STRIDE threat category automatic classification system and method in combination with TextCNN text classification model and generative rule

Abstract

The invention discloses an automatic STRIDE threat category classification method in combination with a TextCNN text classification model and a generative rule. According to the method, feature extraction and classification are performed on threat texts by using a TextCNN text classification model, and meanwhile, a classification result is corrected and optimized in combination with a production rule, so that automatic classification of STRIDE threat categories is realized. The method improves the accuracy and efficiency of classification, reduces the cost and risk of manual classification, and is suitable for the rapid and automatic classification and processing of a large amount of threat data in the field of network security.

Description

Technical Field

[0001] This invention relates to an automatic threat category classification method, and more particularly to a STRIDE threat category automatic classification method that combines the TextCNN text classification model and production rules, belonging to the field of threat modeling. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure and do not necessarily constitute prior art.

[0003] Since the birth of computer network technology decades ago, network security issues have always existed. With the widespread use of the network in business, government and personal life, protecting network and data security has become a critical task.

[0004] Complex cyberattack threats plague many well-known enterprises, and efforts are being made to reduce the impact of these threats on network security.

[0005] In response to the growing impact of threat modeling, Microsoft's security team introduced the concept of threat modeling. Threat modeling is a structured approach that identifies and enumerates potential threats to a system, then defines mitigation measures to prevent or reduce those threats. Threat modeling has been proposed as a solution for secure application development and system security assessment, aiming to proactively prevent threat attacks and make it more difficult for attackers to achieve their malicious intent. Currently, an increasing number of security teams are choosing threat modeling to help develop more secure software applications.

[0006] As the importance of threat modeling is increasingly recognized, academia has proposed various threat modeling methods to address different application scenarios. The STRIDE threat modeling method was originally developed by experts at Microsoft to help developers and security professionals better understand threats in computer systems when designing and developing applications. The STRIDE method not only helps developers identify threats early but also allows for the development of mitigation measures through analysis of the security attributes that impact threats. Because of these advantages, the STRIDE method has become the most widely used and mature threat modeling method currently available.

[0007] While the STRIDE method has developed into a mature theoretical framework, limitations remain when building threat modeling tools based on it. STRIDE is a model for identifying threats, recognizing six different threat categories: authentication, authorization, session management, data integrity, data confidentiality, and denial of service. However, manually classifying network traffic is time-consuming and error-prone, thus requiring an automated classification method to improve efficiency and accuracy. Summary of the Invention

[0008] This invention presents a novel method for automating STRIDE threat classification. Given the lack of research on automated classification methods in threat modeling, and the scarcity of STRIDE-annotated data, this invention specifically designs a solution combining TextCNN text classification technology and production rules. Through the implementation of this invention, threat categories (CNNVD Threat Category, CNNVDTC) defined in the National Security Information Database can be automatically converted to and from STRIDE categories, thereby achieving automatic classification of STRIDE threat categories. This method not only improves efficiency but also expands the research boundaries in threat modeling.

[0009] To address the aforementioned technical problems, this invention provides the following technical solution: an automatic threat category classification system based on the TextCNN text classification model and production rules, comprising a data crawling module, a data processing module, a threat classification module, and a production rule matching module;

[0010] The data crawling module is used to crawl threat data with CNNVDTC categories from the China National Vulnerability Database of Information Security (CNNVD) as input;

[0011] The data processing module is used to transform raw data into usable data, improve the quality of the dataset, and avoid the interference of duplicate and noisy data on the quality of the model.

[0012] The threat classification module uses the processed data to fine-tune the parameters and adaptively train the TextCNN pre-trained model so that it meets the specific CNNVDTC threat category classification task. The training data includes a standardized subset of threat data and its corresponding CNNVDTC category label information.

[0013] The production rule matching module is used to analyze the correspondence between CNNVDTC and STRIDE categories and, by applying production rules, successfully achieve automated conversion from CNNVDTC category to STRIDE category.

[0014] Furthermore, the threat data crawling module includes a targeted data download unit, a data parsing unit, and a data standardization unit;

[0015] The targeted data download unit is used to crawl the required threat data file in Extensible Markup Language (XML) format by means of the input data URL;

[0016] The data parsing unit is used to parse the downloaded XML file and convert the acquired threat data into a dictionary format corresponding to the tags, based on different tags.

[0017] The data standardization unit is used to filter the threat content required by the method, extract the content corresponding to the required tags according to the needs, and combine them into a standardized format.

