Network threat intelligence automatic extraction method based on multi-source fusion

Abstract

The invention provides an efficient and accurate network threat intelligence automatic extraction method, and aims to solve the problems of incomplete entity recognition, inaccurate relation reasoning, easy model illusion and the like when an existing intelligence extraction technology faces CTI texts with multi-source isomerism, complex safety terms and implicit relation expression. According to the method, the advantages of a deep learning model and a large language model are fused, and the structured understanding ability of complex threat intelligence is comprehensively improved. According to the specific technical scheme, firstly, multi-source data from security reports, technical blogs and the like are processed in a unified mode through a text standardization and entity preliminary screening module, and the basic quality of information extraction is improved; secondly, an entity-driven attention model is introduced, threat entity semantics are recovered through external knowledge enhancement and an entity-to-attention mechanism, a preliminary relation is recognized, and the extraction accuracy is improved; thirdly, capturing potential attack chain logic and implicit association by adopting an example retrieval mechanism based on relational logic driving and combining the analogy reasoning capability of a large language model; and finally, through a decision fusion and arbitration mechanism, consistency comparison, conflict verification and deletion completion are carried out on results of the deep model and the large model, so that the accuracy, integrity and robustness of network threat intelligence extraction are remarkably improved.

Description

Technical Field

[0001] This invention relates to the fields of cybersecurity and artificial intelligence, specifically to a method for automatically extracting network threat intelligence based on multi-source fusion. Background Technology

[0002] Cyber ​​threat intelligence (CTI) is highly complex and heterogeneous, widely found in security vendor reports, technical bulletins, blog posts, and open-source communities. It carries critical information such as attacker identity, malware families, exploit methods, and target industries. Due to its loose structure, flexible expression, and numerous implicit semantic relationships, traditional threat perception and attack detection mechanisms struggle to directly utilize this intelligence, thus hindering timely threat identification and defense. Furthermore, CTI often contains attack chain reasoning information spanning sentences, paragraphs, and even documents, further increasing the difficulty of automatic extraction and parsing.

[0003] Traditional methods for extracting cyber threat intelligence typically rely on manual rules and feature matching, using predefined keywords, regular expressions, or templates to identify entities such as attackers, tools, and industries, as well as their relationships. However, these methods face multiple challenges. Firstly, CTI text formats are extremely diverse, containing numerous ambiguous expressions, metaphorical descriptions, and stylistic differences between vendors, making rule-based detection methods ineffective in covering complex scenarios. Secondly, attackers frequently change their narrative style and adjust terminology, causing traditional feature- or rule-based extraction methods to exhibit lower accuracy and adaptability when facing new attack techniques or unknown text patterns. Furthermore, maintaining and updating the rule base requires the involvement of numerous security experts, consuming significant human resources and struggling to cope with the rapidly evolving threat environment.

[0004] To address these issues, researchers have proposed a series of deep learning-based threat intelligence extraction methods in recent years. These methods can automatically learn the semantic features of entities and relationships, exhibiting stronger robustness in handling complex sentence structures, long-distance dependencies, and multi-entity interactions. However, deep learning models still have limitations, such as insufficient reliance on external knowledge, difficulty in identifying implicit relational logic, and limited generalization ability, often leading to entity omissions, misjudgments of relationships, and inadequate understanding of complex attack chains. Furthermore, deep models are heavily reliant on domain semantics, making them prone to false positives and false negatives when faced with unseen threat terms or novel attack descriptions.

[0005] With the development of Large Language Models (LLMs), threat intelligence extraction methods based on cue engineering and analogical reasoning have gradually emerged. LLMs have significant advantages in language understanding and reasoning, and can infer potential attack logic from complex text. However, LLMs also suffer from problems such as factual illusion, unstable inference results, and strong dependence on cues, and lack the ability to complement the structured features of deep models.

