A cross-domain knowledge extraction method and device based on adaptive segmented convolution and domain confrontation

Abstract

The application provides a cross-domain knowledge extraction method and device based on adaptive segmented convolution and domain confrontation, acquires multi-source security situation data and pre-processes, forms a security situation input sequence; the input sequence is input into an adaptive segmented convolution neural network module of a feature extractor, the module outputs a segmentation strategy according to the time sequence statistical characteristics of the input sequence, and the input sequence is adaptively segmented into a short-term feature extraction section and a long-term trend perception section, and the first and second convolution kernel sets are used to extract features respectively, the convolution kernel length is dynamically adjusted according to the local statistical characteristics, and then the fusion features are obtained through the cross-section feature interaction gating mechanism, wherein the feature extractor is a feature extractor pre-trained through two-level domain confrontation transfer learning, and the source domain and target domain feature distribution are aligned; the fusion features are decoded, security situation entities and their correlation are extracted, and a structured security situation knowledge base is generated.

Description

Technical Field

[0001] This invention relates to the fields of natural language processing and knowledge extraction technology, and in particular to a cross-domain knowledge extraction method and apparatus based on adaptive segmented convolution and domain adversarial techniques. Background Technology

[0002] With the continuous increase in information sources and data scale, data from different sources, in different organizational forms, and at different time scales exhibit significant heterogeneity. How to automatically identify target entities, entity attributes, and relationships between entities from massive amounts of multi-source heterogeneous data, and transform unstructured or semi-structured information into structured knowledge, has become a crucial technical challenge in the field of knowledge extraction and information analysis. With the continuous growth of various public texts, special reports, indicator data, and other multi-source information, relying on manual or semi-manual methods is no longer sufficient to extract relevant knowledge in a timely and comprehensive manner. Therefore, how to automatically extract structured knowledge centered on entities, entity attributes, and relationships from multi-source heterogeneous data has become a key technology for improving information processing efficiency and knowledge utilization capabilities.

[0003] In terms of knowledge extraction implementation, existing technologies mostly use deep neural networks to encode text sequences and output entities and their relationships through downstream tasks such as sequence labeling and relation classification. For situations with insufficient labeled data, transfer learning or domain adaptation techniques are typically introduced to transfer representation capabilities learned in a relatively well-labeled source domain to a target domain with scarce labeling. These methods can achieve certain results in scenarios where the source and target domains are relatively similar in distribution and the temporal characteristics of the data are relatively simple.

[0004] However, security situation data exhibits a complexity distinct from general text: on the one hand, the evolution scales of its situation patterns vary significantly over time, with short-term rapid change patterns and long-term slow change patterns often intertwined within the same batch of data; on the other hand, available labeled samples in the target domain are extremely scarce, and the data distribution between different target subdomains exhibits significant shifts. When these factors are coupled together, encoding networks using fixed processing methods struggle to simultaneously accommodate situation patterns across different time scales, and transfer methods that only perform overall distribution alignment are prone to degradation during cross-domain processes, ultimately leading to significantly insufficient accuracy and stability of the extraction results.

[0005] In view of the above, this application is hereby submitted. Summary of the Invention

[0006] This invention discloses a cross-domain knowledge extraction method and apparatus based on adaptive segmented convolution and domain adversarial approaches, aiming to solve the technical problem of difficulty in extracting structured security situation knowledge stably and accurately from multi-source heterogeneous security situation data when annotations are scarce and time scales vary greatly.

[0007] The first embodiment of the present invention provides a cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial approaches, including: Acquire multi-source security situation data and preprocess it to form a security situation input sequence; The input sequence is input into an adaptive segmented convolutional neural network module as a feature extractor. This module outputs a segmentation strategy based on the temporal statistical characteristics of the input sequence and adaptively segments the input sequence into short-term feature extraction segments and long-term trend perception segments according to the segmentation strategy. Features are extracted using a first set of convolutional kernels and a second set of convolutional kernels, respectively. The length of the convolutional kernels is dynamically adjusted according to the local statistical characteristics of the input sequence. The features are then fused through a cross-segment feature interaction gating mechanism to obtain fused features. The feature extractor is a feature extractor pre-trained through two levels of domain adversarial transfer learning to align the feature distributions of the source domain and the target domain. The fused features are decoded to extract security situation entities and their relationships, generating a structured security situation knowledge base.

