Network security threat intelligence-oriented dynamic knowledge graph construction method and intelligent question and answer system

Abstract

This invention relates to the field of cybersecurity threat intelligence processing technology, and more particularly to a method for constructing a dynamic knowledge graph and an intelligent question-answering system for cybersecurity threat intelligence. The method first acquires cybersecurity threat intelligence data and generates text data blocks with metadata prefixes; based on a large language model, it extracts cybersecurity entities and relationships from the preprocessed data and fragmented entities from the cybersecurity threat intelligence data; it uses vector semantic similarity and a multi-model voting mechanism to align and fuse fragmented entities, and constructs search paths to form a knowledge graph; it updates the nodes in the knowledge graph in real time, and constructs a context-aware semantic vector index based on the cybersecurity knowledge graph; it responds to user natural language queries and generates threat analysis results constrained by the knowledge graph. This invention can solve the problem of large model reasoning illusion, enabling the knowledge base to be synchronized with the latest threat intelligence in real time.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity threat intelligence processing technology, and in particular to a method for constructing a dynamic knowledge graph and an intelligent question-answering system for cybersecurity threat intelligence. Background Technology

[0002] Cybersecurity threat intelligence is the cornerstone of network defense systems, and cybersecurity threat intelligence analysis is a key technology for identifying potential security risks by collecting and analyzing multi-source data. Currently, cybersecurity intelligence exhibits significant multi-source heterogeneity, with data formats ranging from standardized STIX 2.0 structured threat intelligence representations to semi-structured national vulnerability databases such as the US's NVD, China's CNVD and CNNVD, and even completely unstructured internet text. Faced with the complex knowledge ecosystem of cybersecurity intelligence, existing automated retrieval technologies are insufficient to meet the demands of in-depth intelligence analysis in practical applications. Their limitations are mainly reflected in the following three dimensions:

[0003] First, traditional feature-based retrieval relies primarily on predefined keywords for regular expression matching, limiting it to the literal dimension and making it difficult to bridge the cognitive boundaries between different dimensions in cyberspace. For example, standard hardware and software code defined by the Common Platform Enumeration Standard (CPE) cannot establish deep semantic alignment and logical mapping with attack strategies defined by the Common Attack Pattern Enumeration and Classification Standard (CAPEC). Natural language descriptions in unstructured threat intelligence often cannot be effectively aligned with specialized entries in semi-structured knowledge bases, resulting in attack fragments with causal relationships being isolated in their respective data formats. This prevents defense systems from effectively inferring and reconstructing complex attack chains from a global perspective.

[0004] Secondly, while knowledge graphs offer significant advantages in the structured integration of multi-source heterogeneous data, they suffer from rigid retrieval and lagging updates. Knowledge graphs can provide rigorous entity relationships through ontology models, but knowledge graph retrieval relies on precise subgraph matching algorithms and structured query languages, lacking understanding of natural language and semantic generalization capabilities. When the natural language query terms input by the user differ from the predefined entity labels or relation types within the graph, it can lead to broken retrieval links, decreased recall, and difficulty in effectively handling non-standardized, ambiguous query demands. Furthermore, traditional knowledge graph construction relies on supervised learning-based specialized information extraction models, such as BiLSTM-CRF or BERT fine-tuning models. These models are typically trained on closed datasets, resulting in limited generalization capabilities. When facing new threat entities or ontology structure changes in the cybersecurity field, these models cannot achieve zero-shot transfer, often requiring large-scale manual annotation and iterative model training. This not only consumes enormous computational resources but also struggles to adapt to the high-frequency dynamic updates of threat intelligence (minute-level updates), making it difficult for existing solutions to balance timeliness and comprehensive coverage.

[0005] Finally, while large language models possess powerful semantic generalization and reasoning capabilities, they face the problem of logical reasoning illusions when lacking domain knowledge constraints and real-time data alignment. Large language models can efficiently understand massive amounts of unstructured intelligence text, identifying explicit expressions of implicit information and inherent relationships between entities within unstructured data, transforming intelligence information into structured data. However, lacking knowledge constraints specific to the cybersecurity vertical domain, large models struggle to distinguish complex attack techniques and the boundaries of technical terminology, easily losing contextual logic in long-chain reasoning, leading to semantic biases or causal inversions in the extracted results. Furthermore, limited by high retraining costs and lengthy iteration cycles, large language models rely on static parameterized memory, which often lags behind the latest common vulnerability disclosures (CVEs) or common vulnerability enumeration (CWE) libraries. This lack of real-time data alignment makes it difficult for large models to identify sudden new attack methods such as zero-day vulnerabilities when processing cybersecurity question answering due to the knowledge truncation effect, resulting in threat analysis lagging behind the current offensive and defensive situation.

[0006] The semantic generalization and reasoning capabilities of large language models complement the structured logic of knowledge graphs. By utilizing large models to automatically construct and update structured knowledge graphs in real time, the problems of high knowledge base construction costs and rigid retrieval are solved. At the same time, the deterministic knowledge retrieval of the graph enhances the generation process, correcting attribution bias and logical illusions in complex tasks by large models. This results in a highly accurate, real-time updated intelligent question-answering system that effectively addresses the semantic understanding deficiencies and lack of reasoning ability of traditional retrieval technologies in processing multi-source heterogeneous data. Summary of the Invention

[0007] The present invention aims to at least partially solve one of the technical problems in the related art.