[0018] Furthermore, the data processing module includes a data item merging unit, a threat description content removal unit for useless information, and a data undersampling processing unit;

[0019] The data item merging unit is used to remove unwanted hardware threat portions and merge smaller threat category portions with other threat categories that have inclusion relationships, thereby improving the quality of the dataset;

[0020] The threat description content is used to remove useless information units to remove the "affected entity" part of the content that is not applicable to subsequent research work in this paper and may become a distraction.

[0021] The data undersampling processing unit is used to undersample the classes with a large number of samples in the training set, that is, to discard some samples to alleviate the class imbalance problem.

[0022] Furthermore, the threat classification module includes an input unit, a data preprocessing unit, a feature extraction unit, and a classification unit;

[0023] The input unit is used to reuse the input module to generate input data for the TextCNN threat classification model;

[0024] The data preprocessing unit performs word segmentation and stop word removal preprocessing on the processed vulnerability data, and then extracts the feature vector of each word in the vulnerability description text through a word vector processing algorithm, which is used as the input layer of the TextCNN model.

[0025] The feature extraction module is used to input the fixed-dimensional word vectors obtained from the input layer into the feature extraction module, and after passing through the convolutional layer, they are sent to the activation layer, pooling layer and fully connected layer.

[0026] The classification unit is used to obtain the CNNVDTC threat category corresponding to the input threat text by using a threat classification model based on TextCNN;

[0027] Furthermore, the generative rule matching module includes a correspondence construction unit and a category conversion unit;

[0028] The correspondence construction unit is used to construct a correspondence table between the STRIDE category and the CNNVDTC category based on their relationship.

[0029] The category conversion unit is used for automatic conversion from CNNVDTC category to STRIDE category, and constructs the corresponding production rule machine through the correspondence table.

[0030] An automatic threat category classification method based on the STRIDE framework, combining the TextCNN text classification model and production rules, is described below:

[0031] S1: Obtain standardized threat data based on the selected threat data platform;

[0032] S2: After preprocessing the acquired threat data, use it as the training set to train the TextCNN model to obtain a model that can automatically classify CNNVDTC threat categories;

[0033] S3: The obtained CNNVDTC categories are automatically converted into the corresponding STRIDE categories according to the production rule machine.

[0034] Step S1 specifically involves:

[0035] S101: Automatically crawl the corresponding XML file based on the input threat data platform URL;

[0036] S102: Use regular expressions to build a specific XML parser to obtain the required threat content;

[0037] Step S2 specifically involves:

[0038] S201: Process the threat data information obtained this time to obtain its corresponding category and content information;

[0039] S202: Input the acquired threat content into the CNNVDTC threat category prediction classifier to obtain the prediction results for all categories in this threat data.

[0040] In step S201, the threat data needs to undergo data processing to improve the quality of the dataset, wherein the data processing steps are as follows:

[0041] S2011: Remove threat data from the hardware section and merge threat data based on category inclusion relationships;

[0042] S2012: Remove useless information such as product information from the threat description section;

[0043] S2013: Undersample the classes with a large number of samples in the training set, i.e. discard some samples to alleviate the class imbalance problem.

[0044] In step S202, the threat category classifier is trained using the TextCNN model, and the training steps are as follows:

[0045] S2021: Threat content obtained from the TextCNN threat classification model;

[0046] S2022: Process threat data information and obtain its corresponding formatted threat content;

[0047] S2023: Encode labels based on the threat's CNNVDTC category results and use them as the result labels for the training data;

[0048] S2024: The initial training corpus required to form the TextCNN model from the raw data encoded in the threat classification model and its corresponding result label information;

[0049] S2025: The initial prediction is randomly split for training and testing of the TextCNN threat classification model;

[0050] S2026: Input the training set into the TextCNN model for parameter fine-tuning and train the TextCNN threat classification model;

[0051] S2027: Validate the effectiveness of the TextCNN threat classification model using test set data.

[0052] In step S2027, the performance of the TextCNN threat classification model is measured using the following four formulas:

[0053]

[0054] Accuracy represents the proportion of all correctly predicted values ​​out of the total test sample size; TP represents the number of values ​​that are both positive and predicted; FP represents the number of values ​​that are negative but predicted; FN represents the number of values ​​that are negative but predicted; TN represents the number of values ​​that are both negative and predicted.

[0055]

[0056] Precision represents the proportion of samples that are correctly predicted among all samples with positive prediction results; TP represents the number of samples with both actual and predicted positive values; FP represents the number of samples with actual and predicted negative values. It refers to the prediction results and means the probability that all samples predicted as positive are actually classified as positive. In other words, how confident is the model in making a correct prediction when the prediction is positive?

[0057]

[0058] Recall refers to the proportion of samples that are actually positive and are correctly predicted; TP represents the number of samples that are both actually positive and predicted to be positive; FN represents the number of samples that are actually negative but are predicted to be positive. It is relative to the original sample and means the probability that a sample that is actually positive will be predicted as a positive example. In other words, how confident is the model in predicting all positive samples correctly?