[0008] The second embodiment of the present invention provides a cross-domain knowledge extraction device based on adaptive segmented convolution and domain adversarial methods, comprising: The preprocessing module is used to acquire and preprocess multi-source security situation data to form a security situation input sequence; The fusion feature generation module is used to take the input sequence as an input to an adaptive segmented convolutional neural network module for feature extraction. This module outputs a segmentation strategy based on the temporal statistical characteristics of the input sequence, and adaptively segments the input sequence into short-term feature extraction segments and long-term trend perception segments according to the segmentation strategy. Features are extracted using a first set of convolutional kernels and a second set of convolutional kernels, respectively. The length of the convolutional kernels is dynamically adjusted according to the local statistical characteristics of the input sequence. The features are then fused through a cross-segment feature interaction gating mechanism to generate fused features. The feature extractor is a feature extractor pre-trained by two levels of domain adversarial transfer learning to align the feature distributions of the source domain and the target domain. The knowledge decoding module is used to decode the fused features, extract security situation entities and their relationships, and generate a structured security situation knowledge base.

[0009] The third embodiment of the present invention provides a cross-domain knowledge extraction device based on adaptive segmented convolution and domain adversarial methods, characterized in that it includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement the cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods as described in any of the above embodiments.

[0010] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that it stores a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement a cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial as described in any of the above claims.

[0011] Beneficial effects: As a feature extractor, the adaptive segmented convolutional neural network adaptively segments the input sequence into short-term feature extraction segments and long-term trend perception segments based on the temporal statistical characteristics. It dynamically adjusts the length of the convolutional kernel according to local statistical characteristics and then performs cross-segment gating fusion. This overcomes the shortcomings of fixed receptive field convolution, which cannot simultaneously characterize short-term rapid change burst patterns and long-term slow change trends. This allows for more complete extraction of situational features at different time evolution scales and reduces feature omissions.

[0012] The feature extractor used is pre-trained through two levels of domain adversarial transfer learning. It aligns the source and target domains at both the overall feature distribution and category-level semantic levels, effectively reducing the distribution drift between different security subdomains. This allows the representational capabilities learned in the well-annotated source domain to be transferred to the target domain where annotations are scarce. This reduces the dependence on the target domain's labeled data, reduces the amount of data required for cross-domain retraining, and alleviates the negative transfer caused by simply aligning the overall domain or simply stacking discriminators.

[0013] By combining adaptive multi-scale feature extraction with two-level domain alignment transfer capabilities, this invention can still stably and accurately extract security situation entities and their relationships and generate a structured knowledge base even under conditions where target domain annotations are scarce and data time scale differences and distribution offsets coexist. This improves the stability and accuracy of knowledge extraction in heterogeneous data environments, reduces the false recognition rate, and provides more reliable structured knowledge support for security situation awareness and decision analysis. Attached Figure Description

[0014] Figure 1 This is a flowchart illustrating a cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial approaches provided in the first embodiment of the present invention. Figure 2 This is a schematic diagram of a cross-domain knowledge extraction device based on adaptive segmented convolution and domain adversarial techniques, provided in the second embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] To better understand the technical solution of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0017] This invention discloses a cross-domain knowledge extraction method and apparatus based on adaptive segmented convolution and domain adversarial approaches, aiming to solve the technical problem of difficulty in extracting structured security situation knowledge stably and accurately from multi-source heterogeneous security situation data when annotations are scarce and time scales vary greatly.

[0018] Please see Figure 1 The first embodiment of the present invention provides a cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods, which can be executed by an extraction device (hereinafter referred to as a system), specifically by one or more processors within the extraction device, to at least implement the following steps: S101: Acquire multi-source security situation data and preprocess it to form a security situation input sequence; First, multi-source security posture data is acquired. This security posture data can originate from different business domains and data channels, such as publicly available explanatory texts, event reports, statistical data, and special analysis reports. Based on the data organization, the acquired data includes structured data, semi-structured data, and unstructured data. Structured data includes statistical indicator data and object parameter data; semi-structured data includes special reports and business documents; and unstructured data includes publicly available text, commentary text, and image description text. There is significant heterogeneity among the data sources. In one specific embodiment, a fully labeled source domain event dataset is selected as the source domain, and a poorly labeled target domain dataset is selected as the target domain. This allows for the transfer of representational capabilities learned from the source domain to the poorly labeled target domain in subsequent two-level domain adversarial transfer learning.