[0006] In summary, while existing methods for extracting cyber threat intelligence have improved automation and analysis efficiency to some extent, they still have many shortcomings, including the inability to fully handle cross-sentence semantic relationships, a lack of effective utilization of external threat knowledge, difficulty in achieving stable inference, and a high false positive / false negative rate. Therefore, there is an urgent need for a more efficient, accurate threat intelligence extraction method with expert reasoning capabilities, combining deep learning, knowledge augmentation, and large language model inference techniques to comprehensively improve the quality and practical value of extracted cyber threat intelligence. Summary of the Invention

[0007] The purpose of this invention is to propose an efficient and accurate automatic method for extracting network threat intelligence. This invention aims to address the problems of low accuracy and high false positive / false negative rates in existing threat intelligence extraction methods when faced with multi-source, heterogeneous, semantically complex, and implicitly relational CTI text. By combining deep learning, external knowledge enhancement, and large language model inference techniques, it is possible to deeply mine key entities and potential relationships in threat intelligence, improve the ability to identify complex attack scenarios, and achieve accurate extraction of network threat intelligence. To achieve the above objectives, this invention adopts the following technical solution:

[0008] Step 1: Standardize text format, unify terminology, and filter irrelevant sentences through the text preprocessing module to provide standardized input for subsequent recognition and reasoning.

[0009] Step 2: To address the implicit semantics and complex dependencies in CTI texts, an entity-driven attention model is introduced. Through contextual encoding, external knowledge enhancement, and entity pair attention, entity semantic recovery and preliminary relationship identification are achieved, thereby improving the accuracy and interpretability of relationship extraction.

[0010] Step 3: To address the potential logical relationships that are difficult for deep models to identify, a relation-driven example retrieval mechanism based on a large language model is introduced. Through example construction and analogical reasoning, the logic of complex attack chains is recovered, implicit relationships are completed, and the model's reasoning ability in complex CTI scenarios is enhanced.

[0011] Step 4: First, compare the consistency of the entity and relation results output by the two types of models; then, use the large language model arbitration mechanism to verify and complete conflicting or missing triples, and finally achieve accurate fusion of threat intelligence triples to improve the overall accuracy and robustness of extraction. Attached Figure Description

[0012] Figure 1 The overall structure of the Entity-Driven Attention Module (EDAM) is described in detail.

[0013] Figure 2 The overall structure of the Entity-Driven Attention Module (EDAM) is described in detail.

[0014] Figure 3 The Decision Fusion and Arbitration Module (DFAM) mechanism is described in detail.

[0015] Figure 4 The entity recognition and relationship prediction process is described in detail.

[0016] Figure 5 A detailed description of the example-driven large model hint construction method is provided. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0018] This invention provides a method for entity identification and relation reasoning in network threat intelligence. By constructing a preprocessing module, an entity-driven attention modeling module, a case retrieval and reasoning module, and a relation fusion and arbitration module, it achieves high-precision extraction of key entities and attack relationships from threat intelligence texts. The specific steps are as follows:

[0019] Step 1: Network Threat Intelligence Text Preprocessing Stage

[0020] In the network threat intelligence extraction method of this invention, the input text is first preprocessed to filter sentences unrelated to network threats, and security terminology is standardized. Regarding sentence filtering, this invention employs a filtering strategy based on regular expression matching and keyword recognition. By identifying attack-related behavioral words, malware names, vulnerability identifiers, and common attack semantic patterns, sentences directly related to attack behaviors, threat actors, or victims are selected. Simultaneously, purely background descriptions, irrelevant comments, or ordinary narrative content unrelated to threat analysis are removed, making the remaining text more focused on actual attack semantics.

[0021] In terms of terminology alignment, this invention utilizes a pre-built cybersecurity domain dictionary and entity mapping table to uniformly map aliases, abbreviations, and non-standard spellings appearing in the text to standardized entity names. For terms that cannot be directly matched, this invention further calculates semantic similarity based on word vectors and merges them into the corresponding standard entities according to their semantic proximity, thereby ensuring the consistency of attack organizations, malware, vulnerability numbers, and technology names involved in the text in subsequent entity identification and relationship modeling.