[0059]

[0060] In large-scale datasets, precision and recall are often conflicting metrics. Generally, increasing precision often leads to a decrease in recall, and vice versa. In some scenarios, it's necessary to consider both precision and recall. The most common method is the F1-score, a weighted harmonic average of precision and recall. F1 combines accuracy and recall to comprehensively reflect the overall performance of the threat category classifier.

[0061] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0062] 1. The advantage of this invention over the prior art lies in its ability to overcome the limitations of existing research. Through an automated conversion mechanism, it indirectly achieves automatic classification of STRIDE threat categories, which not only improves efficiency but also provides a practical solution to the challenge of lacking labeled data.

[0063] 2. By innovatively combining the TextCNN model and a generative rule system, this invention designs a complete process from data crawling to classification. First, using a customized data crawling module, the system can efficiently acquire threat data from a specified platform. The data processing module then cleans and standardizes this data, ensuring high-quality input for model training. Subsequently, the threat classification module applies this data to fine-tune the TextCNN model and achieve adaptive training to accurately classify the CNNVDTC threat category. Furthermore, the generative rule matching module analyzes the relationship between CNNVDTC and STRIDE categories and establishes a rule-based transformation mechanism, thereby achieving automated mapping between the two threat categories. Attached Figure Description

[0064] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0065] Figure 1This is a schematic diagram of a threat data format according to an embodiment of the present invention;

[0066] Figure 2 This is a pseudocode diagram of a specific XML parser based on regular expressions according to the present invention;

[0067] Figure 3 This is a structural diagram of a TextCNN model according to the present invention;

[0068] Figure 4 This is an overall framework diagram of the STRIDE threat category automatic classification method that combines the TextCNN text classification model and production rules according to the present invention;

[0069] Figure 5 This is a flowchart of a TextCNN threat classification process according to the present invention;

[0070] Figure 6 This is an intentional representation of the correspondence between CNNVD vulnerability categories and STRIDE categories according to the present invention;

[0071] Figure 7 This is a schematic diagram of the pseudocode representation of a CNNVDTC category and STRIDE category production rule machine according to the present invention. Detailed Implementation

[0072] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0073] Example 1: Please refer to Figure 1-7 The present invention provides the following technical solution: an automatic threat category classification system of STRIDE that combines the TextCNN text classification model and production rules, the system including a data crawling module, a data processing module, a threat classification module and a production rule matching module;

[0074] The data crawling module is used to crawl threat data with CNNVDTC categories from the CNNVD platform as input;

[0075] The data processing module is used to transform raw data into usable data, improve the quality of the dataset, and avoid the interference of duplicate and noisy data on the quality of the model.

[0076] The threat classification module uses the processed data to fine-tune the parameters and adaptively train the TextCNN pre-trained model so that it meets the specific CNNVDTC threat category classification task. The training data includes a standardized subset of threat data and its corresponding CNNVDTC category label information.

[0077] The production rule matching module is used to analyze the correspondence between CNNVDTC and STRIDE categories and, by applying production rules, successfully achieve automated conversion from CNNVDTC category to STRIDE category.

[0078] Furthermore, the threat data crawling module includes a targeted data download unit, a data parsing unit, and a data standardization unit;

[0079] The targeted data download unit is used to crawl the required XML-formatted threat data file by means of the input data URL;

[0080] The data parsing unit is used to parse the downloaded XML file and convert the acquired threat data into a dictionary format corresponding to the tags, based on different tags.

[0081] The data standardization unit is used to filter the threat content required by the method, extract the content corresponding to the required tags according to the needs, and combine them into a standardized format.

[0082] Furthermore, the data processing module includes a data item merging unit, a threat description content removal unit for useless information, and a data undersampling processing unit;

[0083] The data item merging unit is used to remove unwanted hardware threat portions and merge smaller threat category portions with other threat categories that have inclusion relationships, thereby improving the quality of the dataset;

[0084] The threat description content is used to remove useless information units to remove the "affected entity" part of the content that is not applicable to subsequent research work in this paper and may become a distraction.

[0085] The data undersampling processing unit is used to undersample the classes with a large number of samples in the training set, that is, to discard some samples to alleviate the class imbalance problem.

[0086] Furthermore, the threat classification module includes an input unit, a data preprocessing unit, a feature extraction unit, and a classification unit;

[0087] The input unit is used to reuse the input module to generate input data for the CNNVDTC threat category prediction classifier.