[0019] After acquiring the raw data, it undergoes preprocessing, which includes data deduplication and cleaning, time representation standardization, security-specific terminology segmentation and entity boundary adjustment, and alignment of multi-source heterogeneous data. Specifically, data cleaning removes irrelevant advertisements, HTML tags, and illegal characters; data deduplication uses the SimHash algorithm to identify and eliminate nearly duplicate documents to avoid bias in subsequent training due to duplicate samples; time representation standardization unifies time representations from different sources and with different writing styles into a standard time format (e.g., ISO 8601), thereby eliminating ambiguity in time representation and providing a consistent time benchmark for subsequent adaptive segmentation and cross-data source alignment.

[0020] Regarding specialized terminology segmentation and entity boundary adjustment, multi-granularity word segmentation is performed on the text using a security domain terminology dictionary to complete word segmentation and phrase block recognition. Based on the security domain terminology dictionary, the boundaries of composite entity candidates in the segmentation results are merged and corrected. For example, incorrectly segmented multi-character composite entities (organization names, object models, regional level names, etc.) are merged into complete entity candidates, or candidates with out-of-bounds boundaries are corrected by backtracking. This provides accurate entity candidate boundaries for subsequent decoding before entity extraction. To address the uncertainty in regional representation in security situation data, a fuzzy matching strategy based on a regional level knowledge base can be adopted to map fuzzy expressions such as "a certain region" to representative identifiers of their respective regional levels, thereby reducing the impact of regional ambiguity on subsequent extraction.

[0021] In terms of aligning multi-source heterogeneous data, the structured, semi-structured, and unstructured data are encoded into corresponding feature representations. For textual data, word segmentation encoding using a BERT-series two-layer Transformer is used to obtain vector embeddings. Then, features from different data sources are mapped to a unified feature embedding space according to unified time and event identifiers, thereby eliminating the heterogeneity of data from different sources and with different organizational forms in the representation space. Based on this, source domain security posture input sequences and target domain security posture input sequences are formed respectively. Thus, step S1 completes the transformation from multi-source heterogeneous raw data to security posture input sequences in a unified embedding space. The source domain security posture input sequence is used for subsequent pre-training of the feature extractor, while the target domain security posture input sequence is used to extract structured security posture knowledge in subsequent steps.

[0022] S102, the input sequence is input as an adaptive segmented convolutional neural network module for feature extraction. This module outputs a segmentation strategy based on the temporal statistical characteristics of the input sequence, and adaptively segments the input sequence into short-term feature extraction segments and long-term trend perception segments according to the segmentation strategy. Features are extracted using a first set of convolutional kernels and a second set of convolutional kernels, respectively. The length of the convolutional kernels is dynamically adjusted according to the local statistical characteristics of the input sequence. The features are then fused through a cross-segment feature interaction gating mechanism to obtain fused features. The feature extractor is a feature extractor pre-trained by two levels of domain adversarial transfer learning to align the feature distributions of the source domain and the target domain. An adaptive segmented convolutional neural network module, using the security situation input sequence as a feature extractor, performs feature extraction. A temporal pattern detection subnetwork is embedded at the front end of its encoding layer. This subnetwork takes the multi-scale sliding window statistics of the input sequence as input, such as the sliding window size. The values ​​are 5, 7, and 11 respectively. The statistics include local extremum density, standard deviation of slope change, and autocorrelation coefficient decay rate, based on which a segmentation strategy is output. The segmentation strategy can be represented as a segmentation strategy tuple (seg_len_short, seg_len_long, switch_point), where seg_len_short and seg_len_long represent the unit lengths of the short-term and long-term segments, respectively, and switch_point represents the switching position between the two types of segments. This segmentation strategy tuple performs end-to-end optimization with the global loss of the training data as the target. According to the segmentation strategy, this module adaptively segments the input sequence in the time dimension into short-term feature extraction segments and long-term trend perception segments. The short-term feature extraction segments focus on shorter time step granularity intervals (e.g., 1 to 7 time steps), while the long-term trend perception segments focus on longer time step granularity intervals (e.g., 8 to 50 time steps).

