基于MRC的威胁情报实体识别方法研究

doi:10.3969/j.issn.1671-1122.2021.10.011

信息网络安全 ›› 2021, Vol. 21 ›› Issue (10): 76-82.doi: 10.3969/j.issn.1671-1122.2021.10.011

基于MRC的威胁情报实体识别方法研究

程顺航, 李志华()

江南大学人工智能与计算机学院,无锡 214122

收稿日期:2021-04-13 出版日期:2021-10-10 发布日期:2021-10-14
通讯作者: 李志华 E-mail:jswxzhli@aliyun.com
作者简介:程顺航（1998—）,男,湖北,硕士研究生,主要研究方向为自然语言处理、信息安全|李志华（1969—）,男,湖南,副教授,博士,主要研究方向为云计算、信息安全
基金资助:
国家自然科学基金(60704047);工业和信息化部智能制造项目(ZH-XZ-180004);中央高校基本科研业务费专项资金(JUSRP211A41);中央高校基本科研业务费专项资金(JUSRP42003);111基地建设项目(B2018)

Research on Threat Intelligence Entity Recognition Method Based on MRC

CHENG Shunhang, LI Zhihua()

School of Artificial Intelligence and Computer, Jiangnan University, Wuxi 214122, China

Received:2021-04-13 Online:2021-10-10 Published:2021-10-14
Contact: LI Zhihua E-mail:jswxzhli@aliyun.com

摘要/Abstract

摘要：

在威胁情报实体抽取领域,由于网络数据源结构复杂、无关信息多,且威胁情报实体具有专业性强、分类模糊等特点,传统实体识别方法对于威胁情报挖掘的效率不高。针对此问题,文章通过将实体识别转化为机器阅读理解的方式,提出一种融入专业知识的MRC指针标注模型（Threat Intelligence Machine Reading Comprehension,TIMRC）,该模型能够为每个实体问题找到对应的开始和结尾索引。基于此,文章进一步构造了一种威胁情报实体识别（Threat Intelligence Entity Identification,TIEI）方法,通过对978篇安全类文章进行实验验证,证明了TIEI方法的有效性及高效的实体挖掘能力。

关键词: 威胁情报, 实体识别, 机器阅读理解

Abstract:

In the field of threat intelligence entity extraction, due to the complex structure of network data sources, more irrelevant information, and the strong professional and fuzzy classification of threat intelligence entities, the efficiency of traditional entity recognition methods for threat intelligence mining is not high. To solve this problem, this paper put forward a kind of MRC pointer annotation model(TIMRC) by transforming entity recognition into machine reading comprehension. The model could find the corresponding beginning and end index for each entity problem. Based on this, a threat intelligence entity identification(TIEI) method was further constructed. Experiments on 978 security articles show that TIEI method is effective and efficient in entity mining.

Key words: threat intelligence, entity recognition, machine reading comprehension

中图分类号:

TP309

程顺航, 李志华. 基于MRC的威胁情报实体识别方法研究[J]. 信息网络安全, 2021, 21(10): 76-82.

CHENG Shunhang, LI Zhihua. Research on Threat Intelligence Entity Recognition Method Based on MRC[J]. Netinfo Security, 2021, 21(10): 76-82.