[0088] The data preprocessing unit performs word segmentation and stop word removal preprocessing on the processed vulnerability data, and then extracts the feature vector of each word in the vulnerability description text through the Word2vec algorithm, which is used as the input layer of the TextCNN model.

[0089] The feature extraction module is used to input the fixed-dimensional word vectors obtained from the input layer into the feature extraction module, and after passing through the convolutional layer, they are sent to the activation layer, pooling layer and fully connected layer.

[0090] The classification unit is used to obtain the CNNVDTC threat category corresponding to the input threat text by using a threat classification model based on TextCNN;

[0091] Furthermore, the generative rule matching module includes a correspondence construction unit and a category conversion unit;

[0092] The correspondence construction unit is used to construct a correspondence table between the STRIDE category and the CNNVDTC category based on their relationship.

[0093] The category conversion unit is used for automatic conversion from CNNVDTC category to STRIDE category, and constructs the corresponding production rule machine through the correspondence table.

[0094] An automatic threat category classification method based on the STRIDE framework, combining the TextCNN text classification model and production rules, is described below:

[0095] S1: Obtain standardized threat data based on the selected threat data platform;

[0096] During the data crawling phase, the targeted data download unit is used to crawl the required XML-formatted threat data files based on the input data URL. The data parsing unit parses the downloaded XML files, converting the acquired threat data into a dictionary format of tag-corresponding content based on different tags. The data standardization unit filters the threat content required by the method, extracts the content corresponding to the required tags according to the needs, and combines them into a standardized format. Through the configuration of the data crawling algorithm, data can be acquired from open-source threat data platforms such as CNNVD, CWE, and CVE, and the acquired data format is as follows: Figure 1 As shown, each <entry>A tag represents a threat and is categorized by threat type, content, level, etc., based on different tags.

[0097] S2: After preprocessing the acquired threat data, use it as the training set to train the TextCNN model to obtain a model that can automatically classify CNNVDTC threat categories;

[0098] In this step, because the threat data obtained from the CNNVD platform contains irrelevant information such as software names and versions, data cleaning is first required to remove duplicates and null values. Next, the data is integrated and filtered based on the correlation and inclusion relationships of the basic categories to further remove redundant information in the threat descriptions. To address the imbalance in the data, an undersampling strategy is used to reduce the unevenness of the data distribution. It is worth noting that the STRIDE method differs from the semantic context of the threat text when analyzing the scope of threat impact, while CNNVDTC's threat classification is more consistent with the semantic context of the threat text. Therefore, a threat classification model based on TextCNN is used to accurately determine the corresponding CNNVDTC threat category based on the input threat text. For example, assuming that the latest batch of threat data has been crawled and parsed, the specific data format is as follows... Figure 1 As shown, using Figure 2 The XML parser built as shown is based on regular expressions and follows... <name> 、 <vuln-type> 、 <vuln-descript>The tags are used to extract corresponding data content, which is then compiled into a dictionary and saved. Finally, all the data, after the above preprocessing, is used as follows: Figure 4 The input layer in the TextCNN classification process is shown.

[0099] S3: The obtained CNNVDTC categories are automatically converted into the corresponding STRIDE categories according to the production rule machine.

[0100] The STRIDE method is more directly related to the scope of the threat's impact, while the vulnerability classification guidelines published by CNNVD include descriptions of common consequences and scope of impact for each vulnerability category. Therefore, based on the CNNVD vulnerability classification guidelines and the scope of impact attribute of STRIDE, the following conclusions can be drawn: Figure 5 The correspondence is shown. Finally, a production rule matching method for converting CNNVDTC categories to STRIDE categories is implemented. The algorithm's inputs are the six categories of the STIRDE method, the CNNVDTC categories generated in the threat classification step, and the list of correspondences between CNNVDTC and STRIDE categories generated from the table. The output is the STRIDE category corresponding to the input threat. Specifically, the input CNNVDTC threat category is used to query the corresponding STRIDE category through a production rule machine in the form of "if...then...".

[0101] Step S1 specifically involves:

[0102] S101: Automatically crawl the corresponding XML file based on the input threat data platform URL;

[0103] Figure 1 This shows a snippet of threat data crawled from the CNNVD platform, which presents the structure and content of the threat in XML format. <name>Partially indicating the name of the threat, <vuln-id>Partially representing the unique identifier of this threat, <vuln-type>The CNNVDTC category partially represents this threat. <vuln-descript>This section describes the specific details of the threat. This section displays information about the affected entities and the threat, which is the content that needs to be further analyzed in this embodiment.