[0023] For short-term feature extraction segments, a first set of convolutional kernels is used to extract fine-grained semantic features, while for long-term trend perception segments, a second set of convolutional kernels is used to capture macro-trend features, thus obtaining two differentiated segment features. Furthermore, the kernel lengths of the first and second sets of convolutional kernels are dynamically adjusted based on the local statistical characteristics of the input sequence. Specifically, let the length of the input feature sequence for a certain segment be... The initial kernel length of the kernel set corresponding to this segment is an odd number. The kernel length is then determined using the following formula. :

[0024] In the formula, The reference sequence length can be obtained from the statistics of the segmentation strategy tuples. For learnable scaling factor, This is the output value of the local volatility evaluation function for the input sequence. In one specific embodiment, the short-term segment is taken as the initial convolutional kernel length. Reference sequence length ,Right now:

[0025] Take the initial convolution kernel length for long-term segments To ensure that the convolution kernel length is a positive odd integer, the value calculated according to the above formula will be used. After rounding and adjusting to a nearest odd number not less than a preset lower limit, the kernel length for the corresponding segment is used. In implementation, several candidate convolutional branches with different odd-numbered kernel lengths can be pre-constructed; for example, candidate branches with lengths of 3 and 5 can be set for short-term segments, and candidate branches with lengths of 5, 7, and 9 can be set for long-term segments. Then, based on the calculated... By selecting the candidate convolution branch with the shortest length distance for convolution, dynamic adjustment of the convolution kernel length can be achieved in a stable and implementable manner.

[0026] The local volatility evaluation function takes the local extremum density, slope variation standard deviation, and autocorrelation coefficient decay rate of the input sequence within a sliding window as input, and outputs a value range of [value missing] after nonlinear mapping. Volatility measure By utilizing the aforementioned adjustment mechanism and in conjunction with a learnable coefficient... The receptive field of the convolutional kernel can adaptively match the time scale distribution of data in different security domains. For example, for short-period rapidly changing data, the local volatility is large and the values ​​are large, so the corresponding segments tend to use smaller convolutional kernels to capture fine-grained changes; for long-period slowly changing data, the local volatility is small and the values ​​are small, so the corresponding segments tend to use larger convolutional kernels to capture long-term trend features.

[0027] After obtaining the features of the short-term and long-term segments separately, the features are fused using a cross-segment feature interaction gating mechanism to obtain the fused features. Specifically, a learnable cross-segment feature interaction weight matrix is ​​defined. The output feature map of the short-term feature extraction segment. obtained through upsampling This makes it consistent with the output feature map of the long-term trend perception segment. Alignment is performed at scale, and then the fused features are calculated using the following formula via a gating unit. :

[0028]

[0029] In the formula, The gating coefficient, It is the Sigmoid activation function. This indicates element-wise multiplication. This represents the concatenation along the feature channel dimension. This fusion mechanism, on the one hand, injects short-term detailed features into the long-term trend representation to enrich its dynamic details; on the other hand, it utilizes long-term context to provide global semantic constraints for short-term features, overcoming the unidirectional information bottleneck of traditional pyramid convolutional networks, thereby significantly improving the model's collaborative representation of short-term events and long-term strategic situations. The resulting fused features are the output of the feature extractor, used for decoding in subsequent steps, and serve as the basis for feature alignment in the two-level domain adversarial transfer learning pre-training.

[0030] S103, decode the fused features, extract security situation entities and their relationships, and generate a structured security situation knowledge base.

[0031] The fused features are decoded to extract security situation entities and their relationships, generating a structured security situation knowledge base. Since the feature extractor is pre-trained using two levels of domain adversarial transfer learning to align the feature distributions of the source and target domains, and the fused features are cross-domain aligned features, decoding the fused features corresponding to the target domain data allows for the extraction of high-quality security situation knowledge even under conditions of scarce target domain annotations.

[0032] In terms of entity extraction, the fused features are input into an entity recognition module, which can be composed of a linear classifier and a conditional random field (CRF) sequence labeling submodule connected in series: first, the linear classifier predicts entity boundaries at each time step; then, a CRF is connected in series to label the prediction results; and finally, the optimal entity label sequence is decoded using its state transition constraints, thereby identifying named entities related to security situation. In a specific embodiment, the size of the CRF transition matrix is... ,in The system is categorized into 21 types, including specialized type labels such as subject, organization, region, time, and object. The identified named entities can include subjects, organizations, objects, event types, regional locations, time windows, business units, and handling measures.

