevant information.

[0094] Solution Overview: By constructing a unified recognition process and analysis mechanism, the input text is processed in a structured manner, and task focus is automatically assigned within the model, thereby improving the system's processing efficiency and accuracy.

[0095] Invention Point: This method directly evaluates the likelihood of a text segment (from Start Token to End Token) as the overall answer using a complex scoring function. This approach better captures long-distance dependencies between words, significantly improving the accuracy of answer prediction. Specific plan: 1. Dimensionality reduction using feedforward neural networks, generating token representations of the beginning and end of segments.

[0096] For text fragments First, the fragment is calculated using two feedforward neural networks. The embedding vectors are represented by the head token vector and the tail token vector. The dimensionality of the BERT output embedding vector can be reduced using a feedforward neural network.

[0097] (4.1) (4.2) in, The semantic vector of the first token of the fragment. This is the semantic vector of the token at the end of the fragment.

[0098] 2. Calculate the distribution of text fragments across various event types based on a dual affine attention mechanism.

[0099] (4.3) Where U is a The parameter matrix, It is the dimension of the latent vector. This refers to the number of categories. Since the question already includes label information, it will be... Setting it to 2 indicates whether the text fragment is relevant to the label in the question. W is a 2. × The matrix, It is a bias term. It is the softmax function. This is equivalent to making the starting features and ending features in The model interacts within different "relationship spaces," calculating an independent interaction score for each possible category. This allows the model to capture complex patterns such as "what kind of opening word paired with what kind of ending word is more likely to form a fragment representing an 'attacker'." Simultaneously, the model also considers the inherent features of the first and last tokens, concatenating their vectors and transforming them through a linear layer. Finally, the bilinear interaction score, linear transformation score, and bias term are summed, and the probability distribution of the segment belonging to each category is obtained through the Softmax function.

[0100] 3. Select the optimal text segment.

[0101] Finally, using The function finds the largest predicted value of S_i for a text segment. Assign a label to indicate whether the current text fragment belongs to the category suggested in the question. For a given BERT-based input encoding, obtain a score set S for all text fragments in the input. For set S, obtain the prediction result for each text fragment, and use the prediction result of the fragment to determine whether the fragment is related to the event suggested in the question template.

[0102] Technical meaning: and Represents the deep semantic features at both ends of a segment; double affine terms Simultaneously encode header information The secondary relationship of tail information is the core of span-level representation; softmax classification is used to determine whether the fragment is related to the event type suggested in the question, and argmax is used to select the fragment with the highest confidence, realizing the decision from "possible fragment set" to "final argument".

[0103] The answer prediction method based on dual affine attention mechanism breaks through the limitations of traditional token-level methods. By interacting with the information of the first and last tokens and scoring global segments, the model can identify structured argument segments at the sentence level and significantly improve the extraction accuracy and robustness in complex event scenarios.

[0104] In Example 1, the "dynamic threshold adaptive argument filtering" in step S4 is explained as follows: Problem Solving: Traditional fixed thresholds are unstable under different text and event types, which can easily lead to misjudgment or missed detection of arguments.

[0105] Solution Overview: By statistically analyzing the score distribution of candidate segments, an adaptive threshold is automatically generated to enable flexible screening of valid arguments.

[0106] Invention point: A threshold control mechanism that can dynamically change with input features is proposed, making argument screening more robust and generalizable.

[0107] Specific implementation plan: In the preceding steps, the system has already generated candidate argument fragments and their corresponding start and end probabilities. The core task of this step is to automatically filter out valid arguments based on the confidence differences of the candidate fragments using a dynamic threshold strategy, thereby improving the system's stability across different text styles and domain scenarios.

[0108] (1) This step first counts the confidence values ​​of all candidate segments and sorts them according to the "relative no answer score" (no_ans_score) of the segments to obtain the complete segment confidence distribution.

[0109] (2) Subsequently, by evaluating the overall performance of the development set data, the system automatically selects the optimal score threshold so that the overall precision and recall of the final filtering results achieve the best balance.

[0110] (3) During the testing phase, the system filters candidate segments based on the dynamic threshold and retains only argument segments whose no_ans_score is not higher than the threshold, so that the selected arguments are significantly better than the "no matter" prediction in probability.

[0111] (4) The dynamic threshold mechanism can automatically adjust the filtering criteria according to the differences in text, its own confidence distribution and the characteristics of event types, thereby avoiding the problem of insufficient generalization caused by using a fixed threshold.