[0104] S102: Use regular expressions to build a specific XML parser to obtain the required threat content;

[0105] The part of this embodiment that requires data acquisition and parsing is... Figure 1 Shown in <vuln-descript>Partial information content; Because currently available XML parsing tools analyze data according to internationally accepted XML standard formats, while CNNVD lacks strict management of XML file formats, most XML files provided by CNNVD are not written according to internationally accepted XML standard formats, making it impossible to use existing XML parsing tools to parse the threat data of the CNNVD platform. Therefore, this invention constructs a specific CNNVD XML parser by utilizing the query characteristics of regular expressions for specific content. The algorithm is as follows... Figure 2 As shown, the XML file is first read line by line, and then based on " <entry>The tag separates each vulnerability information, and finally retrieves the corresponding content based on the XML tags corresponding to the vulnerability name, vulnerability number, vulnerability category, and vulnerability description required in this article.

[0106] Step S2 specifically includes:

[0107] S201: Process the threat data information obtained this time to obtain its corresponding category and content information;

[0108] A single data crawl can yield multiple threats after parsing, collectively forming a subset of threat data. To transform the raw data into usable data, improve dataset quality, and avoid interference from duplicate and noisy data on model quality, the threat data obtained from the CNNVD platform contains irrelevant information such as software names and versions. Therefore, data cleaning is first required to remove duplicates and null values. Then, data items are merged and deleted based on the availability and inclusion relationships of basic categories, followed by the removal of irrelevant information from threat descriptions. Finally, undersampling is employed to mitigate the impact of uneven data distribution, given the class imbalance in the retained data.

[0109] S202: Input the acquired threat content into the TextCNN threat classification model to obtain the prediction results of all categories in this threat data.

[0110] By training the dataset using the TextCNN model, a TextCNN threat classification model is obtained that can automatically classify threats into CNNVDTC threat categories;

[0111] In step S201, the threat data needs to undergo data processing to improve the quality of the dataset, wherein the data processing steps are as follows:

[0112] S2011: Remove threat data from the hardware section and merge threat data based on category inclusion relationships;

[0113] Because CNNVD extensively collects vulnerabilities from software and hardware products and external environmental behaviors worldwide, the data types exhibit diversity and imbalance in quantity. To improve the quality of the dataset, this invention performs merging and removal operations on this portion of the data. Given that the application background of this invention focuses on software security and network security, we removed vulnerability categories caused by hardware problems or environment configuration issues. The goal of this invention's automatic vulnerability classification is to achieve automatic classification of STRIDE threat categories. Therefore, based on the hierarchical relationship of types in the CNNVD vulnerability classification standard, we merged vulnerability types with obvious inclusion relationships and consistent threat impact scope.

[0114] S2012: Remove useless information such as product information from the threat description section;

[0115] The threat description in this embodiment consists of two parts: the affected entity and the vulnerability content. The affected entity part describes the basic information of the software or product involved in the vulnerability. However, this part of the description is not applicable to the subsequent research work of this invention and may become a distraction. The format rule for the affected entity part is product name and product description, and then the vulnerability content part includes vulnerability type, cause, exploitation method, and affected version. Through observation of a large number of examples, it was found that the vulnerability type content appears in a uniform format of "[Company] has [Vulnerability Category]". Therefore, it can be combined with, for example... Figure 2 The filter shown uses regular expressions to identify the content of the vulnerability type section and then removes the affected entity parts before this section.

[0116] S2013: Undersample the classes with a large number of samples in the training set, i.e. discard some samples to alleviate the class imbalance problem.

[0117] Since the crawled threat data has a class imbalance ratio greater than 10:1, it is necessary to adopt corresponding sample optimization methods. Moreover, since there are many types of threats and most samples only have two classes, this paper chooses the EasyEnsemble method in undersampling to optimize the sample data.

[0118] In step S2013, the data undersampling process is as follows:

[0119] S201301: Divide the data into two parts: the majority class sample max and the minority class sample min.

[0120] S201302: Randomly sample n times with replacement from the majority class max, and each time select a number of samples that is close to the number of samples in the minority class, i.e., imax = min, to obtain a set of n samples, denoted as {1max, 2max, ...}.

