A method and system for automatically labeling critical aspects of vulnerabilities based on unsupervised learning
By employing unsupervised learning methods and utilizing preprocessing, vectorization, and clustering optimization techniques, the inefficiency and inaccuracy of automatic annotation of critical vulnerability aspects are addressed, achieving second-level processing and stronger generalization capabilities to adapt to novel vulnerability descriptions.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- JIANGXI NORMAL UNIV
- Filing Date
- 2026-04-23
- Publication Date
- 2026-08-04
AI Technical Summary
In existing technologies, automatic annotation methods for critical aspects of vulnerabilities rely on manual annotation, which is time-consuming and difficult to adapt to new vulnerability descriptions. Supervised learning methods require a large amount of labeled data and have insufficient generalization ability, resulting in low efficiency and insufficient accuracy.
We employ an unsupervised learning approach, which involves preprocessing, vectorization, cluster optimization, and similarity matching. We generate representative vectors using vectorization and clustering algorithms, and perform category matching by combining word frequency-inverse document frequency weights, thus achieving automatic labeling without the need for large-scale training data.
It achieves second-level processing speed and stronger generalization ability, improves the accuracy and efficiency of automatic annotation of critical aspects of vulnerabilities, and can automatically adapt to new vulnerability descriptions.
Smart Images
Figure CN122087114B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of natural language processing, and in particular to a method and system for automatically labeling critical aspects of vulnerabilities based on unsupervised learning. Background Technology
[0002] In the field of cybersecurity, labeling key aspects of vulnerability descriptions is a fundamental task for risk assessment and vulnerability remediation.
[0003] In current technologies, mainstream methods rely on security experts manually annotating key aspects of vulnerabilities (such as attack vectors and scope of impact). Taking the CVE-2022-1234 vulnerability as an example, experts need to spend an average of 45 minutes analyzing the vulnerability report to complete the full annotation. With the number of vulnerabilities growing exponentially (more than 25,000 vulnerabilities were disclosed globally in 2023), this model has become a bottleneck for security operations. Existing automated solutions mostly use supervised learning, which has two inherent drawbacks: first, it requires a large amount of labeled data to train the model, but high-quality labeled sets are scarce in the vulnerability domain; second, it is difficult to adapt to new vulnerability descriptions, and the accuracy of supervised models drops sharply on untrained vulnerability types. Existing methods also have semantic understanding problems, such as synonym problems and compound word problems. Pure keyword methods have low recall rates for compound vulnerability types. Therefore, how to design an automatic annotation method for critical aspects of vulnerabilities to improve generalization ability and accuracy has become an urgent problem to be solved. Summary of the Invention
[0004] Based on this, the present invention proposes an automatic annotation method and system for critical vulnerability aspects based on unsupervised learning. By preprocessing and extracting keywords from the statement data of vulnerability descriptions, it generates optimized representative vectors using vectorization and clustering algorithms, constructs category vectors by combining word frequency-inverse document frequency weights, and then achieves matching prediction between the vulnerability to be detected and predefined categories through similarity matching. This achieves the effect of automatically adapting to new vulnerability descriptions without the need for large-scale training data, has stronger generalization ability, and achieves second-level processing speed in annotation, thus improving processing efficiency. The present invention improves the generalization ability and accuracy of automatic annotation of critical vulnerability aspects.
[0005] This invention proposes an automatic vulnerability critical aspect annotation method based on unsupervised learning, comprising: Acquire the data of the statements to be annotated and perform preprocessing, including keyword extraction; The preprocessed statement data to be labeled is vectorized to obtain vulnerability description vectors. The vectorization is based on the en_core_web_md model. The vulnerability description vector is subjected to clustering optimization to obtain keyword vectors. The clustering optimization is based on quadratic clustering optimization, outlier filtering, and clustering quality verification. Similarity matching is performed based on the keyword vector to obtain the final annotation result. The similarity matching process is based on dynamic weighted vectors, multi-level similarity calculation, and result verification.