[0112] (5) Finally, this step outputs a set of valid arguments after dynamic thresholding, providing stable and reliable input data for subsequent event structure reconstruction.

[0113] In Example 1, the “event structure reconstruction” in step S4 is explained as follows: Problem solved: After the trigger words and arguments are extracted independently, they are presented as discrete fragments, which cannot be directly used for event understanding and subsequent analysis.

[0114] Solution Overview: The predicted trigger words and arguments are reassembled according to the event template, so that the text information is converted into structured event units.

[0115] Invention point: Construct an automated event reconstruction mechanism to achieve efficient mapping from fragmented information to a complete event structure.

[0116] The information extracted in the previous steps was fragmented. This step is responsible for assembling these discrete trigger words and arguments according to a predefined event structure (such as the ACE2005 specification) to construct a complete and structured event graph. For example, it links the attacker, victim, time, location, and means of an "attack" event to form structured knowledge that computers can understand and process.

[0117] In Example 1, the “Construction of Security Knowledge Base” in step S4 is explained as follows: Problem Solving: The extracted event information lacks a unified storage method, making it difficult to query, track, and utilize systematically.

[0118] Solution Overview: Based on the domain ontology, event elements are transformed into triples or graph structures and written into the knowledge base to achieve standardized storage and retrieval.

[0119] Invention Point: The invention introduces a semantic knowledge base framework for traffic network security scenarios, providing a core data foundation for situational awareness and decision support in the field of traffic network security.

[0120] Knowledge base design principles, such as Figure 2 : (1) Unified semantic expression principle: It can express the complex and heterogeneous knowledge content in the field of traffic network security with a unified semantic structure, reduce information ambiguity, and improve information interoperability.

[0121] (2) Structured storage principle: By structuring the discrete argument results output by the event extraction model, the knowledge base can support functions such as query analysis, data update, model training and sharing distribution.

[0122] (3) Knowledge sharing and reuse principle: Based on ontology, the structured expression method enables knowledge to be automatically identified, scheduled and reused by the system, thereby improving the efficiency of knowledge application.

[0123] Specific implementation plan: 1. Construct a knowledge ontology structure for transportation network security.

[0124] Based on the characteristics of the attack event text, the core object types required for the ontology knowledge base are determined, including: Attacker information (attacker_info); Affected objects (affected_info); Attack events and techniques (attack_event); Response measures; Security incident log (security_incident).

[0125] 2. Design data attribute fields.

[0126] (1) Object-type properties: Table 7.1 Setting Object-Type Properties

[0127] (2) Data attributes of security events, such as Figure 3 : Table 7.2 Data Attributes of Security Events

[0128] (3) Data attributes of the victim: Table 7.3 Data Attributes of the Attacker

[0129] Based on the prediction results extracted by the model, the structured knowledge should include the IP address of the attacked object, expressed as "affected_ip"; the country or region to which the attacked object belongs, expressed as "affected_country"; and the organization affected, expressed as "affected_org".

[0130] (4) Data attributes of attack type: Table 7.4 Data Attributes of Attack Types

[0131] Based on the prediction results extracted by the model and the way questions are generated, structured knowledge should include the type of attack, expressed as "attack_type"; the attack techniques, methods, and tools, expressed as "attack_tech"; the scope of impact, expressed as "influence_range"; and an introduction to relevant attack methods based on security domain knowledge, expressed as "introduction".

[0132] (5) Attacker's data attributes: Table 7.5 Attacker's Data Attributes

[0133] Based on the prediction results extracted by the model and the way the questions are generated, the structured knowledge should include the attacker's IP address, expressed as "attacker_ip"; the country or region to which the attacker belongs, expressed as "attacker_country"; and the device used in the attack, expressed as "attacker_equipment".

[0134] (6) Data type of corresponding measures: Table 7.6 Data Attributes of Corresponding Measures

[0135] Based on the prediction results extracted by the model, the structured knowledge should include the response measures taken by the system after being attacked, expressed as "response_measures"; the time required for the response, expressed as "response_time"; and relevant information on the response measures, expressed as "introduction".

[0136] 3. Use SQLite for persistent storage of the knowledge base: like Figure 4 The knowledge base storage engine uses SQLite 3.45.3 and is set to UTF-16 encoding for cross-platform read and write.

[0137] The storage process includes: (1) Load the trained event extraction model; (2) Run the prediction to obtain structured event data; (3) Insert the data into SQLite according to the ontology fields in Tables 7.1-7.3; (4) Supports subsequent addition, deletion, modification and query and historical event retrieval.