[0121] S201303: The AdaBoost classifier is trained by merging the subset `imax` of each majority class sample with the `min` of the minority class samples. With the threshold set to H, n models can be obtained, i.e.:

[0122]

[0123] S201304: These models are combined to form an ensemble learning system. The final model result is the voting value of these $n$ models. A weighted majority voting method is used here, increasing the weight of weak classifiers with low classification error rates to give them a larger role in the voting, and decreasing the weight of weak classifiers with low classification error rates to give them a smaller role in the voting. Therefore, the final classifier is:

[0124]

[0125] In step S202, the CNNVDTC threat category prediction classifier is trained using the TextCNN model, and the training steps are as follows:

[0126] S2021: Obtain the training threat content for the TextCNN threat classification model;

[0127] That is, the threat content and its corresponding threat category information obtained through open-source threat data platforms;

[0128] This embodiment selects security vulnerabilities from the CNNVD standard dataset as training threats, extracting some threats and their category labels from 2000 to March 2023. The publicly available internet vulnerability information released by CNNVD is a vulnerability information resource database established by the National Security Center, and is the most comprehensive and authoritative source of threat data in the Chinese threat information field. As a national-level information security vulnerability data management platform, CNNVD has cooperated with many well-known domestic enterprises and has publicly released standards and specifications such as the "CNNVD Vulnerability Compatibility Description Specification." For example, CNNVD's label information is provided in the form of an attached XML file. CNNVD's threat data will mark vulnerabilities according to their categories as 26 categories: configuration errors, code problems, resource management errors, numerical errors, information leakage, race conditions, input validation, buffer errors, format strings, cross-site scripting, path traversal, backlinks, SQL injection, injection, code injection, command injection, operating system command injection, security feature issues, authorization issues, trust management, encryption issues, insufficiently verified data reliability, cross-site request forgery, permission and access control, access control errors, and insufficient documentation.

[0129] Figure 1 This shows a fragment of the CNNVD threat dataset and its category label information. The label vuln-type reflects the CNNVDTC category result of the threat, and its value is resource management error.

[0130] S2022: Process threat data information and obtain its corresponding formatted threat content;

[0131] The part of this embodiment that requires data acquisition and parsing is... Figure 1 Shown in <vuln-descript>The information content within the tag. The format specified in the *CNNVD Vulnerability Content Description Specification* includes two parts: the affected entity and the vulnerability content. The affected entity section describes the basic information of the software or product involved in the vulnerability. However, this description can be distracting. The format rules for the affected entity section are product name and product introduction, followed by the vulnerability content section, which includes the vulnerability type, cause, exploitation method, and affected versions. Combined with... Figure 2 The pseudocode shows a filter machine made of regular expressions to filter out the content of the vulnerability type stage, and then remove the affected entity part before this stage;

[0132] S2023: Encode labels based on the threat's CNNVDTC category results and use them as the result labels for the training data;

[0133] This embodiment obtains the CNNVDTC category from the 26 result labels in CNNVD. Therefore, this embodiment encodes the result labels of these 26 categories to unify the result labels of the training data of the TextCNN threat classification model.

[0134] S2024: The initial training corpus required to form the TextCNN model from the raw data of the CNNVDTC threat category classifier and its corresponding result label information;

[0135] The initial training corpus is encoded into a uniform format [id, encoded result label, standardized threat content]. Here, id is the initial training corpus number, the encoded result label is the label processed in step S2023, and the standardized threat content is the threat content obtained after processing in step S2022, from which useless information has been removed.

[0136] S2025: The initial prediction is randomly split for training and testing of the CNNVDTC threat category classifier;

[0137] In this embodiment, the initial training corpus processed in step S2024 is allocated into a training set, a validation set, and a test set in a ratio of 5:1:1. The training set is used to train the threat classifier. The general TextCNN model is trained using the initial training corpus data with result labels to be suitable for specific threat category prediction scenarios. The test set is used to verify the performance of the trained TextCNN threat classification model.

[0138] S2026: Input the training set into the TextCNN model for parameter fine-tuning to train a CNNVDTC threat category classifier;

[0139] This embodiment expands the original vocabulary of the BERT pre-trained model during parameter fine-tuning, making the fine-tuned security vulnerability prediction classifier more applicable to security vulnerability prediction tasks of code snippets at the specific function method granularity. Specifically, for the Java language, this embodiment extracts reserved words and placeholders of the programming language. Additionally, it extracts specific structural hint words from the obtained standardized abstract syntax tree and adds them to the original vocabulary of the BERT pre-trained model. Using the supplemented vocabulary, the training data processed in step S1035 is input into the BERT pre-trained model for adaptive training.

[0140] S2027: Validate the effectiveness of the CNNVDTC threat category classifier using test set data.

[0141] In step S2027, the performance of the CNNVDTC threat category classifier is measured using the following four formulas:

[0142]

[0143] Accuracy represents the proportion of all correctly predicted values ​​out of the total test sample size; TP represents the number of values ​​that are both positive and predicted; FP represents the number of values ​​that are negative but predicted; FN represents the number of values ​​that are negative but predicted; TN represents the number of values ​​that are both negative and predicted.