[0006] In summary, based on the aforementioned method for automatically labeling critical vulnerability aspects using unsupervised learning, this invention preprocesses and extracts keywords from the vulnerability description statements, generates optimized representative vectors using vectorization and clustering algorithms, constructs category vectors by combining word frequency-inverse document frequency weights, and then uses similarity matching to predict the matching between the vulnerability to be detected and predefined categories. This achieves the effect of automatically adapting to new vulnerability descriptions without requiring large-scale training data, possesses stronger generalization ability, and achieves second-level processing speed, thus improving processing efficiency. This invention improves the generalization ability and accuracy of automatic labeling of critical vulnerability aspects. Specifically, the process involves acquiring and preprocessing the statement data to be labeled. This preprocessing includes keyword extraction, which improves interpretability and reproducibility. The preprocessed statement data is then vectorized to obtain vulnerability description vectors. This vectorization is based on the en_core_web_md model. The vulnerability description vectors are then subjected to clustering optimization to obtain keyword vectors. This clustering optimization is based on quadratic clustering optimization, outlier filtering, and clustering quality verification. Finally, similarity matching is performed based on the keyword vectors to obtain the final labeling result. This similarity matching is based on dynamic weighted vectors, multi-level similarity calculation, and result verification. This achieves the effect of automatically adapting to new vulnerability descriptions without requiring large-scale training data, possessing stronger generalization ability, and achieving second-level processing speed, thus improving processing efficiency. This invention improves the generalization ability and accuracy of automatic labeling of key vulnerability aspects.
[0007] Furthermore, the step of obtaining the data of the statements to be annotated and performing preprocessing specifically includes: Retrieve the statement data to be annotated from the vulnerability dataset; Extract key information from the scattered fields of the data to be annotated, integrate the key information into a unified text, retain network security special terms in the unified text, convert all text in the unified text to lowercase and remove all punctuation marks, and perform stemming normalization according to PorterStemmer, ignoring non-key words, including conjunctions. A four-dimensional vulnerability classification framework is established, whose dimensions include vulnerability type, root cause, impact, and attack vector. A sub-keyword system is constructed for each single dimension of the four-dimensional vulnerability classification framework. The sub-keyword system assigns vulnerabilities to corresponding groups based on the occurrence of keywords. An independent JSON file is generated for each keyword group. Function keywords under each sub-keyword system are extracted, and the role of the function keywords in the current statement is explained according to a large speech model and written into local data accordingly.
[0008] Furthermore, the step of vectorizing the preprocessed statement data to be labeled to obtain vulnerability description vectors specifically includes: Vectorization is performed based on the en_core_web_md model. The grouped keyword vectors in the preprocessed data to be labeled are loaded and normalized. Then, the code function names are matched according to regular expressions.
[0009] Furthermore, the step of performing clustering optimization on the vulnerability description vector to obtain keyword vectors specifically includes: The vulnerability description vectors are initially clustered using the K-means algorithm. These initial clusters are then grouped based on a dynamic clustering number, the specific algorithm for which the dynamic clustering number is calculated is as follows: N_cluster = min(5, N_vectors / 10), Where N_cluster represents the initial number of clusters, min represents the minimum value function, and N_vectors represents the total number of vectors; The two-dimensional outlier factor is calculated using the following algorithm: Z_d = (d - μ_d) / σ_d, Where Z_d represents the Z-score value of the vector to its cluster center, and when Z_d>3, it is considered a distance outlier, d represents the distance to the cluster center, μ_d represents the mean distance of the vector to the cluster center within the same cluster, and σ_d represents the standard deviation of the distance of the vector to the cluster center within the same cluster. The specific algorithm for labeling microclusters is as follows: threshold = max(3, ceil(0.05 × N_vectors)), Where max represents the maximum value function, threshold represents the threshold for small clusters, and ceil represents the ceil function; Outlier filtering is performed based on a composite outlier criterion, the specific algorithm of which is as follows: Outlier_flag(i) = (Z_d(i)>3) ∨ (ClusterSize(C_i) <threshold), Where Outlier_flag(i) represents the composite outlier criterion, i represents the vector sample index, C_i represents the cluster to which the vector belongs, and ClusterSize(C_i) represents the number of vector samples in cluster C_i; The vector set after outlier filtering is subjected to secondary clustering, and the optimal representative vector in each cluster is calculated to refine the cluster centers. Subspace projection decomposition is performed on the compound word clusters to complete feature decoupling. Perform clustering quality verification.