[0008] Therefore, the first objective of this invention is to propose a method for constructing a dynamic knowledge graph for cybersecurity threat intelligence, comprising: S1. Acquire and preprocess multi-source heterogeneous cybersecurity threat intelligence data, extract global attribute metadata of the intelligence data, and perform recursive semantic segmentation based on metadata attachment to generate text data blocks with metadata prefixes. S2, based on a large language model, extracts cybersecurity entities and relationships from preprocessed data and extracts fragmented entities from cybersecurity threat intelligence data. S3 aligns fragmented entities based on entity classification and constructs a search path using the connectivity of the knowledge graph to build the knowledge graph. When an entity has a clear identifier, the alignment is completed using a preset alias list as the entity's prior rule. When an entity lacks a unique identifier or is not included in the preset alias list, the fragmented entities are aligned after similarity matching and multi-model voting. S4, update the nodes in the knowledge graph in real time, and construct a context-aware semantic vector index based on the network security knowledge graph, wherein the vectorized object integrates the entity's own description and its topological neighbor information in the knowledge graph; S5, responding to the user's natural language query, performing semantic similarity retrieval based on the semantic vector index to determine the starting anchor entity in the knowledge graph, performing path traversal in the knowledge graph based on the starting anchor entity to extract the association evidence subgraph, and inputting the association evidence subgraph and the user query together into the large language model to generate threat analysis results constrained by the knowledge graph.

[0009] In one embodiment of the present invention, S2 includes: S21, Define the ontology layer of the network security knowledge graph. Based on preset domain objects and relation objects, construct an ontology model containing threat entity entities, malware entities and vulnerability entities. Define the relationship chain between key entities and extract the relationship chain that conforms to preset logic to form edges. The preset logic is domain object-relationship object-domain object. S22, based on ontology model constraints, constructs prompt word templates that include role limitations, fact boundary constraints, and hard constraints on output format. These templates guide the large language model to perform zero-sample information extraction, obtain fragmented entities, and output the fragmented entities in a JSON structure.

[0010] In one embodiment of the present invention, step S22 further includes: When processing unstructured text in cybersecurity threat intelligence data, the system uses the thought chain in the zero-shot learning mechanism to perform reasoning processing on the unstructured text, identify the subject-verb-object structure of the unstructured text, and combine the context to resolve the referential relationship, and output the extraction results in JSON structure.

[0011] In one embodiment of the present invention, the method for performing similarity matching on fragmented entities in step S3 is as follows: A1 utilizes semantic embedding vectors to transform the contextual descriptions of fragmented entities into high-dimensional vectors for entity alignment. By calculating the cosine similarity between vectors, entity pairs with similarity higher than the initial screening threshold are selected as candidate sets for alignment. A2 uses large language models with different parameter sizes to distinguish entities in the candidate set to be aligned. It uses a majority voting strategy to compare the processing results of large language models with different parameter sizes. When the number of votes exceeds a set threshold, it determines that the fragmented entity is the same entity as the first entity and performs a node merging operation.

[0012] In one embodiment of the present invention, the method for constructing a search path using the connectivity of a knowledge graph in step S3 is as follows: Based on the entity relationship semantics and transitivity rules defined in the STIX standard, the system finds the evidence chain corresponding to the same entity in different documents, verifies the overlap of time windows or causal sequence of the evidence chain to be associated, and automatically fills in the implicit evidence loop according to the logical rules to instantiate the cross-document attack path.

[0013] In one embodiment of the present invention, the method for real-time updating of nodes in the knowledge graph in step S4 is as follows: For nodes that already exist in the knowledge graph, perform incremental attribute merging. If the updated data attribute is a list type, perform a set deduplication and merging operation. If the updated data attribute is a state type, update the node to the latest timestamp. For nodes that do not exist in the knowledge graph, create new nodes, initialize time attributes, and store standardized triplet data.

[0014] In one embodiment of the present invention, the context-aware semantic vector indexing method in step S4 is as follows: The algorithm iterates through all one-hop neighbor nodes of the core entity in the graph, extracts the key features and relationship types of the neighbor nodes, and concatenates them with the core entity's own description to form a semantic text sequence. The threat intelligence text sequence is transformed into a high-dimensional vector using an Embedding pre-trained model to capture the similarity of network attacks, constructs an approximate nearest neighbor index, and uses the top-level sparse graph for fast routing navigation and local greedy search.

[0015] In one embodiment of the present invention, S5 further includes: S51 uses a large language model to transform the user's unstructured natural language questions into machine-executable structured query Cypher instructions to determine the user's query intent; S52, the user query text is decomposed into multiple query subtasks, and semantic similarity retrieval is performed using semantic vector index; S53, performs a depth-first search in the graph database based on the starting anchor point to uncover implicit associations; S54. Input the user's original question and the structured context constructed above into the generative large model. Use the deterministic logic provided by the graph to constrain the generation process of the large model, correct the illusion in its internal parameter memory, and generate an analysis report containing a complete chain of evidence.