[0144]

[0145] Precision represents the proportion of samples that are correctly predicted among all samples with positive prediction results; TP represents the number of samples with both actual and predicted positive values; FP represents the number of samples with actual and predicted negative values. It refers to the prediction results and means the probability that all samples predicted as positive are actually classified as positive. In other words, how confident is the model in making a correct prediction when the prediction is positive?

[0146]

[0147] Recall refers to the proportion of samples that are actually positive and are correctly predicted; TP represents the number of samples that are both actually positive and predicted to be positive; FN represents the number of samples that are actually negative but are predicted to be positive. It is relative to the original sample and means the probability that a sample that is actually positive will be predicted as a positive example. In other words, how confident is the model in predicting all positive samples correctly?

[0148]

[0149] In large-scale datasets, precision and recall are often conflicting metrics. Generally, increasing precision often leads to a decrease in recall, and vice versa. In some scenarios, it's necessary to consider both precision and recall. The most common method is the F1-score, a weighted harmonic average of precision and recall. F1 combines accuracy and recall to comprehensively reflect the overall performance of the threat category classifier.

[0150] Example 2: This example illustrates a specific application case where the TextCNN text classification model and production rules are applied to a network security management system to achieve automatic classification of STRIDE threat categories. The detailed steps are as follows:

[0151] (1) Data preprocessing: Data is collected from the security event log repository and the text is cleaned, including removing noise such as irrelevant punctuation marks and special characters, and then word segmentation is performed.

[0152] (2) Model Training: The TextCNN text classification model is trained using the preprocessed text data. Multiple convolutional layers are configured to extract text features, and convolutional kernels of different sizes are used to capture contextual information of different ranges.

[0153] (3) Production rule definition: Based on the STRIDE classification principle and the experience of cybersecurity experts, a series of production rules are defined to help identify misclassified cases and make corrections.

[0154] (4) Classification and Optimization: The trained TextCNN model is used to perform automatic classification of new threat texts. Then, the classification results are checked to see if they conform to the production rules; classification results that do not conform will be adjusted appropriately according to the rules.

[0155] (5) Deployment and Monitoring: Deploy the integrated classification system into the network security operating environment to monitor threat data flow in real time. The system automatically classifies STRIDE threats and provides reports for security analysts to review.

[0156] This embodiment can effectively improve the automation level of network security monitoring systems, reduce reliance on security analysts, and ensure minimized threat response time and high classification accuracy. This embodiment is suitable for enterprises and institutions that need to process large amounts of security data, such as financial service providers, government agencies, or large cloud service operators.

[0157] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention. < / entry> < / name> < / vuln-type> < / name> < / entry>

Claims

1. A STRIDE threat category automatic classification system that combines the TextCNN text classification model and production rules, the system comprising a data crawling module, a data processing module, a threat classification module, and a production rule matching module; The data crawling module is used to crawl threat data with CNNVDTC categories from the China National Vulnerability Database of Information Security (CNNVD) as input; The data processing module is used to transform raw data into usable data, improve the quality of the dataset, and avoid the interference of duplicate and noisy data on the quality of the model. The threat classification module uses the processed data to fine-tune the parameters and adaptively train the TextCNN pre-trained model so that it meets the specific CNNVDTC threat category classification task. The training data includes a standardized subset of threat data and its corresponding CNNVDTC category label information. The production rule matching module is used to analyze the correspondence between CNNVDTC and STRIDE categories and, by applying production rules, successfully achieve automated conversion from CNNVDTC category to STRIDE category.

2. The STRIDE threat category automatic classification system combining the TextCNN text classification model and production rules as described in claim 1, characterized in that: The threat data crawling module includes a targeted data download unit, a data parsing unit, and a data standardization unit; The targeted data download unit is used to crawl the required threat data file in Extensible Markup Language (XML) format by means of the input data URL; The data parsing unit is used to parse the downloaded XML file and convert the acquired threat data into a dictionary format corresponding to the tags, based on different tags. The data standardization unit is used to filter the threat content required by the method, extract the content corresponding to the required tags according to the needs, and combine them into a standardized format.

3. The STRIDE threat category automatic classification system combining the TextCNN text classification model and production rules as described in claim 2, characterized in that: The data processing module includes a data item merging unit, a threat description content removal unit for useless information, and a data undersampling processing unit. The data item merging unit is used to remove unwanted hardware threat portions and merge smaller threat category portions with other threat categories that have inclusion relationships, thereby improving the quality of the dataset; The threat description content is used to remove useless information units to remove the "affected entity" part of the content that is not applicable to subsequent research work in this paper and may become a distraction. The data undersampling processing unit is used to undersample the classes with a large number of samples in the training set, that is, to discard some samples to alleviate the problem of class imbalance.