[0138] 4. Enable security incident analysis and trend discovery: like Figure 5 The data stored in the knowledge base supports various analytical tasks, including: (1) Statistical analysis of the frequency of different types of events; (2) The distribution pattern of attack targets; (3) Identification of regional and high-risk period trends; (4) Analysis of the types of attacked systems and their vulnerabilities; (5) These functions correspond to the description of the purpose of the knowledge base in the documentation. Through SQL queries, users can instantly obtain the latest event information and trend analysis to support the emergency response and strategy formulation of traffic management departments.

[0139] In Example 1, the "multi-dimensional visualization display" in step S5 is explained as follows: Problem Solving: Although structured event data has been stored in the knowledge base, it lacks an intuitive way of displaying it, which is not conducive to traffic management departments quickly understanding the distribution, trends and risk points of events, resulting in low information utilization efficiency.

[0140] Solution Overview: This step involves constructing a multi-dimensional visualization interface to present information such as event types, geographical distribution, time series changes, and affected systems in the knowledge base using charts, heatmaps, and statistical curves, enabling the extraction results to be directly transformed into interpretable security situation information.

[0141] Invention Point: It provides a multi-perspective, intuitive display mechanism, enabling the extracted results to be directly used for security assessment and decision support. It transforms complex underlying data into intuitive insights, significantly improving system usability and user experience.

[0142] Implementation steps: (1) Extract the fields required for visualization from the knowledge base; (2) Generate time-dimensional analysis charts; (3) Construct geospatial visualization (GIS heat map); (4) Multidimensional analysis of system types and attack techniques; (5) Construct a comprehensive situational awareness dashboard; (6) Supports interactive filtering and querying.

[0143] In Example 1, the "system integration and optimization" in step S5 is explained as follows: Problem Solving: Traffic network security incident patterns change dynamically, making it difficult for static models to maintain accuracy over the long term.

[0144] Solution Overview: The system updates model parameters and templates regularly based on new data and user feedback, enabling it to self-evolve.

[0145] Invention points: A closed-loop update mechanism for event extraction tasks is proposed, which transforms newly added event knowledge into training samples, realizes knowledge-driven incremental training, and enables the system to continuously adapt to new scenarios and maintain stable performance.

[0146] Specific implementation plan: (1) Collect new data and user feedback; (2) Construct an incremental training dataset; (3) Perform incremental training; (4) Dynamically update problem templates and threshold strategies; (5) Update the knowledge base and form a continuous iterative closed loop.

[0147] The following is a specific experimental example of this application: This experiment uses the widely used benchmark dataset ACE 2005 in the field of event extraction for validation. This dataset contains English documents of various genres, including newsletters and radio news, and provides detailed event trigger words, arguments, and role annotations. The dataset was validated using the official data partitioning (training / development / test set ratio of 529:29:40) and hyperparameter settings (batch size of 8, learning rate of 4e-5) consistent with mainstream research. Model performance was evaluated using common metrics such as precision, recall, and F1 score to ensure comparability and fairness of the results. Experimental results show that this patented solution performs excellently on the core task of event extraction: the F1 score for trigger word extraction reaches 74.85%, and the F1 score for argument extraction reaches 64.32%. Compared to existing technologies, such as the OneIE model (Lin et al., 2020), which achieves F1 scores of approximately 73.2% (trigger words) and 61.5% (arguments) on the same task, this solution demonstrates significant improvements in both key metrics. This modular design ensures both the scalability of the processing flow and provides a reliable data foundation for traffic network security decision-making through end-to-end structured output, fully reflecting the technological advancement and practical value of the patented solution.

[0148] The implementation of use case two, "An Early Warning Method Based on Traffic Network Security Incident Extraction," includes the following steps: S1: Data Input: The early warning system continuously reads newly stored structured event records from the traffic network security knowledge base constructed in Example 1. S2: Rule Execution and Early Warning Signal Generation: The system's built-in early warning engine loads predefined early warning rules and performs real-time analysis on the input event records. The "early warning rules" are specific judgment conditions implemented by the following technical logic modules: Rule A (High-Frequency Attack Warning): The statistics module maintains a sliding time window (e.g., window size set to 30 minutes). It counts in real-time the number of events of the same type (event_type, such as 'DDoS') targeting the same IP (affected_ip) within this window. When the judgment module detects that this number exceeds a preset threshold (e.g., 3 times), the signal generation module immediately generates a "High-Frequency Attack Warning" signal, which contains information about the attack target, attack type, and event frequency.

