Man-machine collaborative network threat knowledge entity alignment method and system based on large model

Abstract

The invention discloses a man-machine collaborative network threat knowledge entity alignment method and system based on a large model, and relates to the technical field of artificial intelligence. The method comprises the following steps: respectively coding a source knowledge graph and a target knowledge graph by utilizing a relational graph attention network, and generating a structure embedding vector and a naming embedding vector of each entity; calculating a structural similarity matrix between the entities based on the structural embedding vectors, calculating a naming similarity matrix between the entities based on the naming embedding vectors, and synthesizing the two matrixes to generate a candidate aligned entity set; and inputting the candidate alignment entity set and the context information thereof into the large language model subjected to fine adjustment of the network threat domain knowledge to obtain an alignment result. On the basis of a large model, a network threat sub-graph and network threat unstructured knowledge are introduced in combination with an RAG framework, so that the large model can concentrate on the network threat field and query and analyze related entity relationships and attribute features, the demand for a training data set is reduced, large model illusion is reduced, and the accuracy of entity alignment is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a method and system for network threat knowledge entity alignment based on large models. BACKGROUND

[0002] With the increasing complexity and concealment of network attack means, building a network threat knowledge graph that integrates multi-source information has become the key to realizing intelligent threat perception and research. Entity alignment, as a core technology of knowledge fusion, aims to identify entities in different knowledge graphs that point to the same object in the real world, and is the basis for building a unified and high-quality threat knowledge base.

[0003] In recent years, entity alignment technology has mainly evolved from traditional similarity calculation to deep learning-based methods: Methods based on representation learning: These methods use graph neural networks (GNN) to automatically learn the embedding representation of entities in graph structure, and perform alignment by measuring the similarity of embedding vectors. Although they can capture certain semantic and structural information, they face significant bottlenecks in actual network threat scenarios: first, they rely heavily on a large amount of high-quality labeled data (alignment seeds) for supervised learning, and high-precision labeling in the network security field is costly, resulting in a sharp decline in model generalization ability in few-shot and zero-shot scenarios; second, they struggle to effectively handle the widespread problems of naming variation, attribute absence, and graph heterogeneity in threat intelligence, and lack deep semantic understanding.

[0004] Methods based on pre-trained language models: Large models represented by BERT and others contain rich general knowledge through self-supervised pre-training, providing a new approach to understanding the natural language semantics of entity descriptions. However, applying general large models directly to specialized fields creates a "domain gap." Although they can be adapted to the network security field through fine-tuning (such as using LoRA and other parameter-efficient methods), fine-tuned large models still face challenges in actual inference: on the one hand, network security data has strong timeliness and long-tail distribution characteristics, making it difficult for training sets to cover all emerging threat entities and relationships, leading to models prone to "hallucinations" and generating inaccurate alignment results; on the other hand, existing methods fail to effectively integrate the structured information of knowledge graphs (such as entity relationships) with the semantic reasoning capabilities of large models, with the two often independent of each other and failing to form a synergistic effect.

[0005] In summary, existing technologies have not adequately addressed the problem of entity alignment under few-shot conditions, and lack a mechanism to effectively constrain the professional domain reasoning of large models and suppress hallucinations. Therefore, there is an urgent need for a new technical solution that can deeply integrate the structured knowledge of graphs with the semantic understanding capabilities of large models, while reducing dependence on labeled data and significantly improving the accuracy and reliability of alignment results. SUMMARY

[0006] The present application aims at the above-mentioned problems existing at present, and provides a method and system for aligning network threat knowledge entities based on large models.

[0007] The technical solution of the present application is as follows: A method for aligning network threat knowledge entities based on large models, comprising the following steps: Graph embedding representation, using a relationship graph attention network to encode the source knowledge graph and the target knowledge graph respectively, to generate a structural embedding vector and a naming embedding vector for each entity; Candidate entity generation, calculating the structural similarity matrix between entities based on the structural embedding vector, calculating the naming similarity matrix between entities based on the naming embedding vector, and generating a candidate alignment entity set by integrating the two; Large model collaborative alignment, inputting the candidate alignment entity set and its context information into a large language model fine-tuned in the network threat field, to guide the large language model to perform the following steps: Generating or selecting a standard entity representation based on its internal knowledge and external network threat knowledge base; Calculating the similarity between each candidate entity and the standard entity for preliminary screening; Performing semantic and attribute comprehensive analysis on the screened candidate entities and the target entity to generate a preliminary alignment result; Manual verification and feedback, manually confirming the preliminary alignment result, and feeding back the verification result to the large language model to optimize its subsequent reasoning performance.