[0016] To achieve the above objectives, a second aspect of the present invention proposes an intelligent question-answering system for cybersecurity threat intelligence, comprising: The data acquisition module acquires and preprocesses multi-source heterogeneous cybersecurity threat intelligence data; The knowledge extraction module, based on a large language model, extracts cybersecurity entities and relationships from preprocessed data and extracts fragmented entities from cybersecurity threat intelligence data. The knowledge graph construction module aligns fragmented entities based on entity classification and constructs search paths using the connectivity of the knowledge graph to build the knowledge graph. When an entity has a clear identifier, the alignment is completed using a preset alias list as the entity's prior rule. When an entity lacks a unique identifier or is not included in the preset alias list, the fragmented entities are matched for similarity before alignment.

[0017] The semantic vector index construction module updates the nodes in the knowledge graph in real time and constructs a context-aware semantic vector index based on the network security knowledge graph. The vectorized object integrates the entity's own description and its topological neighbor information in the knowledge graph. The query response and analysis generation module responds to the user's natural language query, performs semantic similarity retrieval based on the semantic vector index to determine the starting anchor entity in the knowledge graph, performs path traversal in the knowledge graph based on the starting anchor entity to extract the association evidence subgraph, and inputs the association evidence subgraph and the user query into the large language model to generate threat analysis results constrained by the knowledge graph.

[0018] To achieve the above objectives, a third aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0019] The method, system, and storage medium of this invention effectively solve the problems of logical illusion and knowledge lag in question answering in the field of cybersecurity using large language models. By providing structured factual constraints through dynamically constructed knowledge graphs, it achieves highly accurate, interpretable, and real-time responsive intelligent threat intelligence analysis.

[0020] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0021] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a threat intelligence analysis method based on the collaboration of a large language model and a knowledge graph, according to an embodiment of the present invention. Figure 2 This is a structural diagram of an intelligent question-and-answer system for cybersecurity threat intelligence according to an embodiment of the present invention. Detailed Implementation

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] The following description, with reference to the accompanying drawings, describes a method for constructing a dynamic knowledge graph for cybersecurity threat intelligence and an intelligent question-answering system proposed according to embodiments of the present invention.

[0025] Example 1 Figure 1 This is a flowchart of a threat intelligence analysis method based on the collaboration of a large language model and a knowledge graph, according to an embodiment of the present invention.

[0026] like Figure 1 As shown, the threat intelligence analysis method based on the collaboration of large language models and knowledge graphs includes the following steps: S1. Acquire and preprocess multi-source heterogeneous cybersecurity threat intelligence data, extract global attribute metadata of the intelligence data, and perform recursive semantic segmentation based on metadata attachment to generate text data blocks with metadata prefixes.

[0027] Specifically, this step aims to provide high-quality, structured input data for subsequent knowledge extraction and graph construction. Its core lies in transforming raw, messy, multi-source heterogeneous threat intelligence into standardized text units that are semantically coherent and rich in key background information through systematic data collection, cleaning, and intelligent segmentation.

[0028] Specifically, as one implementation method, the cybersecurity threat intelligence data collected by this invention includes structured data, semi-structured data, and unstructured data.

[0029] After acquiring cybersecurity threat intelligence data, data cleaning and analysis are necessary. For PDF data such as white papers and technical reports, PyMuPDF is used to extract text. By analyzing the PDF's metadata and layout coordinates, headers, footers, page numbers, and watermarks are automatically identified and removed. Simultaneously, OCR technology is used to identify text information embedded in attack flowcharts or code screenshots within the document. For web page data, BeautifulSoup combined with XPath is used to extract the main text content, removing HTML tags, advertising scripts, navigation bars, and other noise, retaining only text paragraphs with intelligence value. For short texts such as tweets, emojis, meaningless hashtags, and URL shortening redirection are removed to restore the text's true semantic meaning.

[0030] Subsequently, the cleaned intelligence data is recursively segmented semantically. First, it is segmented by paragraph; if the segment is still too long, it is segmented by sentence; finally, it is segmented by clause. Each block retains a 15% overlap window, which preserves the contextual relevance while meeting the vectorization input constraints of the large language model. The maximum block length threshold is set to 512 tokens, and the overlap window ratio is set to 15%. A three-level semantic delimiter list is defined for hierarchical segmentation: Level 1 delimiter (paragraph level): double newline character \n\n; Level 2 delimiter (sentence level): sentence-ending punctuation matched by regular expression (?<=[.!?])\s+; Level 3 delimiter (clause level): comma and semicolon [,;]. The specific processing flow is as follows: Step i: Input the cleaned intelligence text T (i.e., intelligence data). Calculate its length Len(T). If Len(T)... If the result is a single block, it will be output directly without further splitting.

[0031] Step ii: Paragraph segmentation, if Len(T) > First, the text is divided into a set of sub-blocks using the first-level delimiter.

[0032] Step iii: Traverse the set, for any element whose length still exceeds... The sub-blocks are further divided using a second-level delimiter; if the sub-blocks are still too long after division, they are continued to be divided using a third-level delimiter until all sub-blocks are less than the specified length. .

[0033] Step iv: Overlapping window fusion. To maintain semantic coherence near the split points, a sliding window mechanism is applied during the reorganization of blocks. For the k-th block... Its starting position is the same as the previous block. An overlapping area is maintained between the ending positions. The formula for calculating the overlap length is: = The overlap window ratio is 15%. During actual truncation, a break is forced at the nearest natural separator within the overlap area to avoid cutting off words or entities.