[0033] In terms of relation extraction, the identified entities and their contexts are input into the relation extraction module. This module can employ a multi-head interactive attention module, using entities as nodes and text context as edge weight matrices to model the semantic relationships between entities and output the predicted relationships between entities. In one specific embodiment, the relation type set can cover multiple (e.g., 27) relation types, including at least one of collaborative relationships, competitive relationships, constraint relationships, business cooperation relationships, and support relationships.

[0034] Building upon this, the attribute completion submodule can further utilize an attention mechanism to inject multi-source heterogeneous contextual information into the extracted knowledge tuples, completing attributes for uncertainties in the time and ambiguous regions of the target event, thereby forming attributed knowledge tuples. Furthermore, the aforementioned entities, relations, and attributes are organized into a set of attributed security situation knowledge triples, where each attributed security situation knowledge triple includes a head entity, a relation type, a tail entity, and a set of attributes associated with the head entity, tail entity, or the relation type, which can be represented as:

[0035] Finally, the knowledge graph construction module aligns the above outputs with the existing neutral knowledge base, completes entity disambiguation, relationship fusion, and inconsistency information resolution, generates a structured security situation knowledge base, and forms a security situation knowledge graph that supports reasoning and analysis, providing systematic knowledge support for information analysis, trend prediction, and decision support.

[0036] To obtain the feature extractor pre-trained through two levels of domain adversarial transfer learning, aligning the feature distributions of the source and target domains, this embodiment performs the following domain adaptation training on the formed source and target domain security situation input sequences. Considering that domain adversarial methods that only perform global feature distribution alignment are difficult to correct category-level domain drift and prone to category confusion in cross-domain classification, this embodiment performs domain alignment simultaneously at both the feature and category levels, implemented by a first-level and a second-level domain discriminator, respectively.

[0037] The first-level domain discriminator is located in the intermediate hidden layer of the adaptive segmented convolutional neural network module, using the intermediate layer features output by the feature extractor. The input is passed through a gradient inversion layer and connected to the feature extractor; the gradient strength parameters of the gradient inversion layer are... During the initial training phase, the value is gradually increased from 0 to a preset maximum value. (Taking values ​​from 0.5 to 2.0) to guide the feature extractor to implicitly align the source and target domains at the feature distribution level. The adversarial objective of the first-level neighborhood discriminator is:

[0038] In the formula, , The data distributions for the source and target domains are respectively. This is the first-level domain discriminator; during training, the first-level domain discriminator is maximized. The feature extractor, via the gradient inversion layer, makes... The direction of the update is reduced, thereby suppressing the overall feature distribution drift between the source and target domains.

[0039] The second-level domain discriminator is located in the high-level semantic feature layer of the feature extractor, using the category prototype vectors of each category as anchor points for domain alignment. For each category... Second-level domain discriminator The input is the residual vector of the high-level semantic features relative to the prototype vector of that category:

[0040] In the formula, For the sample The high-level semantic features output by the feature extractor For category The category prototype vector. The second-level domain discriminator is trained adversarially with the goal of ensuring that the residual vectors of samples belonging to the same category in the source and target domains are distributed in the same way. Its adversarial objective is:

[0041] In the formula, For the first in the source domain Class sample set, The pseudo-label in the target domain is the first A sample set of classes This serves as the second-level domain discriminator. The introduction of the second-level domain discriminator allows the feature extractor to focus not only on the alignment of the global domain distribution but also on the semantic invariance of each specific category across domains, thereby improving the classification accuracy across safe subdomains.

[0042] Due to the category prototype vector Since direct calculation is impossible without labeling in the target domain, this embodiment employs an iterative bootstrapping mechanism to gradually approximate the true category prototype of the target domain without any labeling. First, a cold start is performed on the source domain prototype, using labeled data from the source domain for each category. Initialize the category prototype vector:

[0043] In the formula, For categories in the source domain The initial prototype, serving as an anchor point for subsequent bootstrapping, provides an initial reference for cross-domain alignment, even if it deviates from the true class center of the target domain. Subsequently, target domain pseudo-labels are generated and confidence is selected: in each iteration, the current feature extractor and an additional classifier jointly trained with the entire model are used. For each unlabeled sample in the target domain Predict the category probability distribution, and take the category with the highest probability as the pseudo-label, and the highest probability value as the confidence score:

[0044]

[0045] Preserving confidence level Not less than the preset threshold The samples constitute the high-confidence target domain sample set for each category. Then, dynamic updates of the target domain prototype and smoothing of source domain migration are performed: first, the observed prototype of the target domain in the current round is calculated using high-confidence samples:

[0046] To prevent early pseudo-labeling errors from causing drastic prototype drift, an exponential moving average method is used to update the category prototype vectors.