[0008] Further, the construction of the network threat knowledge base comprises: The vulnerability and defect structured data is directly stored in the database in the original data structure, and the network threat unstructured data is preprocessed into text segments and stored in the database according to the entries; Using bert to convert the data in the database into high-dimensional vectors, and storing these high-dimensional vectors in the vector database using HNSW structure; Selecting a small part of the data set from the network threat database, requiring the data set to cover all entity types and relationship types, and constructing a network threat standard sub-graph according to the entity A-relation a-entity B triple form.

[0009] Further, the manual verification and feedback comprises: Fine-tuning: on the basis of Qwen, using LoRA to pre-train, combining SFT method to complete model training on the manually constructed vulnerability event data set; In the form of multiple-choice questions, guide the network threat knowledge fusion large model to select or generate a standard entity from the candidate entity and the network threat knowledge base based on its own knowledge and the network threat knowledge base; Calculate the edit distance between each candidate entity and the standard entity to further filter the candidate entities:

[0010] Input the context description, attribute information and topological relationship of the target entity and its candidate entities into the pre-trained large language model; the large model, based on its internal knowledge base and context understanding ability, comprehensively judges the semantic consistency, naming logic, functional role and behavior pattern between the candidate entity and the target entity, and generates the alignment result; Manually check the alignment result, use the correct alignment sample as an example in the prompt project; use the feedback data for instruction fine-tuning or adapter fine-tuning of the large language model; and store the feedback result in the knowledge base to record the historical verification result.

[0011] Further, the candidate entity generation includes: After obtaining the entity structure embedding, use cosine similarity to evaluate the similarity between entities; the structure embedding of the source entity is vector , and the structure embedding of the target entity is vector , and the cosine similarity calculation formula is as follows: , After obtaining the structure embedding similarity between all entities and the target entity, the cosine similarity scores of the source entity and the corresponding target entity form a structure similarity matrix . After obtaining the entity naming embedding, use L2 distance to evaluate the similarity between entities, and the naming embedding vector of the source entity is , and the naming embedding vector of the target entity is , The distance calculation formula is as follows: , wherein is the vector dimension, after obtaining the naming embedding similarity between all entities and the target entity, the cosine similarity scores of the source entity and the corresponding target entity form a structure similarity matrix .

[0012] Further, the graph embedding representation specifically includes the following contents: Obtain the knowledge graph to be aligned and , wherein represents an entity set, representing a set of relation types, representing a set of triples; for each entity , extract its name, alias and description text information; Structural embedding learning, using RGAT model to encode two knowledge graphs respectively, using multi-layer relationship perception attention mechanism to aggregate neighbor information; in each layer, for each entity , calculate the attention weight between it and the neighbor entity, and then weight the sum of the embedding vectors of the neighbor entities to update the embedding representation of After several layers of iteration, the final structural embedding vector of each entity is obtained, which can reflect the topological position of the entity in the graph and its semantic association with the surrounding entities; Name embedding generation, using the Bert model to encode the obtained entity name, alias and description text information; input each piece of text into the pre-trained model, output the corresponding context-sensitive embedding representation; integrate the embedding vectors of different segments through pooling operation to form the name embedding vector of each entity , which is used to retain the surface form and semantic features of the entity.

[0013] Further, the large language model is a domain adaptation model obtained by using a low-rank adaptive method and fine-tuning instructions based on a Qwen model and network threat field data.