[0034] Because cybersecurity threat intelligence is highly time-sensitive and diverse, simple text truncation can lead to the loss of crucial contextual constraints in fragmented data. For example, a text fragment describing a data breach without a timestamp might misclassify a historical breach as a current active threat; a fragment describing ransomware encryption without a threat type label might be incorrectly categorized as a common system failure. Therefore, this solution proposes a category- and time-sensitive dynamic metadata attachment mechanism. First, global attributes are extracted during document preprocessing, focusing on identifying the attack type of the intelligence, such as ransomware, data breach, and APT attacks, along with its effective time window. Then, during the recursive chunking process, this global metadata is dynamically injected into the header of each slice of text. A metadata object M = {Type, Time, Status} is defined, where Type is the threat intelligence type label, an enumeration type generated based on keyword extraction, with values ​​including but not limited to ransomware, data breaches, vulnerability exploits, and phishing attacks; Time is the intelligence's effective timestamp, used to anchor the specific moment the threat occurred; and Status is the timeliness status identifier, calculated based on the difference between the current system time and the intelligence timestamp, used to assist the model in quickly determining threat activity. For example, a time difference of less than or equal to seven days indicates an active status, while a time difference greater than seven days indicates an archived status. This mechanism ensures that the large language model in the subsequent S2 step can accurately perceive the type and time status of the intelligence when processing any fragmented text, preventing spatiotemporal misalignment and qualitative errors, thereby ensuring the integrity of the intelligence context.

[0035] S2, based on a large language model, extracts cybersecurity entities and relationships from preprocessed data and extracts fragmented entities from cybersecurity threat intelligence data.

[0036] The core of this step lies in leveraging the zero-shot learning and reasoning capabilities of Large Language Models (LLMs) to automatically extract structured knowledge from preprocessed unstructured or semi-structured cybersecurity text into structured knowledge conforming to a predefined ontology pattern, in order to construct or update the knowledge graph. The specific implementation consists of two key stages.

[0037] Specifically, this invention references the STIX 2.1 standard and, based on its predefined eighteen types of domain objects (SDOs) and relational objects (SROs), constructs an ontology model (Schema) centered on threat subjects, malware, vulnerabilities, and attack patterns. This model formally defines the relationship chains of key entities. In specific implementation, graph nodes are strictly mapped to standard domain objects: threat subject nodes are designed to represent attack initiators and include name, alias, and role attributes; the threat subject attribute set is represented as follows: = {name, aliases, roles, sophistication, resource_level}, where aliases are used to store aliases for the same organization from different intelligence sources; malware nodes are used to characterize attack tools and cover software type and architecture execution environment attributes. The malware attribute set is defined as follows: = {name, is_family, malware_types, architecture, os_execution_envs}, where architecture distinguishes instruction sets such as x86 and ARM; vulnerability nodes characterize system flaws and must contain an external reference field indexed by the CVE number. The vulnerability attribute set is defined as follows: ={name, cve, cvss_score, description}, where the cve field is set as a mandatory constraint field, serving as the anchor point for external knowledge base links. At the graph edge construction level, the relationship chains between key entities are formally defined, strictly adhering to the STIX 2.1 standard. Only SDO-SRO-SDO (domain object-relationship object-domain object) logical triples are allowed to be instantiated, and only edges conforming to predefined logic are allowed to be extracted and stored; illegal relationships are automatically filtered. Specifically, the entity relationship constraint logic is as follows: First, for threat subjects, only "use" relationships pointing to malware or attack patterns are allowed, representing the attacking organization's use of specific malware tools and the adoption of specific attack tactics and techniques; second, for malware, only "target" relationships pointing to vulnerabilities or victim targets are allowed, representing malware exploiting specific system flaws or attacking entities in specific industries and regions; third, for attack patterns, only "exploitation" relationships pointing to vulnerabilities are allowed, to clarify the exploitation association between specific attack methods and vulnerabilities. For example, by restricting threat actors from using relationships to connect to malware, and strictly prohibiting the construction of illegal edges that violate ontology logic, such as launching attacks based on vulnerabilities, the semantic compliance of the graph topology is ensured from the source. Through the above structured ontology definition and constraints, fragmented intelligence data is effectively mapped into a directed graph with clear semantic logic, thereby ensuring the standardization of threat intelligence data.

[0038] Secondly, structured information extraction based on prompt engineering is implemented. This is the key process of transforming ontology constraints into executable instructions for large models. This invention designs a prompt word construction strategy based on a zero-shot learning mechanism. This strategy does not rely on labeled samples, but enhances the understanding and reasoning ability of large language models for general cybersecurity knowledge by constructing a high-precision instruction set and semantic constraints. The specific implementation process is as follows: (1) Construct a schema-constrained instruction prompt template, design strict structured prompts, and transform the ontology model defined in step S1 into strongly constrained instructions in natural language form. In the prompts, the model role is explicitly set as "a threat intelligence analysis expert proficient in the STIX 2.1 standard", and the task boundaries are defined, requiring fact extraction only from the input text and strictly prohibiting the generation of illusory information that does not exist in the text. At the same time, the semantic connotations of predefined entity types and relation types are directly embedded into the prompts. For example, the prompts explicitly state: "The threat subject refers to the organization or individual that launches the attack, often appearing in the form of APT number or code name; if verbs such as 'exploit' or 'deploy' appear in the text to connect the subject and the tool, then a 'use' relationship should be constructed." Through this explicit definition injection, instead of traditional sample alignment, the model understands the extraction target.