[0010] Furthermore, the step of performing clustering quality verification specifically includes: The contour coefficient is evaluated, and the specific algorithm for the contour coefficient evaluation is as follows: s(i) = (b(i) - a(i)) / max(a(i), b(i)), Where s(i) represents the profile coefficient. b(i) represents the average distance between classes, a(i) represents the average distance within classes, and max represents the maximum value function; The intra-class distance-inter-class distance ratio is calculated using the following algorithm: ratio = intra_dist / inter_dist, Where ratio represents the ratio of intra-class distance to inter-class distance, intra_dist represents the mean of the intra-class average distance of intra-cluster vectors, and inter_dist represents the mean of the inter-class average distance of intra-cluster vectors. Iterative optimization is performed, and the optimization results are output.
[0011] Furthermore, the step of performing similarity matching based on the keyword vector to obtain the final annotation result specifically includes: A dynamic weighted vector is generated, and the specific algorithm for generating the dynamic weighted vector is as follows: V_doc=Σ_{w∈K_w}[TF-IDF(w)×V_optimized(w)]+Σ_{w∈NK_w}V_basic(w), Where V_doc represents the document semantic vector, w represents the word being processed, K_w represents the keyword, NK_w represents the ordinary word, TF-IDF(w) represents the word frequency-inverse document frequency weight, V_optimized(w) represents the word pre-optimized vector, and V_basic(w) represents the word basic vector; Word-level similarity is calculated, and the specific algorithm for word-level similarity calculation is as follows: Sim_word(w) = cos(V_optimized(w), V_category-key(w)), Where Sim_word(w) represents word-level similarity, V_category-key(w) represents the predefined category keywords of the word, and cos represents the cosine similarity calculation; Semantic chunk-level similarity calculation is performed, and the specific algorithm for semantic chunk-level similarity calculation is as follows: Sim_chunk(c) = (1 / n) * Σ Sim_word(w_i) * TF-IDF_chunk(c), Where Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keyword, w_i represents sub-words in compound keyword, n represents the number of sub-words in compound keyword, and TF-IDF_chunk(c) represents phrase-level term frequency-inverse document frequency weight; Document-tag level similarity calculation is performed, and the specific algorithm for document-tag level similarity calculation is as follows: Sim_doc = cos(V_doc, V_category), Where Sim_doc represents the basic document similarity, V_doc represents the document vector, and V_category represents the tag category vector; A weighted fusion similarity calculation is performed, and the specific algorithm for the weighted fusion similarity is as follows: Sim_final =α* Sim_doc +β* (Σ Sim_chunk(c) / |C|) +γ* (Σ Sim_word(w) / |W|), Where Sim_final represents the weighted fusion similarity, α, β, and γ represent different levels of fusion weights, C represents the set of composite keywords, and W represents the set of independent keywords; To obtain the final annotation results and verify them.
[0012] Furthermore, the steps for obtaining the final annotation results and verifying the results specifically include: The specific algorithm for performing hierarchical consistency verification is as follows: Consistency = |{Sim_word(w)>θ ∧ Sim_chunk(c)>θ}| / Total_Keywords, Where Consistency represents hierarchical consistency, Sim_word(w) represents word-level similarity, Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keywords, Total_Keywords represents the total number of keywords to be verified, and θ represents the similarity threshold; Feature decoupling is performed based on a difference tolerance mechanism, the specific algorithm of which is as follows: , Where Δ(c) represents the difference measure, and mean_{w∈c} indicates that a single sub-word belongs to a compound keyword; When the difference metric exceeds the difference threshold, feature decoupling is triggered, which includes deweighting and elimination.
[0013] This invention proposes an automatic vulnerability critical aspect annotation system based on unsupervised learning, comprising: The preprocessing module is used to acquire the data of the sentences to be labeled and to preprocess it, including keyword extraction; The vectorization module is used to vectorize the preprocessed statement data to be labeled in order to obtain vulnerability description vectors. The vectorization is based on the en_core_web_md model. The clustering optimization module is used to perform clustering optimization processing on the vulnerability description vector to obtain keyword vectors. The clustering optimization processing is based on quadratic clustering optimization, outlier filtering, and clustering quality verification. The similarity matching module is used to perform similarity matching processing based on the keyword vector to obtain the final annotation result. The similarity matching processing is based on dynamic weighted vectors, multi-level similarity calculation and result verification.
[0014] The present invention also provides a storage medium that stores one or more programs, which, when executed by a processor, implement the above-described method for automatically labeling critical aspects of vulnerabilities based on unsupervised learning.