[0047] In the formula, The prototype vector from the previous round, The momentum coefficient is set to a value between 0.7 and 0.95. When a certain category does not have any target domain samples that meet the confidence threshold in the current round, the prototype vector of that category remains unchanged. The above pseudo-label generation, observation prototype calculation, and prototype vector update are alternately iterated with the adversarial training of the first-level and second-level domain discriminators to form a complete bootstrapping loop until the change in prototype vector between two adjacent rounds is less than the preset threshold.

[0048] To address the competitive coupling between the first-level domain discriminator (coarse-grained global domain alignment) and the second-level domain discriminator (fine-grained category-level domain alignment), this embodiment further designs a federated routing scheduling mechanism to achieve dynamic weight allocation between the two discriminators. If the first-level domain discriminator is too strong, the feature extractor may excessively pursue global domain invariance at the expense of category discrimination information, leading to overlap of samples from different categories in the feature space, i.e., category-level pattern collapse. If the second-level domain discriminator is too strong, the feature extractor may excessively focus on intra-category cross-domain alignment, forcibly compressing source and target domain samples of the same category into an excessively small feature region, resulting in blurred boundaries between different categories and amplified pseudo-label noise, i.e., discriminative overfitting pattern collapse. Traditional adversarial domain adaptation uses a single-level discriminator or fixed multi-level weights, which cannot adapt to dynamically changing domain differences during training, making it easy for the feature extractor to be defeated by a certain discriminator or fall into oscillation. Therefore, the federated routing scheduling mechanism uses the discrimination accuracy of the first-level domain discriminator in distinguishing between the source and target domains. And the discrimination accuracy of the second-level neighborhood discriminator in distinguishing between the source and target domains. As a feedback signal, the first-level adversarial loss weight is dynamically allocated according to the following formula. Loss weights against level two :

[0049]

[0050]

[0051] In the formula, This serves as the baseline weight. This forms a closed-loop adjustment: when the first-level discrimination accuracy... An increase indicates that its global alignment capability is too strong, which can easily lead to category-level pattern collapse. Consequently, it decreases, making Reduce Increase the level of adversarial gradient, thereby automatically weakening the excessively strong first-level adversarial gradient and strengthening the second-level adversarial gradient; conversely, when the second-level discrimination accuracy decreases... When the level increases, the algorithm adjusts in the opposite direction, weakening the second level and strengthening the first level, so that the difficulty of the two-level adversarial task faced by the feature extractor tends to be balanced, avoiding excessive suppression or complete deception by one level of discriminator. Based on this, gradient coordination decoupling can be used to project the gradients back to the feature extractor from the two-level adversarial loss to eliminate their conflicting direction components, preventing the feature extractor from oscillating between contradictory optimization objectives and ensuring the stability of the convergence path. Furthermore, through active collapse detection and recovery, when feature space collapse is detected (such as a significant decrease in effective feature rank) or spurious balance is detected, the algorithm automatically rolls back to the previous stable state and adjusts the training hyperparameters, providing fault tolerance. After adopting the above federated routing scheduling, the discrimination accuracy curves of the two-level discriminators can fluctuate slightly around 0.5, and the effective rank of the feature space remains stable, indicating that mode collapse is effectively suppressed.