[0039] (2) Zero-shot thought chain is introduced for reasoning to achieve accurate mapping between unstructured entities and ontology models. Traditional methods struggle to directly align unstructured text with predefined schema structures due to issues such as obscure attack intent and ambiguous preconditions. Prompt words guide the model in logical decomposition and derivation, outputting an intermediate reasoning process before generating the final JSON structure. The model is required to first perform syntactic analysis on the input text, identify the subject-verb-object structure, and resolve referential relationships within the context. For example, when analyzing the sentence "It exploited this vulnerability," the model needs to clearly define in the reasoning paragraph that "it" refers to the "Mirai botnet" mentioned in the previous sentence, and "this vulnerability" refers to "CVE-2023-XXXX." The thought chain guides the model to analyze the context, and based on the reasoning results, maps the identified entities to STIX objects. For example, the model is required to analyze the role of "Cobalt Strike" in the sentence; if it is described as "used for lateral movement," it is determined to be "malware"; if it is described as "being defended against," it is determined to be "the target of attack."

[0040] (3) To ensure the usability of the output data under zero-sample conditions, the output format will be subject to strict constraints. The output format will be strictly specified at the end of the prompt words using a JSON Schema template. The model is required to output only JSON data objects that conform to the preset key-value pair structure. That is, all key names must be strictly consistent with the STIX 2.1 standard fields, and all key names must be consistent with the ontology layer definition, thereby realizing the transformation from natural language to machine-readable data.

[0041] Existing information extraction methods based on large language models rely on fine-tuning with a large number of labeled samples, which can easily lead to illusions, generating entities or relationships that do not exist in the text. Furthermore, the lack of strict adherence to cybersecurity standards results in semantic confusion in the knowledge graph's topology. This paper constructs a zero-shot hint engineering framework based on STIX 2.1 Schema, designs role constraints and fact boundary constraints, and guides the model's output of intermediate reasoning processes to eliminate semantic ambiguity and ensure the semantic accuracy of the knowledge graph.

[0042] S3 aligns fragmented entities based on entity classification and constructs a search path using the connectivity of the knowledge graph to build the knowledge graph. When an entity has a clear identifier, the alignment is completed using a preset alias list as the entity's prior rule. When an entity lacks a unique identifier or is not included in the preset alias list, the fragmented entities are aligned after similarity matching and multi-model voting.

[0043] Specifically, this invention performs coarse-grained vector recall and alignment for the fragmented entities extracted in the above steps. For entities with explicit identifiers, a pre-defined alias list is used as a priori rule to standardize the naming of entities with explicit identifiers, resolving explicit naming conflicts before vector calculation. As one implementation, the pre-defined alias list in this invention includes MITRE, ATT&CK, and alias lists released by multiple vendors. For unstructured descriptions lacking unique identifiers or not covered by the alias library, semantic embedding vectors are used to transform the context description into high-dimensional vectors for entity alignment. By calculating the cosine similarity between vectors, entity pairs with similarity higher than the initial screening threshold are recalled as a candidate set for alignment.

[0044] For entity pairs in the candidate set to be aligned, the reasoning ability of the large language model is used for fine-grained discrimination. Multiple LLMs with different parameter scales are called and the judgment results of each model are compared. A majority voting strategy is adopted. The node merging operation is only performed when more than two-thirds of the sampling results are consistently judged as the same entity. This mechanism ensures high confidence of fused knowledge.

[0045] After completing entity alignment and node merging of heterogeneous intelligence sources, path searching is performed using the connectivity of the graph structure. Based on the entity relationship semantics and transitivity rules defined in the STIX 2.1 standard, cross-document attack chain completion is executed. Specifically, for two independent evidence chains provided by different intelligence sources—the threat actor using malware and the malware exploiting a vulnerability—after verifying the overlap of timestamps or causal order between the two evidence chains, the missing evidence loops are automatically filled logically, instantiating and constructing the implicit attack path of the threat actor targeting a specific vulnerability, thereby discovering potential threat associations. For example, if intelligence A indicates 'organization X uses tool Y', and intelligence B indicates 'tool Y exploits vulnerability Z', the implicit relationship 'organization X—potential attack—vulnerability Z' is automatically inferred and instantiated based on transitivity rules, thus allowing for the prediction of potential victims in the early stages of a zero-day vulnerability outbreak.

[0046] S4. The nodes in the knowledge graph are updated in real time, and a context-aware semantic vector index is constructed based on the network security knowledge graph. The vectorized object integrates the entity's own description and its topological neighbor information in the knowledge graph.

[0047] This step aims to address the semantic ambiguity caused by the isolated encoding of knowledge graph entities in traditional vectorization methods, and to improve retrieval efficiency for massive amounts of entities. Its core lies in constructing a context-aware semantic vector index. By fusing entity attributes with their local topological structure information within the graph, it generates semantically rich vector representations and establishes an efficient approximate nearest neighbor search index.