[0149] Rule B (Critical Asset Threat Warning): The system has a pre-set list of critical assets, which lists traffic system components that require key protection (such as "the intelligent traffic signal control center server of a certain city"). The rule matching module matches the affected_org (affected organization) or target (attack target) field of each new event with the critical asset list. Once a match is successful, regardless of the number of attacks, the signal generation module will generate a high-level "Critical Asset Threat" warning signal.

[0150] S3: Warning Output and Response: The generated warning signal is transmitted to the warning distribution module. This module displays the warning information in real time on the visual situation screen of the traffic safety monitoring center, and simultaneously triggers subsequent processes automatically through the system API interface, such as sending notification SMS messages to the mobile terminals of safety maintenance personnel, or automatically creating a handling work order on the emergency response platform.

[0151] Through the above steps, this method makes full use of the technical achievements of previous event extraction and knowledge base construction, and embodies the "early warning rule" as an automated technical means based on data processing, threshold comparison and pattern matching, thereby effectively improving the detection and response efficiency of traffic network security threats.

[0152] In summary, this application overcomes the limitations of traditional event extraction methods by utilizing machine reading comprehension technology to achieve deep semantic analysis and structured extraction of traffic network security events. Innovations include: 1. Propose a domain knowledge-driven question generation strategy: This application is the first to transform the task of extracting traffic network security incidents into a multi-turn question-and-answer machine reading comprehension question. Instead of directly using argument names to ask questions, it combines event descriptions and technical elements from the security domain's Mobile Matrix (MITRE ATT&CK Mobile) to generate natural language questions. This guides the model to accurately capture the semantic relationships between event trigger words and arguments, significantly improving event semantic understanding and extraction accuracy.

[0153] 2. This application presents a BERT-based reading comprehension event extraction model: It utilizes a BERT pre-trained language model to obtain contextual representations of input sequences and constructs question-answering event extraction models for trigger word extraction and argument extraction, respectively. Unlike traditional information extraction methods, this model requires no entity annotation or preprocessing steps, transforming event extraction into an end-to-end question-answering task. It supports joint training of both trigger word extraction and argument extraction tasks. Its core lies in jointly optimizing all parameters through a unified loss function, allowing the gradient signals generated by the two tasks to converge and fuse within a shared encoder during training. This achieves bidirectional "knowledge feedback"—argument information helps disambiguate trigger word types, while trigger word information provides contextual constraints for determining argument roles. This deep interactive optimization mechanism ensures that the model learns a collaborative representation sensitive to the overall event structure, rather than a simple superposition of task-independent features, thus surpassing the performance of traditional multi-task learning.

[0154] 3. Joint Optimization of Trigger Word and Argument Extraction: By designing a unified joint training framework, the two subtasks of trigger word extraction and argument extraction are optimized simultaneously. This joint training mechanism enables the model to learn shared features between the two tasks.

[0155] 4. Dynamic Threshold Adaptive Argument Filtering: A dynamic threshold-based argument filtering algorithm is proposed. This algorithm dynamically controls the number of arguments by calculating the relative no-answer score (no_ans_score) of candidate arguments in real time and comparing it with an adaptive threshold. The algorithm first finds the optimal threshold on the development set, and then filters low-quality candidates, avoiding the subjectivity of manually setting hyperparameters and improving the system's robustness in different scenarios.

[0156] 5. End-to-End Structured Knowledge Construction: The system implements an end-to-end processing flow from raw text to a structured knowledge base. By automatically storing the extracted results into an SQLite database according to the ontology model, it supports dynamic querying and analysis of dimensions such as attack type, affected objects, and response measures. This design enables the system to update the traffic network security knowledge base in real time, providing a data foundation for risk warning and decision support.

[0157] In summary, this application makes systematic innovations in question construction, semantic modeling, and reasoning mechanisms. By introducing a domain knowledge-driven question generation strategy, a fragment-level answer prediction method based on dual affine attention, and a joint training mechanism for trigger word and argument extraction, it significantly improves the model's semantic understanding and extraction accuracy of traffic network security event texts. This method overcomes the shortcomings of traditional rule-based and sequence labeling models in adaptability to scenarios with few samples, complex semantic expressions, and dynamic traffic environments. It achieves efficient and accurate structured extraction of traffic network security events, better meeting the urgent need for high-quality event data in current traffic information security analysis.

[0158] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0159] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0160] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0161] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0162] The background section of this invention may include background information about the problems or environment in which the invention is being developed, and is not necessarily a description of prior art. Therefore, the content included in the background section does not constitute an admission of prior art by the applicant.