[0014] The application also includes a large model-based human-computer collaboration network threat knowledge entity alignment system applying a large model-based human-computer collaboration network threat knowledge entity alignment method, which includes: Graph embedding representation module, using a relationship graph attention network to encode the source knowledge graph and the target knowledge graph respectively, to generate the structural embedding vector and the name embedding vector of each entity; Candidate entity generation module, based on the structural embedding vector to calculate the structural similarity matrix between entities, based on the name embedding vector to calculate the name similarity matrix between entities, and to generate a candidate alignment entity set by integrating the two; Large model collaborative alignment module, inputting the candidate alignment entity set and its context information into the large language model fine-tuned by network threat field knowledge, retrieving or generating the most possible standard entity representation from the standard entity library, and filtering the high-confidence candidate results by calculating the edit distance between the candidate entities and the standard entities; the large model integrates entity attributes, semantic relationships and context information to generate a preliminary judgment of entity alignment; the result is verified by artificial verification to form the final alignment output, and the verification result is fed back to the large model.

[0015] Further, the large model cooperative alignment module comprises a network threat knowledge base module and a large model processing module. The network threat knowledge base module comprises a network crawler, a knowledge extraction model, a network threat knowledge base network threat sub-atlas; provides training data for the large model, and provides data support for the judgment of the large model; The large model processing module: in the form of asking questions, the fine-tuned large model selects or generates standard entities, calculates the edit distance between each candidate entity and the standard entity, and on this basis, analyzes the entity relationship semantics and attributes to generate entity alignment results. The result will be confirmed by people and fed back to the large model.

[0016] The present application also includes a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to realize the steps of a large model-based human-computer cooperative network threat knowledge entity alignment method.

[0017] The present application also includes a computer readable storage medium, the computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by the processor to realize the steps of a large model-based human-computer cooperative network threat knowledge entity alignment method.

[0018] Compared with the existing technology, the beneficial effects of the present application are: 1. A feasible large model-based human-computer cooperative network threat knowledge entity alignment method is proposed, which can effectively solve the problem of few-sample network threat knowledge entity alignment.

[0019] 2. A human-computer cooperative large model network threat knowledge entity alignment method is proposed, which can solve the problem of hallucination of the large model in the entity alignment task and improve the efficiency of entity alignment. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 The flowchart of the method of the present application is shown.

[0021] Figure 2 The network threat knowledge base construction schematic diagram is shown.

[0022] Figure 3 The human-computer cooperative large model knowledge entity alignment module schematic diagram is shown. DETAILED DESCRIPTION

[0023] It is to be understood that the terms "first" and "second" and similar relating terms are used merely to distinguish one entity or action from another, and do not necessarily require or imply any such actual relationship or order between such entities or actions. Also, the terms "comprising", "containing" or any other variant thereof are intended to cover non-exclusive inclusions, such that a process, method, article or apparatus that comprises a list of elements does not include only those elements recited, but also other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, an element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0024] The features and performances of the present application will be further described in detail below in connection with embodiments.

[0025] Please refer to Figures 1-3 A method for aligning network threat knowledge entities based on large models, as shown in Figure 1 , comprising the following steps: Graph embedding representation, using a relational graph attention network to encode the source knowledge graph and the target knowledge graph respectively, to generate a structural embedding vector and a naming embedding vector for each entity; Candidate entity generation, based on the structural embedding vector, a structural similarity matrix between entities is calculated, based on the naming embedding vector, a naming similarity matrix between entities is calculated, and a candidate alignment entity set is generated by integrating the two; Large model collaborative alignment, input the candidate alignment entity set and its context information into the large language model fine-tuned by network threat domain knowledge, guide the large language model to perform the following steps: Generate or select a standard entity representation based on its internal knowledge and external network threat knowledge base; Calculate the similarity between each candidate entity and the standard entity, and perform preliminary screening; Perform semantic and attribute comprehensive analysis on the screened candidate entities and the target entity to generate a preliminary alignment result; Manual verification and feedback, manually confirm the preliminary alignment result, and feed back the verification result to the large language model to optimize its subsequent reasoning performance.

[0026] As shown in Figure 2 , the construction of the network threat knowledge base includes: The vulnerability and defect structured data is directly stored in the database with the original data structure, and the network threat unstructured data is preprocessed into text segments and stored in the database according to the entries; The data in the database is converted into high-dimensional vectors using BERT, and these high-dimensional vectors are stored in a vector database using an HNSW structure. A small data set is selected from the network threat database, which covers all entity types and relationship types. The network threat standard sub-graph is constructed in the form of entity A-relation a-entity B triplets.