[0015] The present invention also provides a computer device, the computer device including a memory and a processor, wherein: The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the above-described method for automatically labeling critical vulnerability aspects based on unsupervised learning. Attached Figure Description
[0016] Figure 1 This is a flowchart of the automatic annotation method for critical aspects of vulnerabilities based on unsupervised learning proposed in the first embodiment of the present invention; Figure 2This is a schematic diagram of the structure of the automatic vulnerability critical aspect labeling system based on unsupervised learning proposed in the second embodiment of the present invention.
[0017] The following detailed description, in conjunction with the accompanying drawings, will further illustrate the present invention. Detailed Implementation
[0018] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Several embodiments of the invention are illustrated in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete.
[0019] It should be noted that when a component is said to be "fixed to" another component, it can be directly on the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.
[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.
[0021] Please see Figure 1 The diagram shows a flowchart of the automatic annotation method for critical vulnerability aspects based on unsupervised learning proposed in the first embodiment of the present invention. This automatic annotation method for critical vulnerability aspects based on unsupervised learning includes steps S01 to S04, wherein: Step S01: Obtain the data of the statements to be annotated and perform preprocessing; It should be noted that in this embodiment, the preprocessing includes keyword extraction to obtain the statement data to be labeled in the vulnerability dataset; Extract key information from the scattered fields of the data to be annotated, integrate the key information into a unified text, retain network security special terms in the unified text, convert all text in the unified text to lowercase and remove all punctuation marks, and perform stemming normalization according to PorterStemmer, ignoring non-key words, including conjunctions. A four-dimensional vulnerability classification framework is established, whose dimensions include vulnerability type, root cause, impact, and attack vector. A sub-keyword system is constructed for each single dimension of the four-dimensional vulnerability classification framework. The sub-keyword system assigns vulnerabilities to corresponding groups based on the occurrence of keywords. An independent JSON file is generated for each keyword group. Function keywords under each sub-keyword system are extracted, and the role of the function keywords in the current statement is explained according to a large speech model and written into local data accordingly.
[0022] Step S02: Vectorize the preprocessed statement data to be labeled to obtain the vulnerability description vector; It should be noted that in this embodiment, the vectorization is based on the en_core_web_md model. Vectorization is performed according to the en_core_web_md model by loading the grouped keyword vectors in the preprocessed statement data to be labeled, performing vector standardization, and then matching the code function names according to regular expressions.
[0023] Step S03: Perform clustering optimization on the vulnerability description vector to obtain keyword vectors; It should be noted that in this embodiment, the clustering optimization process is based on quadratic clustering optimization, outlier filtering, and clustering quality verification. The vulnerability description vectors are initially clustered using the K-means algorithm. The initial clustering is grouped according to the dynamic clustering number, and the specific algorithm for the dynamic clustering number is as follows: N_cluster = min(5, N_vectors / 10), Where N_cluster represents the initial number of clusters, min represents the minimum value function, and N_vectors represents the total number of vectors; The two-dimensional outlier factor is calculated using the following algorithm: Z_d = (d - μ_d) / σ_d, Where Z_d represents the Z-score value of the vector to its cluster center, and when Z_d>3, it is considered a distance outlier, d represents the distance to the cluster center, μ_d represents the mean distance of the vector to the cluster center within the same cluster, and σ_d represents the standard deviation of the distance of the vector to the cluster center within the same cluster. The specific algorithm for labeling microclusters is as follows: threshold = max(3, ceil(0.05 × N_vectors)), Where max represents the maximum value function, threshold represents the threshold for small clusters, and ceil represents the ceil function; Outlier filtering is performed based on a composite outlier criterion, the specific algorithm of which is as follows: Outlier_flag(i) = (Z_d(i)>3) ∨ (ClusterSize(C_i) <threshold), Where Outlier_flag(i) represents the composite outlier criterion, i represents the vector sample index, C_i represents the cluster to which the vector belongs, and ClusterSize(C_i) represents the number of vector samples in cluster C_i; The vector set after outlier filtering is subjected to secondary clustering, and the optimal representative vector in each cluster is calculated to refine the cluster centers. Subspace projection decomposition is performed on the compound word clusters to complete feature decoupling. Perform clustering quality verification.
[0024] The contour coefficient is evaluated, and the specific algorithm for the contour coefficient evaluation is as follows: s(i) = (b(i) - a(i)) / max(a(i), b(i)), Where s(i) represents the profile coefficient. b(i) represents the average distance between classes, a(i) represents the average distance within classes, and max represents the maximum value function; The intra-class distance-inter-class distance ratio is calculated using the following algorithm: ratio = intra_dist / inter_dist, Where ratio represents the ratio of intra-class distance to inter-class distance, intra_dist represents the mean of the intra-class average distance of intra-cluster vectors, and inter_dist represents the mean of the inter-class average distance of intra-cluster vectors. Iterative optimization is performed, and the optimization results are output.