[0022] Through the above preprocessing steps, the present invention can effectively filter irrelevant sentences, retain core threat semantics, and ensure consistent expression of key terms, laying a standardized data foundation for subsequent semantic modeling and reasoning.

[0023] Step 2: Entity-Driven Attention (EDAM) Deep Semantic Augmentation Stage

[0024] After text preprocessing, this invention enters the deep semantic modeling stage of Entity-Driven Attention (EDAM). This step achieves a complete mapping from sequential text to structured relationships through multi-layer representation learning, external knowledge injection, and entity-pair attention reasoning, enabling the system to understand the key semantics of threat intelligence and its inherent logical relationships.

[0025] First, this invention uses a pre-trained language model to perform contextual encoding on the input text. Input text sequence

[0026] X = {x1, x2, ..., x} n}

[0027] After passing through the BERT network, a contextual representation is obtained for each token. This representation can capture deep semantic relationships between words in the text, such as the semantic coupling between attack actions, attackers, and behavioral objects. To further enhance the model's understanding of syntactic structure and entity dependencies, this invention inputs the output of BERT into a Bidirectional Long Short-Term Memory (BiLSTM) network, enabling the model to simultaneously model semantic flow from left to right and from right to left. The BiLSTM processing yields a new contextual representation, which has a stronger expressive power for complex sentence structures.

[0028] After completing context dependency modeling, this invention uses Conditional Random Fields (CRF) to annotate the text sequence with entities. The CRF model can model the transition relationships between entity labels, ensuring the consistency and structure of the generated entity sequence and avoiding issues such as broken entity labels and boundary shifts. Through the combined effect of BERT, BiLSTM, and CRF, the system can accurately identify key entities such as attack organizations, malware, vulnerability IDs, and target industries. The above three steps can be represented as a unified entity recognition process:

[0029] ε = CRF(BiLSTM(BERT(X)))

[0030] Where ε is the set of identified entities, including entity boundaries and entity type information.

[0031] After entity identification, this invention augments the entity representation with knowledge using a Relational Graph Attention Network (RGAT). Since cyber threat intelligence texts typically involve numerous technical terms (such as ATT&CK techniques, attack organization families, toolchain structures, etc.), relying solely on the text itself is insufficient to comprehensively capture attack background knowledge. Therefore, this invention utilizes external threat knowledge graphs (such as MITREATT&CK, malware knowledge bases, and APT organization lineages) to semantically supplement the entities.

[0032] Specifically, for entity e i and its neighbor node e in the knowledge graph j The system calculates the contribution of neighbors to an entity using the following relational attention formula:

[0033]

[0034] Where, vector h i with h j Let r represent the semantic representation of the entity respectively. ij This indicates the type of adjacency relationship, such as "using tools," "associating with organizations," or "being exploited." This attention weight dynamically determines the most important semantic source of an entity's adjacency, enabling adaptive expansion of entity knowledge. Subsequently, neighboring entities are aggregated based on the attention weight to obtain the knowledge-enhanced entity representation.

[0035]

[0036] The enhanced entity vectors not only retain the semantic features of the text, but also carry structured semantic information from the knowledge graph, enabling the model to have a stronger professional understanding ability, such as understanding the toolchain unique to a certain attack organization or the typical exploitation method of a certain vulnerability.

[0037] Next, to infer the potential relationships between entities, this invention examines each pair of entities (e) in the text. i ,e j The system performs entity pair attention reasoning. It is based on augmented entity representation h. i ′ and h jThe system uses contextual representation to calculate attention weights between entity pairs and various positions in the text, thereby identifying key semantic segments that best reveal entity relationships. For example, when trigger words such as "use," "target," and "exploit" appear in the text, the system automatically assigns higher attention weights to enhance the reliability of relationship judgments.