[0052] In terms of training implementation, an alternating adversarial optimization strategy is adopted. Each iteration includes two sub-processes: First, the feature extractor is fixed, and the first-level and second-level domain discriminators are updated respectively, so that they are maximized. and Secondly, by fixing the first-level and second-level neighborhood discriminators, the gradient inversion layer is used to... and The joint adversarial gradient is backpropagated to the feature extractor, causing the feature extractor to be updated in the direction that reduces the joint adversarial target. These two sub-processes alternate with the iterative bootstrapping of the aforementioned class prototype vectors until convergence, ultimately yielding a feature extractor pre-trained through two levels of domain adversarial transfer learning, aligning the feature distributions of the source and target domains. This feature extractor is used in step S102 to extract features from the input sequence, and in step S103, it is decoded to extract structured security situation knowledge. Please see Figure 2 The second embodiment of the present invention provides a cross-domain knowledge extraction device based on adaptive segmented convolution and domain adversarial methods, comprising: Preprocessing module 201 is used to acquire multi-source security situation data and perform preprocessing to form a security situation input sequence; The fusion feature generation module 202 is used to take the input sequence as an input to an adaptive segmented convolutional neural network module for feature extraction. This module outputs a segmentation strategy based on the temporal statistical characteristics of the input sequence, and adaptively segments the input sequence into short-term feature extraction segments and long-term trend perception segments according to the segmentation strategy. Features are extracted using a first set of convolutional kernels and a second set of convolutional kernels, respectively. The length of the convolutional kernels is dynamically adjusted according to the local statistical characteristics of the input sequence. The features are then fused through a cross-segment feature interaction gating mechanism to generate fused features. The feature extractor is a feature extractor pre-trained by two levels of domain adversarial transfer learning to align the feature distributions of the source domain and the target domain. The knowledge decoding module 203 is used to decode the fused features, extract security situation entities and their relationships, and generate a structured security situation knowledge base.

[0053] The third embodiment of the present invention provides a cross-domain knowledge extraction device based on adaptive segmented convolution and domain adversarial methods, characterized in that it includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement the cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods as described in any of the above embodiments.

[0054] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that it stores a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement a cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial as described in any of the above claims.

[0055] Exemplary examples show that the computer program described in the third and fourth embodiments of the present invention can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in implementing a cross-domain knowledge extraction device based on adaptive segmented convolution and domain adversarial mechanisms. For example, the apparatus described in the second embodiment of the present invention.

[0056] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the aforementioned cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial mechanisms, connecting various parts of the method through various interfaces and lines.

[0057] The memory can be used to store the computer program and / or modules. The processor, by running or executing the computer program and / or modules stored in the memory, and by calling the data stored in the memory, implements various functions of a cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, text conversion function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, text message data, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0058] If the implemented module is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0059] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0060] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial approaches, characterized in that, include: Acquire multi-source security situation data and preprocess it to form a security situation input sequence; The input sequence is input into an adaptive segmented convolutional neural network module as a feature extractor. This module outputs a segmentation strategy based on the temporal statistical characteristics of the input sequence and adaptively segments the input sequence into short-term feature extraction segments and long-term trend perception segments according to the segmentation strategy. Features are extracted using a first set of convolutional kernels and a second set of convolutional kernels, respectively. The length of the convolutional kernels is dynamically adjusted according to the local statistical characteristics of the input sequence. The features are then fused through a cross-segment feature interaction gating mechanism to obtain fused features. The feature extractor is a feature extractor that has been pre-trained by two levels of domain adversarial transfer learning to align the feature distributions of the source domain and the target domain. The fused features are decoded to extract security situation entities and their relationships, generating a structured security situation knowledge base.

2. The cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods according to claim 1, characterized in that, The feature extractor is obtained through two-level domain adversarial transfer learning pre-training, including: The security situation input sequences of the source domain and the target domain are respectively input into the feature extractor to obtain fused features. The first-level domain discriminator uses the intermediate layer features of the feature extractor as input to perform feature-level domain alignment. The second-level domain discriminator uses the high-level semantic features of the feature extractor and the residual vector of the category prototype vector as input to perform category-level domain alignment. The first-level domain discriminator and the second-level domain discriminator are trained collaboratively through a federated routing scheduling mechanism to align the feature distributions of the source domain and the target domain output by the feature extractor.

3. The cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial approaches according to claim 1, characterized in that, The convolution kernel length is dynamically adjusted based on the local statistical properties of the input sequence, wherein the convolution kernel length... Determine by the following formula: In the formula, The initial convolution kernel length, Input the length of the feature sequence for the current segment. For the reference sequence length, The output value of the local volatility evaluation function of the input sequence is... The learnable scaling factor; After being rounded and adjusted to a nearest odd number not less than a preset lower limit, it is used as the convolution kernel length for the corresponding segment.