[0025] Step S04: Perform similarity matching based on keyword vectors to obtain the final annotation results; It should be noted that in this embodiment, the similarity matching process is based on dynamic weighted vectors, multi-level similarity calculation, and result verification. The specific algorithm for generating the dynamic weighted vectors is as follows: V_doc=Σ_{w∈K_w}[TF-IDF(w)×V_optimized(w)]+Σ_{w∈NK_w}V_basic(w), Where V_doc represents the document semantic vector, w represents the word being processed, K_w represents the keyword, NK_w represents the ordinary word, TF-IDF(w) represents the word frequency-inverse document frequency weight, V_optimized(w) represents the word pre-optimized vector, and V_basic(w) represents the word basic vector; Word-level similarity is calculated, and the specific algorithm for word-level similarity calculation is as follows: Sim_word(w) = cos(V_optimized(w), V_category-key(w)), Where Sim_word(w) represents word-level similarity, V_category-key(w) represents the predefined category keywords of the word, and cos represents the cosine similarity calculation; Semantic chunk-level similarity calculation is performed, and the specific algorithm for semantic chunk-level similarity calculation is as follows: Sim_chunk(c) = (1 / n) * Σ Sim_word(w_i) * TF-IDF_chunk(c), Where Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keyword, w_i represents sub-words in compound keyword, n represents the number of sub-words in compound keyword, and TF-IDF_chunk(c) represents phrase-level term frequency-inverse document frequency weight; Document-tag level similarity calculation is performed, and the specific algorithm for document-tag level similarity calculation is as follows: Sim_doc = cos(V_doc, V_category), Where Sim_doc represents the basic document similarity, V_doc represents the document vector, and V_category represents the tag category vector; A weighted fusion similarity calculation is performed, and the specific algorithm for the weighted fusion similarity is as follows: Sim_final =α* Sim_doc +β* (Σ Sim_chunk(c) / |C|) +γ* (Σ Sim_word(w) / |W|), Where Sim_final represents the weighted fusion similarity, α, β, and γ represent different levels of fusion weights, C represents the set of composite keywords, and W represents the set of independent keywords; To obtain the final annotation results and verify them.
[0026] The specific algorithm for performing hierarchical consistency verification is as follows: Consistency = |{Sim_word(w)>θ ∧ Sim_chunk(c)>θ}| / Total_Keywords, Where Consistency represents hierarchical consistency, Sim_word(w) represents word-level similarity, Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keywords, Total_Keywords represents the total number of keywords to be verified, and θ represents the similarity threshold; Feature decoupling is performed based on a difference tolerance mechanism, the specific algorithm of which is as follows: , Where Δ(c) represents the difference measure, and mean_{w∈c} indicates that a single sub-word belongs to a compound keyword; When the difference metric exceeds the difference threshold, feature decoupling is triggered, which includes deweighting and elimination.
[0027] In summary, based on the aforementioned method for automatically labeling critical vulnerability aspects using unsupervised learning, this invention preprocesses and extracts keywords from the vulnerability description statements, generates optimized representative vectors using vectorization and clustering algorithms, constructs category vectors by combining word frequency-inverse document frequency weights, and then uses similarity matching to predict the matching between the vulnerability to be detected and predefined categories. This achieves the effect of automatically adapting to new vulnerability descriptions without requiring large-scale training data, possesses stronger generalization ability, and achieves second-level processing speed, thus improving processing efficiency. This invention improves the generalization ability and accuracy of automatic labeling of critical vulnerability aspects. Specifically, the process involves acquiring and preprocessing the statement data to be labeled. This preprocessing includes keyword extraction, which improves interpretability and reproducibility. The preprocessed statement data is then vectorized to obtain vulnerability description vectors. This vectorization is based on the en_core_web_md model. The vulnerability description vectors are then subjected to clustering optimization to obtain keyword vectors. This clustering optimization is based on quadratic clustering optimization, outlier filtering, and clustering quality verification. Finally, similarity matching is performed based on the keyword vectors to obtain the final labeling result. This similarity matching is based on dynamic weighted vectors, multi-level similarity calculation, and result verification. This achieves the effect of automatically adapting to new vulnerability descriptions without requiring large-scale training data, possessing stronger generalization ability, and achieving second-level processing speed, thus improving processing efficiency. This invention improves the generalization ability and accuracy of automatic labeling of key vulnerability aspects.