[0038] The attention convergence process between entity pairs and their context is as follows:

[0039]

[0040] Where, α ij,t H represents the relevance weight between the t-th word in the context and the entity pair. t This represents the context vector. This convergence process can automatically extract the semantic information that best expresses the relationship from the entire sentence.

[0041] Subsequently, by concatenating the context summary with the entity augmentation representation, the final entity-to-relation representation is constructed:

[0042]

[0043] This relation representation integrates contextual semantics, knowledge-enhanced entity information, and inter-entity association features, accurately capturing the interaction methods between entities. This invention uses a relation classifier to classify r... ij Make judgments to identify the preliminary relationships between entity pairs, such as "the attacker uses a tool", "the vulnerability is exploited", "the tool belongs to an organization", etc., and output them as preliminary relationship triples.

[0044] Through this step, the present invention ultimately realizes a complete chain of text semantics, knowledge enhancement, and significant contextual relationship reasoning, enabling the system to automatically extract structured, high-quality entity relationships from complex, unstructured threat intelligence, providing a solid foundation for subsequent case-based deep reasoning modules.

[0045] Step 3: Relationship-Driven Case Retrieval and Large-Scale Model Inference Stage

[0046] After completing entity recognition and semantic enhancement, this invention enters the case retrieval-driven reasoning enhancement stage. This step combines historical attack cases with a large-scale language model to achieve deep reasoning and completion of potential relationships in the input text, thereby improving the accuracy and completeness of overall relationship extraction.

[0047] First, based on the entity set, context representation, and enhanced entity vectors obtained in step two, this invention constructs a query feature representation for case retrieval. This representation integrates the semantic type of entities, contextual dependency structure, possible relational patterns, and attack chain behavior features, accurately reflecting the logical framework of the current text fragment. Using this query feature, this invention retrieves several historical cases from the case library that are most similar to the current text structure, providing a reference for subsequent reasoning.

[0048] After obtaining the candidate case set, this invention concatenates the task description, retrieved case examples, and the current input text according to a preset format to form the large model input content for inference. This concatenation method ensures that the model simultaneously obtains task semantics, structural examples, and input text information during inference, as specifically expressed below:

[0049] P = [T||S||x]

[0050] Where T represents the task description and relation type definition for relation recognition, S represents the retrieved set of similar cases, and x represents the input sentence to be processed. The combination of these three elements provides example-driven inference context for large models.

[0051] To enhance the adaptability of large language models to the representation methods and attack behavior patterns in the field of network threat intelligence, this invention employs Low-Rank Adaptation (LoRA) technology for lightweight domain fine-tuning of the original language model. During this process, the original model weights remain frozen, and training is performed only on the newly added low-rank update matrix, which significantly reduces the number of parameters and improves domain transfer performance. The weight update form is as follows:

[0052] W′=W+ΔW,ΔW=BA

[0053] Here, A and B are low-rank trainable matrices that satisfy r << d, enabling the model to quickly learn the professional knowledge and semantic features of threat intelligence texts based on a small number of adapted parameters.

[0054] After constructing the inference input and adapting the model to the relevant domain, this invention provides the input to a large language model fine-tuned with LoRA. The large model analyzes the pattern correspondences between the task description, case examples, and the input text, identifying potential relationships between entity pairs in the text based on analogical reasoning. This inference mechanism can capture relationship types that are not explicitly expressed, span across sentences, or require background knowledge for inference, thus significantly enhancing the system's ability to identify weakly expressed relationships, implicit relationships, and attack chain inference relationships.

[0055] Finally, this invention organizes the candidate relations obtained from the large model inference into a candidate triple set, and performs semantic normalization and type consistency verification on them, so that the inference results can serve as high-quality input for the next stage of arbitration fusion. Through this stage of processing, the system acquires expert-level relation analysis capabilities driven by case analogy, providing a solid foundation for the final relation fusion.