[0027] As shown in Figure 3 Artificial verification and feedback include: Model fine-tuning: Qwen, in terms of knowledge reasoning, knowledge analysis, and context understanding, performs well and occupies moderate video memory. Pre-training data: security vendor announcements, vulnerability authority libraries (CVE, CNNVD, CNVD), self-built vulnerability mining method set, CAPEC, ExploitDB, and other basic network security vulnerability-related knowledge data. Supervised training data: machine and human-built vulnerability event set, allowing the model to understand various vulnerability events and security instructions. Fine-tuning: based on Qwen, using LoRA for pre-training, combined with the SFT method, the model is trained on the manually constructed vulnerability event data set. In the form of multiple-choice questions, guide the network threat knowledge fusion large model to select or generate a standard entity from the candidate entities and the network threat knowledge base based on its own knowledge and the network threat knowledge base; Calculate the edit distance between each candidate entity and the standard entity to further filter the candidate entities:

[0028] Input the context description, attribute information (such as type, IP address, attack method, timestamp, etc.), and topological relationship (such as neighbor nodes, connection relationship) of the target entity and its candidate entities into the pre-trained large language model. Based on its internal knowledge base and context understanding ability, the large model comprehensively judges the semantic consistency, naming logic, functional role, and behavior pattern between the candidate entity and the target entity, and generates alignment results; Artificial verification of alignment results, correct alignment samples as few-shot examples in prompting, enhance the model's judgment accuracy in subsequent tasks; feedback data for instruction tuning or adapter tuning of the large language model to continuously improve its alignment ability in the network security field; and store feedback results in the knowledge base, record historical verification results, and support model analogy reasoning in similar scenarios.

[0029] Candidate entity generation includes: After obtaining the structural embedding of entities, cosine similarity is used to evaluate the similarity between entities; the structural embedding of source entities is vector , and the structural embedding of target entities is vector , and the cosine similarity calculation formula is as follows: , After obtaining the structural embedding similarity between all entities and target entities, the cosine similarity scores of source entities and corresponding target entities are combined to form a structural similarity matrix ; After obtaining the naming embedding of entities, L2 distance is used to evaluate the similarity between entities, and the naming embedding vector of source entities is , and the naming embedding vector of target entities is , The distance calculation formula is as follows: , wherein is the vector dimension, after obtaining the naming embedding similarity between all entities and target entities, the cosine similarity scores of source entities and corresponding target entities are combined to form a structural similarity matrix .

[0030] The graph embedding specifically includes the following contents: Obtain the knowledge graphs to be aligned and , wherein represents a set of entities, represents a set of relationship types, represents a set of triples; for each entity , extract its name, alias, and description text information; Structural embedding learning: use the RGAT model to encode the two knowledge graphs respectively, and use the multi-layer relationship perception attention mechanism to aggregate neighbor information; in each layer, for each entity , calculate the attention weight between it and the neighbor entity, and then weight the sum of the embedding vectors of the neighbor entities to update the embedding representation of ; After several layers of iteration, the final structural embedding vector of each entity is obtained , which can reflect the topological position of the entity in the graph and its semantic association with the surrounding entities; Naming embedding generation: use the Bert model to encode the obtained entity name, alias, and description text information; input each piece of text into the pre-trained model to output the corresponding context-sensitive embedding representation; integrate the embedding vectors of different segments through pooling operation to form the naming embedding vector of each entity , for preserving the surface form and semantic features of an entity.

[0031] The large language model is a domain adaptation model obtained by using a low-rank adaptive method and fine-tuning based on a Qwen model and network threat field data.

[0032] The present application also includes a large model-based human-computer collaborative network threat knowledge entity alignment system, which applies a large model-based human-computer collaborative network threat knowledge entity alignment method, comprising: A graph embedding representation module encodes the source knowledge graph and the target knowledge graph respectively using a relation graph attention network to generate structural embedding vectors and named embedding vectors for each entity. A candidate entity generation module calculates a structural similarity matrix between entities based on the structural embedding vectors, calculates a named similarity matrix between entities based on the named embedding vectors, and generates a candidate alignment entity set by integrating the two. A large model collaborative alignment module inputs the candidate alignment entity set and its context information into a large language model fine-tuned based on network threat field knowledge, retrieves or generates the most possible standard entity representation from a standard entity library, and filters high-confidence candidate results by calculating the edit distance between the candidate entities and the standard entities. The large model generates a preliminary judgment of entity alignment by integrating entity attributes, semantic relationships, and context information. The result is verified by humans to form the final alignment output, and the verification result is fed back to the large model (such as by prompting engineering or fine-tuning strategy to improve model performance).

