Text data-oriented threat intelligence knowledge graph construction method

Abstract

The invention relates to a text data-oriented threat intelligence knowledge graph construction method. The functions of automatically extracting the key information from the text threat intelligence data and constructing the threat intelligence knowledge graph are realized. The invention provides a threat intelligence knowledge graph construction method for text data. The method comprises the following steps: defining an ontology structure in the threat intelligence field; using a threat intelligence named entity recognition model based on multiple factors and a threat intelligence entity relation extraction model based on a graph neural network to obtain threat intelligence entities and relation triples from text data, and finally storing information through a graph database to form a threat intelligence knowledge graph.

Description

technical field [0001] The present invention designs a text data-oriented threat intelligence knowledge map construction system, which extracts threat intelligence entities and relationship triplets in text data through a multi-factor-based threat intelligence named entity recognition model and a graph neural network-based threat intelligence relationship extraction model Groups constitute a threat intelligence knowledge map. It aims to automatically and accurately extract named entities of threat intelligence from a large amount of threat text intelligence, extract threat intelligence entities and relationships to form triples, and generate threat intelligence knowledge graphs. Background technique [0002] With the expansion of Internet applications, a large number of businesses of various government and enterprise units need to be directly connected to the Internet to work. However, the network security situation is still severe, and network attacks occur frequently, thre...

AI Technical Summary

Problems solved by technology

[0007] (1) In view of the high content complexity and difficulty in implementation of the mainstream threat intelligence format, how to design a knowledge map suitable for the threat intelligence field based on the existing information security field ontology and threat intelligence standards, combined with threat intelligence text statistics ontology structure

[0008] (2) Aiming at the problem that the common domain entity recognition model has poor recognition effect on terms in the threat intelligence field, how to design a model that can have a better recognition effect on different types of threat intelligence named entities

Images