4. The cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods according to claim 3, characterized in that, The local volatility evaluation function takes the local extremum density, slope change standard deviation, and autocorrelation coefficient decay rate of the input sequence within a sliding window as input, and outputs a value range after nonlinear mapping. Volatility measure .

5. The cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial approaches according to claim 1, characterized in that, The fusion feature The cross-segment feature interaction gating mechanism is obtained as follows: In the formula, This is the output feature map for the long-term trend perception segment. The output feature map of the short-term feature extraction segment is upsampled and compared with... Aligned feature maps The gating coefficient, A learnable cross-segment feature interaction weight matrix. This indicates splicing along the feature channel dimension. It is the Sigmoid activation function. This is element-wise multiplication.

6. The cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial analysis as described in claim 2, characterized in that, The input residual vector of the second-level neighborhood discriminator is determined by the following formula: In the formula, For the sample The high-level semantic features output by the feature extractor For category The category prototype vector; the second-level domain discriminator is trained adversarially with the goal of ensuring that the residual vectors of samples of the same category in the source domain and the target domain are consistent in distribution.

7. The cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods according to claim 6, characterized in that, The category prototype vector is determined through iterative bootstrapping under the condition that the target domain is unlabeled: The prototype vectors of corresponding categories are initialized with the mean of the high-level semantic features of each category of samples in the labeled data of the source domain, serving as the initial values ​​for iteration. In each iteration, the probability distribution of each category of unlabeled samples in the target domain is predicted by the current feature extractor and the additional classifier. The category corresponding to the highest probability is taken as the pseudo-label, and the highest probability value is taken as the confidence score. The confidence score is not less than a preset threshold. The mean of the high-level semantic features of the samples is used as the target domain observation prototype for this category. And update the prototype vector using an exponential moving average: In the formula, The prototype vector from the previous round, The momentum coefficient is set to a value of 0.7 to 0.95; the pseudo-label generation, target domain observation prototype calculation and prototype vector update, and the adversarial training of the two-level domain adversarial transfer learning are alternately iterated until the change in prototype vector between two adjacent rounds is less than a preset threshold.

8. The cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial analysis as described in claim 2, characterized in that, The federated routing scheduling mechanism uses a first-level domain discriminator to distinguish the source and destination domains with high precision. The discrimination accuracy of the first and second level neighborhood discriminators in distinguishing between the source and target domains. As a feedback signal, the first-level adversarial loss weight is dynamically allocated according to the following formula. Second-level adversarial loss weight : ; In the formula, The baseline weight.

9. A cross-domain knowledge extraction method based on adaptive segmented convolution and domain adversarial methods according to claim 6, characterized in that, The first-level neighborhood discriminator is connected to the feature extractor via a gradient inversion layer, wherein the gradient strength parameter of the gradient inversion layer is... During training, the value is gradually increased from 0 to a preset maximum value, which ranges from 0.5 to 2.

0. During training, the first-level neighborhood discriminator maximizes the target value. The second-level neighborhood discriminator maximizes the target. The feature extractor passes through the gradient inversion layer along... and The direction of decrease is updated, where: In the formula, For the sample The intermediate layer features output by the feature extractor , The data distributions for the source and target domains are respectively. , These are the first-level and second-level neighborhood discriminators, respectively. For the first in the source domain Class sample set, The pseudo-label in the target domain is the first A sample set of classes.

10. A cross-domain knowledge extraction device based on adaptive segmented convolution and domain adversarial mechanisms, characterized in that, include: The preprocessing module is used to acquire and preprocess multi-source security situation data to form a security situation input sequence; The fusion feature generation module is used to take the input sequence as an input to the adaptive segmented convolutional neural network module as a feature extractor. This module outputs a segmentation strategy based on the temporal statistical characteristics of the input sequence, and adaptively segments the input sequence into short-term feature extraction segments and long-term trend perception segments according to the segmentation strategy. Features are extracted using a first set of convolutional kernels and a second set of convolutional kernels, respectively. The length of the convolutional kernels is dynamically adjusted according to the local statistical characteristics of the input sequence. The features are then fused through a cross-segment feature interaction gating mechanism to generate fused features. The feature extractor is a feature extractor that has been pre-trained by two levels of domain adversarial transfer learning to align the feature distributions of the source domain and the target domain. The knowledge decoding module is used to decode the fused features, extract security situation entities and their relationships, and generate a structured security situation knowledge base.

Images