[0033] The large model collaborative alignment module includes a network threat knowledge base module and a large model processing module. The network threat knowledge base module includes a network crawler, a knowledge extraction model, and a network threat knowledge base network threat sub-graph. It provides training data for the large model and data support for the judgment of the large model. The large model processing module: in the form of a question, the fine-tuned large model selects or generates standard entities, calculates the edit distance between each candidate entity and the standard entity, and analyzes the entity relationship semantics and attributes based on this to generate an entity alignment result. The result will be confirmed by humans and fed back to the large model.

[0034] Graph embedding part: In this part, the graph attention network model encodes two knowledge graphs respectively, aggregates neighbor information through multi-layer relationship-aware attention mechanism, and learns the structural embedding of each entity. This embedding vector fully reflects the topological position of the entity in the graph and its semantic association with the surrounding entities. At the same time, the model also encodes the text information such as the name, alias, and description of the entity into the name embedding through the BERT language model, in order to retain the surface form and semantic features of the entity.

[0035] Finally, each entity is represented as two independent embedding vectors: structural embedding and name embedding , which are used for subsequent structural similarity calculation and name similarity matching respectively. By jointly modeling structural and naming information, the invention effectively improves the entity alignment capability in complex scenarios such as graph structure heterogeneity and diverse naming.

[0036] Large model processing part: To adapt to the knowledge fusion task in the field of network threat intelligence, the invention adapts and optimizes the large language model in the field. First, considering the model's ability in relation reasoning, semantic understanding and knowledge representation, the Qwen model is selected as the basic pre-training model. On this basis, the low-rank adaptive (LoRA, Low-Rank Adaptation) method is used to fine-tune the model, so that it has a deep understanding of the terminology, entity naming conventions and attack patterns in the field of threat intelligence.

[0037] After fine-tuning, the large language model enters the entity alignment processing stage. The model combines its internal prior knowledge and external network threat knowledge base (such as MITRE ATT&CK, CISA vulnerability library, etc.) to identify and generate the most likely standard entity representation from the candidate entities, as the semantic benchmark for alignment.

[0038] Then, the edit distance between each candidate entity and the standard entity is calculated, and the negative L2 distance or normalized edit distance is used as the similarity measure to further filter the high-confidence candidate set and reduce the search space for subsequent reasoning.

[0039] Finally, the large language model analyzes the attribute information (such as IP address, port, malicious type, TTPs, etc.) of the remaining candidate entities and their semantic relationships (such as "launching attacks", "belonging to organizations", "exploiting vulnerabilities", etc.) in the knowledge graph, and converts the alignment task into a structured judgment or sorting task through prompt engineering, generating the preliminary results of entity alignment.

[0040] The preliminary result is output to a manual verification link, which is confirmed, corrected or vetoed by researchers. The verification result is fed back to the large model to update the prompt template, enhance the example library or further fine-tune the model parameters, forming a "reasoning-verification-optimization" closed-loop mechanism to continuously improve the accuracy and adaptability of the system in actual application scenarios.

[0041] The application also includes a computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the method for aligning network threat knowledge entities based on large models when executing the program.

[0042] The application also includes a computer readable storage medium having computer readable instructions stored thereon, wherein the computer readable instructions implement the steps of the method for aligning network threat knowledge entities based on large models when executed by a processor.