[0048] Specifically, during the graph storage and schema mapping processing of threat intelligence triples, the triples fused in step S3 and the derived relationships generated by inference are dynamically updated in real time to complete the entire lifecycle attack chain, including threat subjects, malware, vulnerabilities, and attack patterns, ensuring that the storage layer is the latest full lifecycle attack chain state. For triples entering the database, the graph database is first queried based on the number. If the node already exists, incremental attribute merging is performed: for list-type attributes, set deduplication and merging are performed; for state-type attributes, the latest timestamp is updated. If the node does not exist, a new node is created and the time attribute is initialized. During the database entry process, node labels and edge types are automatically created according to the STIX 2.1 Schema, and the generated standardized triples are imported into the Neo4j graph database. A multi-level index structure is built for frequently queried fields, and an inverted index is built for the key attributes of the nodes.

[0049] When constructing a context-aware semantic vector index for heterogeneous threat intelligence, a context fusion strategy centered on entities is adopted to address the semantic ambiguity of threat intelligence data. Instead of utilizing the features of a single node, the strategy associates core threat entities with their adjacent one-hop nodes in the topology, including structured splicing of attack organizations, attack processes, and descriptions of associated malware. This preserves highly specific and forensically valuable neighbor information, such as specific C2 domains, variant hash values, and unique registry key paths. The semantics of the node itself are fused with the semantics of the surrounding topology to form a semantically rich natural language description sequence. By introducing this topological context, semantic ambiguity of a single identifier in different attack scenarios is effectively eliminated. In the vectorization stage, an embedding pre-trained model is used to transform the threat intelligence text sequence into high-dimensional vectors, capturing the similarity of network attacks and constructing an approximate nearest neighbor index. A multi-level graph index structure is built, utilizing a top-level sparse graph for fast routing navigation and local greedy search. This mechanism reduces the time complexity of threat intelligence vector retrieval from linear to logarithmic levels, ensuring that even with a massive number of threat entities, semantically similar entities can still be quickly recalled with millisecond-level latency through semantic similarity, providing high-performance computing support for anchor point localization in the subsequent step S5.

[0050] In existing technologies, vector retrieval struggles to capture complex logical connections and multi-hop relationships, while graph queries have limited ability to understand natural language intent. Large language models suffer from context window limitations when processing long texts and are susceptible to factual errors due to biases in training data. Based on this, this invention designs a dual-modal fusion question-answering framework: (a) semantic anchor point localization using vector indexes to map unstructured queries to Top-K candidate entities; (b) depth-first search in the graph database based on anchor points to uncover implicit associations; (c) a pruning strategy using TF-IDF and degree centrality weighted to filter high-frequency common nodes and retain the shortest attack path subgraph with high evidence value; and (d) the structured subgraph triples and original text fragments are used together as context input to the large model, utilizing the deterministic logical constraints of the graph to generate the process.

[0051] S5, responding to the user's natural language query, performing semantic similarity retrieval based on the semantic vector index to determine the starting anchor entity in the knowledge graph, performing path traversal in the knowledge graph based on the starting anchor entity to extract the association evidence subgraph, and inputting the association evidence subgraph and the user query together into the large language model to generate threat analysis results constrained by the knowledge graph.

[0052] This step, as the core execution module of the intelligent question-answering system, aims to overcome the limitations of traditional single retrieval modes in handling complex cybersecurity natural language queries. Specifically, this invention employs a graph and vector fusion mechanism, using multi-hop queries to mine implicit associations and analyze complex cybersecurity situations. First, a large language model is used to transform the user's unstructured natural language question into machine-executable structured query Cypher instructions to determine the user's query intent. Second, the user's query text is decomposed into multiple query subtasks, and semantic similarity retrieval is performed using the context-aware vector index constructed in step S4. An approximate nearest neighbor search is performed in the vector database to recall the Top-K threat entities that are semantically closest. These entities will serve as the starting anchors for subsequent knowledge graph traversal, effectively matching the user's question with entity names in the database. Next, a depth-first search is performed in the graph database based on the starting anchors to mine implicit associations. To prevent irrelevant nodes from introducing noise and exceeding the context window limit of the large model, subgraph mining and pruning optimization are performed on the recalled attack chain data, retaining only the shortest path subgraph connecting the core anchor and high-confidence neighbors. Using a TF-IDF and degree-centrality-weighted pruning strategy, high-frequency but non-specific general nodes are removed, retaining only attack path subgraphs with high forensic value. The extracted attack path subgraphs are serialized into triplet text and concatenated with the original threat intelligence fragments to construct a semantic context containing factual statements and logical relationships. Finally, the user's original question and the constructed structured context are input into a generative large-scale model. The model utilizes the deterministic logic provided by the graph to constrain the large-scale model's generation process, correcting any illusions in its internal parameter memory, and ultimately generating an analysis report containing a complete chain of evidence.

[0053] Example 2 Figure 2 This is a structural diagram of an intelligent question-and-answer system for cybersecurity threat intelligence according to an embodiment of the present invention.

[0054] like Figure 2 As shown, an intelligent question-and-answer system for cybersecurity threat intelligence includes, The data acquisition module acquires and preprocesses multi-source, heterogeneous cybersecurity threat intelligence data.