[0028] Please see Figure 2 The figure shown is a schematic diagram of the automatic vulnerability critical aspect annotation method system based on unsupervised learning proposed in the second embodiment of the present invention. The system includes: Preprocessing module 10 is used to acquire the data of the sentences to be labeled and to perform preprocessing, the preprocessing including keyword extraction; Vectorization module 20 is used to vectorize the preprocessed statement data to be labeled in order to obtain vulnerability description vectors. The vectorization is based on the en_core_web_md model. Clustering optimization module 30 is used to perform clustering optimization processing on the vulnerability description vector to obtain keyword vectors. The clustering optimization processing is based on secondary clustering optimization, outlier filtering, and clustering quality verification. The similarity matching module 40 is used to perform similarity matching processing based on the keyword vector to obtain the final annotation result. The similarity matching processing is based on dynamic weighted vectors, multi-level similarity calculation and result verification.
[0029] The present invention also proposes a computer storage medium storing one or more programs that, when executed by a processor, implement the above-described method for automatically labeling critical aspects of vulnerabilities based on unsupervised learning.
[0030] The present invention also proposes a computer device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to realize the above-mentioned method for automatic annotation of vulnerability critical aspects based on unsupervised learning.
[0031] Those skilled in the art will understand that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain stored, communicated, propagated, or transmitted programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.
[0032] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.
[0033] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0034] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0035] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.
Claims
1. A method for automatically labeling critical aspects of vulnerabilities based on unsupervised learning, characterized in that, include: Acquire the data of the statements to be annotated and perform preprocessing, including keyword extraction; The preprocessed statement data to be labeled is vectorized to obtain vulnerability description vectors. The vectorization is based on the en_core_web_md model. The vulnerability description vector is subjected to clustering optimization to obtain keyword vectors. The clustering optimization is based on quadratic clustering optimization, outlier filtering, and clustering quality verification. Similarity matching is performed based on the keyword vector to obtain the final annotation result. The similarity matching process is based on dynamic weighted vectors, multi-level similarity calculation, and result verification. The step of performing similarity matching based on the keyword vector to obtain the final annotation result specifically includes: A dynamic weighted vector is generated, and the specific algorithm for generating the dynamic weighted vector is as follows: V_doc=Σ_{w∈K_w}[TF-IDF(w)×V_optimized(w)]+Σ_{w∈NK_w}V_basic(w), Where V_doc represents the document semantic vector, w represents the word being processed, K_w represents the keyword, NK_w represents the ordinary word, TF-IDF(w) represents the word frequency-inverse document frequency weight, V_optimized(w) represents the word pre-optimized vector, and V_basic(w) represents the word basic vector; Word-level similarity is calculated, and the specific algorithm for word-level similarity calculation is as follows: Sim_word(w) = cos(V_optimized(w), V_category-key(w)), Where Sim_word(w) represents word-level similarity, V_category-key(w) represents the predefined category keywords of the word, and cos represents the cosine similarity calculation; Semantic chunk-level similarity calculation is performed, and the specific algorithm for semantic chunk-level similarity calculation is as follows: Sim_chunk(c) = (1 / n) * Σ Sim_word(w_i) * TF-IDF_chunk(c), Where Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keyword, w_i represents sub-words in compound keyword, n represents the number of sub-words in compound keyword, and TF-IDF_chunk(c) represents phrase-level term frequency-inverse document frequency weight; Document-tag level similarity calculation is performed, and the specific algorithm for document-tag level similarity calculation is as follows: Sim_doc = cos(V_doc, V_category), Where Sim_doc represents the basic document similarity, V_doc represents the document vector, and V_category represents the tag category vector; A weighted fusion similarity calculation is performed, and the specific algorithm for the weighted fusion similarity is as follows: Sim_final =α* Sim_doc +β* (Σ Sim_chunk(c) / |C|) +γ* (Σ Sim_word(w) / |W|), Where Sim_final represents the weighted fusion similarity, α, β, and γ represent different levels of fusion weights, C represents the set of composite keywords, and W represents the set of independent keywords; To obtain the final annotation results and verify them; The steps for obtaining the final annotation results and verifying the results specifically include: The specific algorithm for performing hierarchical consistency verification is as follows: Consistency = |{Sim_word(w)>θ ∧ Sim_chunk(c)>θ}| / Total_Keywords, Where Consistency represents hierarchical consistency, Sim_word(w) represents word-level similarity, Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keywords, Total_Keywords represents the total number of keywords to be verified, and θ represents the similarity threshold; Feature decoupling is performed based on a difference tolerance mechanism, the specific algorithm of which is as follows: ， Where Δ(c) represents the difference measure, and mean_{w∈c} indicates that a single sub-word belongs to a compound keyword; When the difference metric exceeds the difference threshold, feature decoupling is triggered, which includes deweighting and elimination.