[0043] Application examples: (1) In subgraph a, there are the following four tuples: {(OpenSSL, exists, heartbleed vulnerability, attackers can remotely read private keys, session tokens and user data in server memory), (Equifax, exists, Apache Struts remote code execution vulnerability, leaks 1.43 billion personal sensitive information of American users), (Log4j, exists, Log4Shell remote code execution vulnerability (CVE-2021-44228), millions of Java applications worldwide face arbitrary code execution risk)} In subgraph b, there are the following four tuples: {(OpenSSL 1.0.1-1.0.1f, has, CVE-2014-0160 buffer over-read vulnerability, attackers can remotely read sensitive information in process memory), (Equifax Inc, has, CVE-2017-5638, leading to large-scale user privacy data leakage events), (Target, was attacked via, a third-party HVAC vendor credential compromise vulnerability, leading to attackers stealing payment card data of 40 million customers)} Call graph attention network model and BERT model to complete entity set and relationship set entity set and relationship set structural semantics (neighbor relations and topological positions in the graph) and naming semantics representation.

[0044] (2) After the completion of entity representation, RGAT learns the structural embedding and attribute embedding of each entity based on the similarity matrix to generate a candidate entity set , , … (3) The candidate entity set is batch input into the large model, and based on the prompt word engineering and RAG, the large model will retrieve and analyze to give a standard entity, , .

[0045] (4) The large model respectively calculates the edit distance of each entity in , , to , , to further screen the candidate words , , . Then determine the equivalent entities according to the entity attributes and semantic relations.

[0046] (5) The large model judgment result is handed over to artificial confirmation, and the artificial confirmation result is fed back to the large model, and the wrong equivalent entities are marked.

[0047] The above-described embodiments only express the specific implementation of the present application, and the description is more specific and detailed, but it cannot be understood as a limitation on the protection scope of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the technical concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application.

Claims

1. A method for aligning human-machine collaborative network threat knowledge entities based on a large model, characterized in that, Includes the following steps: Graph embedding representation uses a relational graph attention network to encode the source knowledge graph and the target knowledge graph respectively, generating a structural embedding vector and a named embedding vector for each entity; Candidate entity generation involves calculating the structural similarity matrix between entities based on structural embedding vectors, calculating the named similarity matrix between entities based on named embedding vectors, and combining the two to generate a set of candidate aligned entities. Large-scale model collaborative alignment involves inputting the candidate alignment entity set and its contextual information into a large language model fine-tuned with knowledge of the cyber threat domain, guiding the large language model to perform the following steps: Based on its internal knowledge and external network threat knowledge base, generate or select a standard entity representation; Calculate the similarity between each candidate entity and the standard entity to perform preliminary screening; The selected candidate entities and target entities are subjected to comprehensive semantic and attribute analysis to generate preliminary alignment results. Manual verification and feedback: The preliminary alignment results are manually confirmed, and the verification results are fed back to the large language model to optimize its subsequent inference performance.

2. The method for aligning human-machine collaborative network threat knowledge entities based on a large model according to claim 1, characterized in that, The construction of the network threat knowledge base includes: Vulnerability and defect structured data are stored directly in the database while maintaining their original data structure. Unstructured network threat data is preprocessed into text fragments and then stored in the database as items. Use BERT to convert data in the database into high-dimensional vectors, and then store these high-dimensional vectors in the vector database using the HNSW structure; Select a small subset of data from the network threat database, ensuring that the dataset covers all entity and relation types, and construct a standard sub-graph of network threats in the form of entity A-relation a-entity B triples.

3. The method for aligning human-machine collaborative network threat knowledge entities based on a large model according to claim 1, characterized in that, The manual verification and feedback include: Fine-tuning: Based on Qwen, and using LoRA for pre-training, the model was trained on a manually constructed vulnerability event dataset by combining the SFT method; In the form of multiple-choice questions, the network threat knowledge fusion model is guided to select or generate a standard entity from candidate entities and the network threat knowledge base based on its own knowledge and the network threat knowledge base. Calculate the edit distance between each candidate entity and the standard entity to further filter candidate entities: The contextual description, attribute information, and topological relationship of the target entity and its candidate entities are input into a pre-trained large language model. Based on its inherent knowledge base and contextual understanding capabilities, the large model comprehensively judges the semantic consistency, naming logic, functional roles, and behavioral patterns between the candidate entities and the target entity, and generates alignment results. The alignment results are manually verified, and the correctly aligned samples are used as examples in the prompting project; the feedback data is used to fine-tune the instructions or adapters of the large language model; and the feedback results are stored in the knowledge base to record historical verification results.