[0055] Specifically, the intelligence data collected by the data acquisition module includes structured data, semi-structured data, and unstructured data. To facilitate subsequent processing, the collected intelligence data needs to be preprocessed.

[0056] This module employs different processing methods for intelligence data of different formats. When the intelligence data is in PDF format, PyMuPDF is used to extract the text. By analyzing the PDF's metadata and layout coordinates, headers, footers, page numbers, and watermarks are automatically identified and removed. At the same time, OCR technology is used to identify text information embedded in attack flowcharts or code screenshots within the document. When the intelligence data is web page data, BeautifulSoup combined with XPath is used to extract the main text content, removing HTML tags, advertising scripts, navigation bars, and other noise, retaining only text paragraphs with intelligence value. When the intelligence data is short text such as tweets, emojis, meaningless hashtags, and URL short link redirection parsing are removed to restore the true semantics of the text.

[0057] To facilitate subsequent processing, the intelligence data can also be segmented.

[0058] The knowledge extraction module, based on a large language model, extracts cybersecurity entities and relationships from preprocessed data and extracts fragmented entities from cybersecurity threat intelligence data.

[0059] Specifically, the knowledge extraction module includes an ontology layer of a cybersecurity knowledge graph, which contains threat entities, malware entities, and vulnerability entities, with relationship chains existing between these entities.

[0060] This knowledge extraction module is based on schema constraints and constructs prompt word templates that include role limitations, fact boundary constraints, and hard constraints on output format. These templates are used to guide the large language model to extract zero-shot information, obtain fragmented entities, and output the fragmented entities in JSON structure.

[0061] The knowledge graph construction module aligns fragmented entities based on entity classification and constructs search paths using the connectivity of the knowledge graph to build the knowledge graph. When an entity has a clear identifier, the alignment is completed using a preset alias list as the entity's prior rule. When an entity lacks a unique identifier or is not included in the preset alias list, the fragmented entities are matched for similarity before alignment.

[0062] Specifically, when performing similarity matching on fragmented entities, the graph construction module first uses semantic embedding vectors to transform the contextual descriptions of fragmented entities into high-dimensional vectors for entity alignment. By calculating the cosine similarity between vectors, entity pairs with similarity higher than the initial screening threshold are selected as candidate sets for alignment. Subsequently, large language models with different parameter sizes are used to distinguish entities in the candidate sets. A majority voting strategy is employed to compare the processing results of large language models with different parameter sizes. When the number of votes exceeds a set threshold, the fragmented entity is determined to be the same entity as the selected entity, and a node merging operation is performed.

[0063] When constructing search paths using the connectivity of knowledge graphs, the graph construction module searches for evidence chains corresponding to the same entity in different documents based on entity relationship semantics and transitivity rules. After verifying whether the timestamps of the evidence chains overlap or have a causal order, it automatically fills in the missing evidence loops according to logic to form a complete search path.

[0064] The semantic vector index construction module updates the nodes in the knowledge graph in real time and constructs a context-aware semantic vector index based on the network security knowledge graph. The vectorized object integrates the entity's own description and its topological neighbor information in the knowledge graph. When the semantic vector indexing construction module updates nodes in the knowledge graph in real time, it first performs incremental attribute merging on existing nodes. If the updated data attribute is list-type, it performs set deduplication and merging operations; if the updated data attribute is state-type, it updates the node to the latest timestamp. Subsequently, for nodes that do not exist in the knowledge graph, it creates new nodes, initializes time attributes, and stores standardized triplet data.

[0065] When constructing a semantic vector index based on context-aware semantic vector indexing, the module vectorizes cybersecurity threat intelligence data, uses an Embedding pre-trained model to transform threat intelligence text sequences into high-dimensional vectors, captures the similarity of network attacks, constructs an approximate nearest neighbor index, and uses a top-level sparse graph for fast routing navigation and local greedy search.

[0066] The query response and analysis generation module responds to the user's natural language query, performs semantic similarity retrieval based on the semantic vector index to determine the starting anchor entity in the knowledge graph, performs path traversal in the knowledge graph based on the starting anchor entity to extract the association evidence subgraph, and inputs the association evidence subgraph and the user query into the large language model to generate threat analysis results constrained by the knowledge graph.

[0067] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned dynamic intelligent question-and-answer system for network security threat intelligence.

[0068] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0069] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for constructing a dynamic knowledge graph for network security threat intelligence, characterized in that, include: S1. Acquire and preprocess multi-source heterogeneous cybersecurity threat intelligence data, extract global attribute metadata of the intelligence data, and perform recursive semantic segmentation based on metadata attachment to generate text data blocks with metadata prefixes. S2, based on a large language model, extracts cybersecurity entities and relationships from preprocessed data and extracts fragmented entities from cybersecurity threat intelligence data. S3 aligns fragmented entities based on entity classification and constructs a search path using the connectivity of the knowledge graph to build the knowledge graph. When an entity has a clear identifier, the alignment is completed using a preset alias list as the entity's prior rule. When an entity lacks a unique identifier or is not included in the preset alias list, the fragmented entities are aligned after similarity matching and multi-model voting. S4, update the nodes in the knowledge graph in real time, and construct a context-aware semantic vector index based on the network security knowledge graph, wherein the vectorized object integrates the entity's own description and its topological neighbor information in the knowledge graph; S5, responding to the user's natural language query, performing semantic similarity retrieval based on the semantic vector index to determine the starting anchor entity in the knowledge graph, performing path traversal in the knowledge graph based on the starting anchor entity to extract the association evidence subgraph, and inputting the association evidence subgraph and the user query together into the large language model to generate threat analysis results constrained by the knowledge graph.

