Deep Learning Relational Triple Extraction for Network Threat Intelligence
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network security defense policies struggle to cope with complex and changing network attacks due to lack of active defense capabilities, reliance on known vulnerability databases, long response times, and insufficient intelligentization and individuation of defense policies.
Innovation Solution
A network threat intelligence relational triple combined extraction method based on deep learning is proposed, which uses a combined extraction method for entities and relations, employs a span-based method to address overlapping entities, and incorporates a BERT large-scale pre-training model for text vector representation, along with a multimodal information perception embedding mechanism to enhance interaction between different modal information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a streamline mode is used to perform entity extraction and relation extraction independently, then the extraction process is simpler, but the interaction between entity and relation extraction tasks is lost
Solution Approach 1:
The patent combines entity extraction and relation extraction into a single unified model that processes both tasks simultaneously. The model shares embedding layers and attention mechanisms between entity and relation extraction modules, enabling interactive learning where entity representations inform relation extraction and vice versa, thereby improving overall extraction accuracy while maintaining reasonable complexity.
2Productivity
If conventional extraction methods are used, then the processing is faster, but the ability to handle overlapping entities and fine-grained features is insufficient
Solution Approach 1:
The patent introduces a span-based extraction dimension that operates alongside traditional token-based methods. By representing entities as spans with start and end positions and incorporating span-level attention mechanisms, the model can effectively handle overlapping entities and extract fine-grained features while maintaining efficient processing through parallel computation of span representations.
3Loss of information
If BERT large-scale pre-training model is used for text vector representation, then semantic expression is extremely enriched, but the model complexity increases
Solution Approach 1:
The patent segments the BERT model into specialized components: a shared embedding layer that processes both entity and relation tokens, separate attention mechanisms for entity extraction and relation extraction, and dedicated pooling operations. This segmentation allows the model to leverage BERT's rich semantic representations while reducing overall complexity through parameter sharing and modular architecture.
4Measurement precision
If various modal information is fused to enhance interaction, then the identification accuracy improves, but the processing complexity increases
Solution Approach 1:
The patent implements a multi-functional attention mechanism that simultaneously processes multiple modalities including entity embeddings, relation embeddings, span features, and contextual representations. This universal attention module performs multiple functions (entity scoring, relation scoring, span validation) within a single computational framework, improving identification accuracy while controlling complexity through unified processing.
Data Source
AI summary
A network threat intelligence relational triple combined extraction method based on deep learning includes: (a) an entity and a relation are both extracted by using a combined extraction method, which solves the problem of a lack of interaction between entity and relation extraction tasks; (b) a problem of entity overlapping is solved by using a method based on a span; (c) a BERT large-scale pre-training model is used for vector representation of a text; and because the pre-training model includes contextual information learned from a large-scale corpus, semantic expression on a threat intelligence text by the model can be extremely enriched; and (d) various modal information, for example, time sequences, dependency relations, the spans, labels, and the like, is fused to enhance the interaction between multimodal information.