4. The method for aligning human-machine collaborative network threat knowledge entities based on a large model according to claim 1, characterized in that, The candidate entity generation includes: After obtaining the entity structure embeddings, cosine similarity is used to evaluate the similarity between entities; the structure embeddings of the source entities are vectors. The structure of the target entity is embedded as a vector. The formula for calculating cosine similarity is as follows: ， After obtaining the structural embedding similarity between all entities and the target entity, the source entity... The structural similarity matrix is ​​formed by combining the cosine similarity scores of the corresponding target entities. ; After obtaining the entity naming embeddings, L2 distance is used to evaluate the similarity between entities. The source entity naming embedding vectors are: Named embedding vector of the target entity , The distance calculation formula is as follows: ， in Using vector dimensions, after obtaining the named embedding similarity between all entities and the target entity, the source entity... The structural similarity matrix is ​​formed by combining the cosine similarity scores of the corresponding target entities. .

5. The method for aligning human-machine collaborative network threat knowledge entities based on a large model according to claim 1, characterized in that, The graph embedding representation specifically includes the following: Obtain the knowledge graph to be aligned and ,in Represents a set of entities. Represents a set of relation types. Represents a set of triples; for each entity Extract its name, aliases, and descriptive text information; Structural embedding learning uses the RGAT model to encode two knowledge graphs separately, and leverages a multi-layer relation-aware attention mechanism to aggregate neighbor information; in each layer, for each entity... It calculates the attention weights between itself and its neighboring entities, and then uses the weighted sum of the embedding vectors of the neighboring entities to update the value. Embedded representation; After several iterations, the final structural embedding vector for each entity is obtained. This vector can reflect the topological location of an entity in the graph and its semantic relationship with surrounding entities; Named embedding generation utilizes the BERT model to encode the acquired entity names, aliases, and descriptive text information. Each text segment is input into a pre-trained model, which outputs a corresponding context-sensitive embedding representation. Pooling operations are then used to integrate the embedding vectors from different segments, forming the named embedding vector for each entity. It is used to preserve the surface form and semantic features of entities.

6. The method for aligning human-machine collaborative network threat knowledge entities based on a large model according to claim 1, characterized in that, The large language model is a domain-adaptive model obtained by using the Qwen model, employing a low-rank adaptive method, and fine-tuning instructions using network threat domain data.

7. A human-machine collaborative network threat knowledge entity alignment system based on a large model, characterized in that, The method for aligning human-machine collaborative network threat knowledge entities based on a large model, as described in any one of claims 1-6, includes: The graph embedding representation module uses a relational graph attention network to encode the source knowledge graph and the target knowledge graph respectively, generating a structural embedding vector and a named embedding vector for each entity; The candidate entity generation module calculates the structural similarity matrix between entities based on structural embedding vectors, calculates the named similarity matrix between entities based on named embedding vectors, and combines the two to generate a set of candidate aligned entities. The large-scale model collaborative alignment module inputs the candidate alignment entity set and its contextual information into the large language model fine-tuned by knowledge of the network threat domain. It retrieves or generates the most likely standard entity representation from the standard entity library and filters high-confidence candidate results by calculating the edit distance between candidate entities and standard entities. The large model integrates entity attributes, semantic relationships and contextual information to generate a preliminary judgment on entity alignment. This result is manually verified to form the final alignment output, and the verification result is fed back to the large model.

8. A human-machine collaborative network threat knowledge entity alignment system based on a large model according to claim 7, characterized in that, The large model collaborative alignment module includes a network threat knowledge base module and a large model processing module; The network threat knowledge base module includes web crawlers, knowledge extraction models, and a network threat sub-grapheper of the network threat knowledge base; it provides training data for large models and data support for the judgment of large models. Large Model Processing Module: In the form of questions, the fine-tuned large model selects or generates standard entities. By calculating the edit distance between each candidate entity and the standard entity, the module analyzes the semantics and attributes of entity relationships to generate entity alignment results. These results are then confirmed by a human and fed back to the large model.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the human-machine collaborative network threat knowledge entity alignment method based on a large model as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the human-machine collaborative network threat knowledge entity alignment method based on a large model as described in any one of claims 1-6.

Images