2. The method of claim 1, wherein, S2 includes: S21, Define the ontology layer of the network security knowledge graph. Based on preset domain objects and relation objects, construct an ontology model containing threat entity entities, malware entities and vulnerability entities. Define the relationship chain between key entities and extract the relationship chain that conforms to preset logic to form edges. The preset logic is domain object-relationship object-domain object. S22, based on ontology model constraints, constructs prompt word templates that include role limitations, fact boundary constraints, and hard constraints on output format. These templates guide the large language model to perform zero-sample information extraction, obtain fragmented entities, and output the fragmented entities in a JSON structure.

3. The method of claim 1, wherein, Step S22 further includes: When processing unstructured text in cybersecurity threat intelligence data, the system uses the thought chain in the zero-shot learning mechanism to perform reasoning processing on the unstructured text, identify the subject-verb-object structure of the unstructured text, and combine the context to resolve the referential relationship, and output the extraction results in JSON structure.

4. The method of claim 1, wherein, The method for similarity matching of fragmented entities described in step S3 is as follows: A1 utilizes semantic embedding vectors to transform the contextual descriptions of fragmented entities into high-dimensional vectors for entity alignment. By calculating the cosine similarity between vectors, entity pairs with similarity higher than the initial screening threshold are selected as candidate sets for alignment. A2 uses large language models with different parameter sizes to identify entities in the candidate set to be aligned. It uses a majority voting strategy to compare the processing results of large language models with different parameter sizes. When the number of votes exceeds a set threshold, it determines that the fragmented entity is the same entity as the entity and performs a node merging operation.

5. The method of claim 1, wherein, The method for constructing search paths using the connectivity of knowledge graphs, as described in step S3, is as follows: Based on the entity relationship semantics and transitivity rules defined in the STIX standard, the system finds the evidence chain corresponding to the same entity in different documents, verifies the overlap of time windows or causal sequence of the evidence chain to be associated, and automatically fills in the implicit evidence loop according to the logical rules to instantiate the cross-document attack path.

6. The method of claim 1, wherein, The method for real-time updating of nodes in the knowledge graph described in step S4 is as follows: For nodes that already exist in the knowledge graph, perform incremental attribute merging. If the updated data attribute is a list type, perform a set deduplication and merging operation. If the updated data attribute is a state type, update the node to the latest timestamp. For nodes that do not exist in the knowledge graph, create new nodes, initialize time attributes, and store standardized triplet data.

7. The method of claim 1, wherein, The context-aware semantic vector indexing method described in step S4 is as follows: Traverse all one-hop neighbor nodes of the core entity in the graph, extract key features and relationship types of the neighbor nodes, and concatenate them with the core entity's own description to form a semantic text sequence; use the Embedding pre-trained model to transform the threat intelligence text sequence into a high-dimensional vector, capture the similarity of network attacks, construct an approximate nearest neighbor index, and use the top-level sparse graph for fast routing navigation and local greedy search.

8. The method of claim 1, wherein, The S5 also includes: S51 uses a large language model to transform the user's unstructured natural language questions into machine-executable structured query Cypher instructions to determine the user's query intent; S52, the user query text is decomposed into multiple query subtasks, and semantic similarity retrieval is performed using semantic vector index; S53, performs a depth-first search in the graph database based on the starting anchor point to uncover implicit associations; S54. Input the user's original question and the structured context constructed above into the generative large model. Use the deterministic logic provided by the graph to constrain the generation process of the large model, correct the illusion in its internal parameter memory, and generate an analysis report containing a complete chain of evidence.

9. A cyber-security threat intelligence oriented intelligent question answering system characterized in that, include, The data acquisition module acquires and preprocesses multi-source heterogeneous cybersecurity threat intelligence data; The knowledge extraction module, based on a large language model, extracts cybersecurity entities and relationships from preprocessed data and extracts fragmented entities from cybersecurity threat intelligence data. The knowledge graph construction module aligns fragmented entities based on entity classification and uses the connectivity of the knowledge graph to construct search paths and build the knowledge graph. When an entity has a clear identifier, the alignment is completed using a pre-defined list of aliases as the entity's prior rule. When an entity lacks a unique identifier or is not included in the pre-defined list of aliases, the fragmented entities are matched for similarity before alignment is performed. The semantic vector index construction module updates the nodes in the knowledge graph in real time and constructs a context-aware semantic vector index based on the network security knowledge graph. The vectorized object integrates the entity's own description and its topological neighbor information in the knowledge graph. The query response and analysis generation module responds to the user's natural language query, performs semantic similarity retrieval based on the semantic vector index to determine the starting anchor entity in the knowledge graph, performs path traversal in the knowledge graph based on the starting anchor entity to extract the association evidence subgraph, and inputs the association evidence subgraph and the user query into the large language model to generate threat analysis results constrained by the knowledge graph.

10. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method as claimed in any one of claims 1-8.

Images