4. The STRIDE threat category automatic classification system combining the TextCNN text classification model and production rules as described in claim 3, characterized in that: The threat classification module includes an input unit, a data preprocessing unit, a feature extraction unit, and a classification unit; The input unit is used to reuse the input module to generate input data for the TextCNN threat classification model; The data preprocessing unit performs word segmentation and stop word removal preprocessing on the processed vulnerability data, and then extracts the feature vector of each word in the vulnerability description text through a word vector processing algorithm, which is used as the input layer of the TextCNN model. The feature extraction module is used to input the fixed-dimensional word vectors obtained from the input layer into the feature extraction module, and after passing through the convolutional layer, they are sent to the activation layer, pooling layer and fully connected layer. The classification unit is used to obtain the CNNVDTC threat category corresponding to the input threat text by using a threat classification model based on TextCNN.

5. The STRIDE threat category automatic classification system combining the TextCNN text classification model and production rules as described in claim 1, characterized in that: The production rule matching module includes a correspondence construction unit and a category conversion unit; The correspondence construction unit is used to construct a correspondence table between the STRIDE category and the CNNVDTC category based on their relationship. The category conversion unit is used for automatic conversion from CNNVDTC category to STRIDE category, and constructs the corresponding production rule machine through the correspondence table.

6. An automatic threat category classification method combining the TextCNN text classification model and production rules, characterized in that: The method, implemented using the system according to any one of claims 1-5, comprises the following steps: S1: Obtain standardized threat data based on the selected threat data platform; S2: After preprocessing the acquired threat data, use it as the training set to train the TextCNN model to obtain a model that can automatically classify CNNVDTC threat categories; S3: The obtained CNNVDTC categories are automatically converted into the corresponding STRIDE categories according to the production rule machine.

7. The STRIDE threat category automatic classification method combining the TextCNN text classification model and production rules as described in claim 6, characterized in that: Step S1 specifically involves: S101: Automatically crawl the corresponding XML file based on the input threat data platform URL; S102: Use regular expressions to build a specific XML parser to obtain the required threat content; Step S2 specifically involves: S201: Process the threat data information obtained this time to obtain its corresponding category and content information; S202: Input the acquired threat content into the CNNVDTC threat category prediction classifier to obtain the prediction results for all categories in this threat data.

8. The STRIDE threat category automatic classification method combining the TextCNN text classification model and production rules as described in claim 7, characterized in that: In step S201, the threat data needs to undergo data processing to improve the quality of the dataset, wherein the data processing steps are as follows: S2011: Remove threat data from the hardware section and merge threat data based on category inclusion relationships; S2012: Remove useless information such as product information from the threat description section; S2013: Undersample the classes with a large number of samples in the training set, i.e. discard some samples to alleviate the class imbalance problem.

9. The STRIDE threat category automatic classification method combining the TextCNN text classification model and production rules as described in claim 7, characterized in that: In step S202, the threat category classifier is trained using the TextCNN model, and the training steps are as follows: S2021: Threat content obtained from the TextCNN threat classification model; S2022: Process threat data information and obtain its corresponding formatted threat content; S2023: Encode labels based on the threat's CNNVDTC category results and use them as the result labels for the training data; S2024: The initial training corpus required to form the TextCNN model from the raw data encoded in the threat classification model and its corresponding result label information; S2025: The initial prediction is randomly split for training and testing of the TextCNN threat classification model; S2026: Input the training set into the TextCNN model for parameter fine-tuning and train the TextCNN threat classification model; S2027: Validate the effectiveness of the TextCNN threat classification model using test set data. In step S2027, the performance of the TextCNN threat classification model is measured using the following four formulas: Accuracy represents the proportion of all correctly predicted values ​​out of the total number of test samples; TP represents the number of values ​​that are both positive and predicted. FP represents the number of times the actual value is negative but the predicted value is positive; FN represents the number of values ​​that are actually negative but predicted to be positive; TN represents the number of values ​​that are both actually negative and predicted to be negative. Precision represents the proportion of correctly predicted samples out of all samples predicted to be positive; TP represents the number of samples whose actual value is positive and whose predicted value is also positive; FP represents the number of samples whose actual value is negative but whose predicted value is positive. It refers to the prediction result, meaning the probability that all samples predicted as positive are actually classified as positive. Recall refers to the proportion of samples whose actual value is positive that are correctly predicted; TP represents the number of samples whose actual value is positive and whose predicted value is also positive; FN represents the number of samples whose actual value is negative but whose predicted value is positive. It refers to the original sample, and its meaning is the probability that a sample whose actual value is positive will be predicted as positive. In the case of large-scale datasets, precision and recall are often a pair of conflicting metrics.

Images