2. The automatic annotation method for critical aspects of vulnerabilities based on unsupervised learning according to claim 1, characterized in that, The steps of obtaining and preprocessing the data of the statements to be annotated specifically include: Retrieve the statement data to be annotated from the vulnerability dataset; Extract key information from the scattered fields of the data to be annotated, integrate the key information into a unified text, retain network security special terms in the unified text, convert all text in the unified text to lowercase and remove all punctuation marks, and perform stemming normalization according to PorterStemmer, ignoring non-key words, including conjunctions. A four-dimensional vulnerability classification framework is established, whose dimensions include vulnerability type, root cause, impact, and attack vector. A sub-keyword system is constructed for each single dimension of the four-dimensional vulnerability classification framework. The sub-keyword system assigns vulnerabilities to corresponding groups based on the occurrence of keywords. An independent JSON file is generated for each keyword group. Function keywords under each sub-keyword system are extracted, and the role of the function keywords in the current statement is explained according to a large speech model and written into local data accordingly.
3. The automatic annotation method for critical aspects of vulnerabilities based on unsupervised learning according to claim 1, characterized in that, The step of vectorizing the preprocessed statement data to be labeled to obtain vulnerability description vectors specifically includes: Vectorization is performed based on the en_core_web_md model. The grouped keyword vectors in the preprocessed data to be labeled are loaded and normalized. Then, the code function names are matched according to regular expressions.
4. The automatic annotation method for critical aspects of vulnerabilities based on unsupervised learning according to claim 1, characterized in that, The step of performing clustering optimization on the vulnerability description vector to obtain keyword vectors specifically includes: The vulnerability description vectors are initially clustered using the K-means algorithm. These initial clusters are then grouped based on a dynamic clustering number, the specific algorithm for which the dynamic clustering number is calculated is as follows: N_cluster = min(5, N_vectors / 10), Where N_cluster represents the initial number of clusters, min represents the minimum value function, and N_vectors represents the total number of vectors; The two-dimensional outlier factor is calculated, and the specific algorithm for calculating the two-dimensional outlier factor is as follows: Z_d = (d - μ_d) / σ_d, Where Z_d represents the Z-score value of the vector to its cluster center, and when Z_d>3, it is considered a distance outlier, d represents the distance to the cluster center, μ_d represents the mean distance of the vector to the cluster center within the same cluster, and σ_d represents the standard deviation of the distance of the vector to the cluster center within the same cluster. The specific algorithm for labeling microclusters is as follows: threshold = max(3, ceil(0.05 × N_vectors)), Where max represents the maximum value function, threshold represents the threshold for small clusters, and ceil represents the ceil function; Outlier filtering is performed based on a composite outlier criterion, the specific algorithm of which is as follows: Outlier_flag(i) = (Z_d(i)>3) ∨ (ClusterSize(C_i) <threshold), Where Outlier_flag(i) represents the composite outlier criterion, i represents the vector sample index, C_i represents the cluster to which the vector belongs, and ClusterSize(C_i) represents the number of vector samples in cluster C_i; The vector set after outlier filtering is subjected to secondary clustering, and the optimal representative vector in each cluster is calculated to refine the cluster centers. Subspace projection decomposition is performed on the compound word clusters to complete feature decoupling. Perform clustering quality verification.
5. The automatic annotation method for critical aspects of vulnerabilities based on unsupervised learning according to claim 4, characterized in that, The steps for performing clustering quality verification specifically include: The contour coefficient is evaluated, and the specific algorithm for the contour coefficient evaluation is as follows: s(i) = (b(i) - a(i)) / max(a(i), b(i)), Where s(i) represents the profile coefficient. b(i) represents the average distance between classes, a(i) represents the average distance within classes, and max represents the maximum value function; The intra-class distance-inter-class distance ratio is calculated using the following algorithm: ratio = intra_dist / inter_dist, Where ratio represents the ratio of intra-class distance to inter-class distance, intra_dist represents the mean of the intra-class average distance of intra-cluster vectors, and inter_dist represents the mean of the inter-class average distance of intra-cluster vectors. Iterative optimization is performed, and the optimization results are output.