[0163] The above description provides a further detailed explanation of the present invention in conjunction with specific / preferred embodiments, and it should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various substitutions or modifications can be made to these described embodiments without departing from the concept of the present invention, and all such substitutions or modifications should be considered within the scope of protection of the present invention. In the description of this specification, the reference to terms such as "an embodiment," "some embodiments," "preferred embodiment," "example," "specific example," or "some examples," etc., indicates that the specific features, structures, materials, or characteristics described in connection with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples. Although the embodiments of the present invention and their advantages have been described in detail, it should be understood that various changes, substitutions, and modifications can be made herein without departing from the scope of protection of the patent application.

Claims

1. A method for extracting traffic network security incidents based on machine reading comprehension, characterized in that, Includes the following steps: Acquiring unstructured text data in the field of traffic network security; Based on a pre-defined knowledge system of traffic network security, natural language questions corresponding to argument roles are generated. The unstructured text data and the natural language question are combined into a sequence and input into a pre-trained language model for joint encoding to obtain the contextual semantic vector representation of the sequence. Based on the context semantic vector representation, the event trigger words in the unstructured text data are identified and classified by the trigger word prediction module; Based on the context semantic vector representation, the argument extraction module, guided by the natural language question, predicts and extracts arguments corresponding to the event trigger words from the unstructured text data. The trigger word prediction module and the argument extraction module share the encoding layer of the pre-trained language model and are jointly trained and optimized based on the shared semantic representation.

2. The method according to claim 1, characterized in that, The process of generating natural language questions corresponding to argument roles based on a pre-defined knowledge system of traffic network security includes the following steps: Based on the argument roles, select one template from a variety of predefined question templates; The various question templates include at least: a basic template based on argument role names, and a semantically enhanced template generated based on attack techniques and event descriptions in the traffic network security knowledge system.

3. The method according to claim 2, characterized in that, The semantic enhancement template is generated by incorporating the attack phases and attack technique names from the MITRE ATT&CK Mobile matrix.

4. The method according to claim 1, characterized in that, Arguments are predicted and extracted using an argument extraction module, and a fragment-level prediction method based on a dual affine attention mechanism is employed, including the following steps: The context semantic vector representation is reduced in dimensionality to obtain a reduced-dimensional representation of each smallest processing unit token in the text; For any candidate segment in the text, calculate the bilinear interaction score between its start position token representation and its end position token representation; By combining the bilinear interaction score and the linear transformation score, the probability of the candidate segment being the argument corresponding to the natural language problem is calculated using the softmax function.

5. The method according to claim 1, characterized in that, The method further includes: Calculate the relative no-answer score for extracted arguments, whereby the relative no-answer score is defined as the difference between the sum of the start and end position probabilities of the argument fragment and the sum of the probability of the specific marker position representing the argument; The relative no-answer score is compared with a dynamic threshold, and arguments whose relative no-answer scores are higher than the dynamic threshold are filtered out. The dynamic threshold is determined by grid search on the development set to optimize the overall performance of argument extraction.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: associating and assembling the successfully extracted event trigger words and arguments according to a predefined event structure to form a structured event record; and storing the structured event record in a structured knowledge base.

7. A traffic network security incident extraction system based on machine reading comprehension, characterized in that, include: The data acquisition module is configured to acquire unstructured text data in the field of traffic network security. The question generation module is configured to generate natural language questions corresponding to argument roles based on a preset traffic network security knowledge system. The joint encoding module is configured to combine the unstructured text data and the natural language question into a sequence, input it into a pre-trained language model, and obtain the contextual semantic vector representation of the sequence; the trigger word prediction module is configured to identify and classify event trigger words in the unstructured text data based on the contextual semantic vector representation. The argument extraction module is configured to predict and extract arguments corresponding to the event trigger words from the unstructured text data based on the context semantic vector representation and guided by the natural language question; wherein the trigger word prediction module and the argument extraction module share the output of the joint encoding module, and the system performs joint training and optimization based on the shared semantic representation.

8. The system according to claim 7, characterized in that, The argument extraction module employs a fragment-level prediction model based on a dual affine attention mechanism.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the method as described in any one of claims 1 to 6.

10. An early warning method based on traffic network security incident extraction, characterized in that, Includes the following steps: The traffic network security incident extraction method based on machine reading comprehension as described in claim 6 is used to extract structured event records from unstructured text; The structured event records are stored in the traffic network security knowledge base; Based on the event records stored in the traffic network security knowledge base, and combined with the early warning rules, an early warning signal is generated.

Images