Network threat intelligence text key information extraction method based on weak supervised learning

Abstract

The invention discloses a network threat intelligence text key information extraction method based on weak supervised learning, and the method comprises the steps: converting information extraction into a feature data space mapping task, combining a knowledge representation learning method, adopting an attention mechanism based on a local sequence, and utilizing a text theme label to extract key information of a network threat intelligence text; key information extraction of a weak supervised learning text is realized, the quality of the extracted information is verified by using a manual evaluation and confidence evaluation mode, and the information is ensured to be real, reliable and credible. The method comprises the following steps: training a more accurate, comparative and basis key information extraction model for a text, and hoping that the key information formed by the extraction model can reflect the actual semantic value of a sequence tag rationally; through a weak supervised learning strategy and two evaluation methods defined by the method, through end-to-end network training, the complexity and time cost of information extraction are reduced, and the accuracy and recall rate of key information extracted by the method in label classification are improved.

Description

technical field [0001] The invention relates to the technical fields of natural language processing and cyberspace security, in particular to a method for extracting key information of network threat intelligence texts based on weakly supervised learning. Background technique [0002] Cyber ​​Threat Intelligence (CTI), as the main information carrier of shared event information attack methods, is recommended by most security analysis resource sharing platforms, providing the necessary technology for the restoration of most similar attack event scenarios and the tracking of attacking organizations The background, attack process reference, and attack method analysis have become the current mainstream data sources for network threat event analysis. The analysis project of threat intelligence is mainly to understand the logic of multimedia data such as the text of threat intelligence collected from various channels, connect the plot process of events in series, and supplement th...

AI Technical Summary

Problems solved by technology

But it is precisely because of this high-dimensional abstract nature that it is difficult for classification methods to quantitatively analyze text content like entity extraction to obtain quantitative and qualitative descriptions of higher abstract entities.

Although some scholars have carried out clustering based on lexical correlation methods and similar lexical reasoning for entity recognition, such as Linear Discriminant Analysis (LDA), these methods cannot effectively evaluate the boundaries of similar lexical data, or form more abstract conceptual entity settlement

Images