6. An automatic vulnerability critical aspect annotation system based on unsupervised learning, characterized in that, include: The preprocessing module is used to acquire the data of the statements to be labeled and to preprocess it, including keyword extraction. The vectorization module is used to vectorize the preprocessed statement data to be labeled in order to obtain vulnerability description vectors. The vectorization is based on the en_core_web_md model. The clustering optimization module is used to perform clustering optimization processing on the vulnerability description vector to obtain keyword vectors. The clustering optimization processing is based on quadratic clustering optimization, outlier filtering, and clustering quality verification. The similarity matching module is used to perform similarity matching processing based on the keyword vector to obtain the final annotation result. The similarity matching processing is based on dynamic weighted vectors, multi-level similarity calculation and result verification. The step of performing similarity matching based on the keyword vector to obtain the final annotation result specifically includes: A dynamic weighted vector is generated, and the specific algorithm for generating the dynamic weighted vector is as follows: V_doc=Σ_{w∈K_w}[TF-IDF(w)×V_optimized(w)]+Σ_{w∈NK_w}V_basic(w), Where V_doc represents the document semantic vector, w represents the word being processed, K_w represents the keyword, NK_w represents the ordinary word, TF-IDF(w) represents the word frequency-inverse document frequency weight, V_optimized(w) represents the word pre-optimized vector, and V_basic(w) represents the word basic vector; Word-level similarity is calculated, and the specific algorithm for word-level similarity calculation is as follows: Sim_word(w) = cos(V_optimized(w), V_category-key(w)), Where Sim_word(w) represents word-level similarity, V_category-key(w) represents the predefined category keywords of the word, and cos represents the cosine similarity calculation; Semantic chunk-level similarity calculation is performed, and the specific algorithm for semantic chunk-level similarity calculation is as follows: Sim_chunk(c) = (1 / n) * Σ Sim_word(w_i) * TF-IDF_chunk(c), Where Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keyword, w_i represents sub-words in compound keyword, n represents the number of sub-words in compound keyword, and TF-IDF_chunk(c) represents phrase-level term frequency-inverse document frequency weight; Document-tag level similarity calculation is performed, and the specific algorithm for document-tag level similarity calculation is as follows: Sim_doc = cos(V_doc, V_category), Where Sim_doc represents the basic document similarity, V_doc represents the document vector, and V_category represents the tag category vector; A weighted fusion similarity calculation is performed, and the specific algorithm for the weighted fusion similarity is as follows: Sim_final =α* Sim_doc +β* (Σ Sim_chunk(c) / |C|) +γ* (Σ Sim_word(w) / |W|), Where Sim_final represents the weighted fusion similarity, α, β, and γ represent different levels of fusion weights, C represents the set of composite keywords, and W represents the set of independent keywords; To obtain the final annotation results and verify them; The steps for obtaining the final annotation results and verifying the results specifically include: The specific algorithm for performing hierarchical consistency verification is as follows: Consistency = |{Sim_word(w)>θ ∧ Sim_chunk(c)>θ}| / Total_Keywords, Where Consistency represents hierarchical consistency, Sim_word(w) represents word-level similarity, Sim_chunk(·) represents semantic chunk-level similarity, c represents compound keywords, Total_Keywords represents the total number of keywords to be verified, and θ represents the similarity threshold; Feature decoupling is performed based on a difference tolerance mechanism, the specific algorithm of which is as follows: ， Where Δ(c) represents the difference measure, and mean_{w∈c} indicates that a single sub-word belongs to a compound keyword; When the difference metric exceeds the difference threshold, feature decoupling is triggered, which includes deweighting and elimination.
7. A storage medium, characterized in that, The storage medium stores one or more programs that, when executed by a processor, implement the automatic vulnerability critical aspect annotation method based on unsupervised learning as described in any one of claims 1-5.
8. A computer device, characterized in that, The computer device includes a memory and a processor, wherein: The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the automatic annotation method for critical vulnerability aspects based on unsupervised learning as described in any one of claims 1-5.