[0056] Step Four: Relationship Integration and Arbitration Stage

[0057] After obtaining candidate relation sets through the structured model and case-based reasoning model, this invention proceeds to the relation fusion and arbitration stage. This step aims to uniformly verify and finally adjudicate the multi-source relation results to obtain robust and reliable relation outputs.

[0058] First, this invention compares the relation sets generated by the structured model and the large model respectively, identifies the relations predicted by both, and retains these consistent relations directly as high-confidence results. Simultaneously, for candidate relations that appear only in a single path, this invention aggregates them into the arbitration set and proceeds to the subsequent verification process.

[0059] During the arbitration process, this invention prioritizes screening candidate relationships item by item through a rule-based, multi-dimensional verification mechanism. Preliminary verification includes whether entity type pairings conform to network attack behavior patterns, whether relationship semantics align with the attack chain stage logic, whether there are obvious semantic conflicts between entities, and whether the relationship is consistent with existing threat knowledge systems. Through such rule-based verification, this invention can quickly eliminate relationships that are semantically unreasonable or inconsistent with attack behavior patterns.

[0060] For candidate relations that pass the initial rule verification but still exhibit semantic uncertainty, incomplete descriptions, or involve cross-sentence dependency inference, this invention further introduces a domain-adapted large language model for final arbitration. The large language model comprehensively judges the semantic rationality of the relation based on contextual content, entity augmentation representations, and reasoning patterns from case examples, thus completing the final ruling on the candidate relation. Through this two-layer judgment mechanism of "rule screening + large model arbitration," this invention can effectively identify potential relationships hidden in the text while preventing unreasonable inferences from entering the final result.

[0061] After arbitration, this invention performs unified integration and formatting on all confirmed relationships to ensure standardized entity names, relationship types, and consistency with the relationship constraints of the knowledge graph. The cleaned and fused set of relationships serves as the final output of this invention, which can be directly used for threat knowledge graph construction, attack chain analysis, and subsequent automated security reasoning tasks.

Claims

1. An automatic method for extracting network threat intelligence based on multi-source fusion, the specific steps of which are as follows: Step 1: Through three stages—text filtering, terminology standardization, and format normalization—multi-source heterogeneous network threat intelligence texts are processed in a unified manner. Sentences irrelevant to threats are filtered out, and key security terms are aligned, providing an accurate and standardized input foundation for subsequent entity identification and relational reasoning. Step Two: Entities and relationships in cyber threat intelligence are highly implicit and context-dependent. To address the difficulty of traditional models in capturing key entity relationships, a deep learning model and external knowledge fusion mechanism are introduced. Through three steps—contextual encoding of text, entity knowledge enhancement, and entity pair attention analysis—entity semantics are recovered and an initial candidate set of relationships is constructed. This process includes: BERT-BiLSTM-CRF encoding, RGAT knowledge enhancement, and entity pair attention reasoning significantly improve the accuracy and interpretability of entity recognition and relation extraction. Step 3: To handle the implicit attack chain logic and cross-sentence relationships in CTI text, a large language model is introduced. By analyzing the relational logic of the input text, threat cases with similar patterns are retrieved, and prompt templates are constructed for analogical reasoning. This module includes six steps: relational logic analysis, example retrieval, prompt engineering construction, domain adaptation fine-tuning, analogical reasoning execution, and structured result generation. It can effectively complete implicit relationships and improve the reasoning ability for complex attack scenarios. Step Four: First, compare the results generated by the entity-driven model and the relation-driven model to screen reliable triples. Then, for entity relations that conflict or are missing, further verify, correct, and complete them by introducing a large language model arbitration mechanism. Finally, merge the arbitrated entities and relations and input them into a unified threat intelligence output module to achieve accurate extraction and structured expression of network threat intelligence, thereby significantly improving the accuracy, completeness, and robustness of detection.

Images