图/表 9

图1

图2

表1

图3

表2

表3

表4

图4

图5

参考文献 16

[1]	LAFFERTY J, MCCALLUM A, PEREIRA F. Conditional Random Fields: Probabilistic Models for Segmenting and Labeling Sequence Data [C]//ACM. 18th International Conference on Machine Learning, June 1-28, 2001, San Prancisco, CA, USA. San Francisco: Margan Kaufmann, 2001: 282-289.
[2]	SUTTON C, MCCALLUM A, ROHANIMANESH K, et al. Dynamic Conditional Random Fields: Factorized Probabilistic Models for Labeling and Segmenting Sequence Data[J]. Journal of Machine Learning Research, 2007, 8(3):693-723.
[3]	HOCHREITER S, SCHMIDHUNER J. Long Short-term Memory[J]. Neural Computation, 1997, 9(8):1735-1780. doi: 10.1162/neco.1997.9.8.1735 URL
[4]	CHIU J, NICHOLS E. Named Entity Recognition with Bidirectional LSTM-CNNs[EB/OL]. https://arxiv.org/pdf/1511.08308.pdf, 2021-02-22.
[5]	VASWANI A, SHAZEER N, PARMAR N, et al. Attention Is All You Need [C]//ACM. 31st Internation Conference on Neural Information Processing Systems, December 4-9, 2017, Red Hook, NY, USA. New York: ACM, 2017: 6000-6010.
[6]	RADFORD A, NARASIMHAN K, SALIMANS T, et al. Improving Language Understanding by Generative Pre-training[EB/OL]. https://s3-us-west-2.amazonaws.com/openai-assets/research-covers/language-unsupervised/language_understanding_paper.pdf, 2018-11-19.
[7]	DEVLIN J, CHANG Mingwei, LEE K, et al. Bert: Pre-training of Deep Bidirectional Transformers for Language Understanding[EB/OL]. https://arxiv.org/abs/1810.04805, 2019-05-24.
[8]	LI Xiaoya, FENG Jingrong, MENG Yuxian, et al. A Unified MRC Framework for Named Entity Recognition[EB/OL]. https://arxiv.org/abs/1910.11476, 2020-05-23.
[9]	LIAO Xiaojing, YUAN Kan, WANG Xiaofeng, et al. Acing the IOC Game: Toward Automatic Discovery and Analysis of Open-source Cyber Threat Intelligence [C]//ACM. ACM SIGSAC Conference on Computer & Communications Security, October 24-28, 2016, Vienna, Austria. New York: ACM, 2016: 755-766.
[10]	LONG Zi, TAN Lianzhi, ZHOU Shengping, et al. Collecting Indicators of Compromise from Unstructured Text of Cybersecurity Articles using Neural-based Sequence Labelling [C]//IEEE. 2019 International Joint Conference on Neural Networks(IJCNN), July 14-19, 2019, Budapest, Hungary. New Jersey: IEEE, 2019: 1-8.
[11]	DIONÍSIO N, ALVES F, FERREIRA P M, et al. Cyberthreat Detection from Twitter Using Deep Neural Networks [C]//IEEE. 2019 International Joint Conference on Neural Networks(IJCNN), July 14-19, 2019, Budapest, Hungary. New Jersey: IEEE, 2019: 1-8.
[12]	QIN Ya, SHEN Guowei, ZHAO Wenbo, et al. A Network Security Entity Recognition Method based on Feature Template and Cnn-bilstm-crf[J]. Frontiersof Information Technology & Electronic Engineering, 2019, 20(6):872-884.
[13]	DASGUPTA S, PIPLAI A, KOTAL A, et al. A Comparative Study of Deep Learning Based Named Entity Recognition Algorithms for Cybersecurity [C]//IEEE. 2020 IEEE International Conference on Big Data(Big Data), December 10-13, 2020, Atlanta, GA, USA. New Jersey: IEEE, 2021: 2596-2604.
[14]	WANG Qinxin, YANG Wang. Extraction of Threat Intelligence Entities Based on STIX[J]. Cyberspace Security, 2020, 11(8):86-91.
	王沁心, 杨望. 基于STIX标准的威胁情报实体抽取研究[J]. 网络空间安全, 2020, 11(8):86-91.
[15]	WU Han, LI Xiaoyong, GAO Yali. An Effective Approach of Named Entity Recognition for Cyber Threat Intelligence [C]//IEEE. 4th Information Technology, Networking, Electronic and Automation Control Conference(IT-NEC), June 12-14, 2020, Chongqing, China. New Jersey: IEEE, 2020: 1370-1374.
[16]	MÉTAIS E, MEZIANE F, HORACEK H, et al. Natural Language Processing and Information Systems[M]. Cham: Springer Inter-national Publishing, 2020.

实体名	问题
Val	漏洞的编号或名称
Malware	恶意软件,如后门木马的名称
Attacker	黑客、间谍等攻击组织

参数名	值
Batch_size	16
Epoch num	20
Hidden_dim	1024
Fine tuning	True
Dropout rate	0.5
Learning rate	0.00001

类别	数据集
类别	训练集	验证集	测试集
句子数	1000	111	100
标签总数	1660	146	131
漏洞	233	26	23
恶意软件	899	81	77
攻击者	528	39	31

模型	结果
模型	准确率	召回率	F1值
BERT-CRF	0.858	0.791	0.823
BERT-BILSTM-CRF	0.889	0.838	0.863
BERTWWM-BILSTM-CRF	0.904	0.832	0.867
BERTWWM-MRC	0.868	0.896	0.881
BERTWWM-TIMRC	0.873	0.931	0.901

基于MRC的威胁情报实体识别方法研究

Research on Threat Intelligence Entity Recognition Method Based on MRC

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 16

相关文章 6

编辑推荐

Metrics

本文评价

[1]	丁家伟, 刘晓栋. 基于ELECTRA-CRF的电信网络诈骗案件文本命名实体识别模型[J]. 信息网络安全, 2021, 21(6): 63-69.
[2]	张永生, 王志, 武艺杰, 杜振华. 基于Conformal Prediction的威胁情报繁殖方法[J]. 信息网络安全, 2020, 20(6): 90-95.
[3]	王长杰, 李志华, 张叶. 一种针对恶意软件家族的威胁情报生成方法[J]. 信息网络安全, 2020, 20(12): 83-90.
[4]	GULKhanSafiQamas, 尹继泽, 潘丽敏, 罗森林. 基于深度神经网络的命名实体识别方法研究[J]. 信息网络安全, 2017, 17(10): 29-35.
[5]	管磊, 胡光俊, 王专. 基于大数据的网络安全态势感知技术研究[J]. 信息网络安全, 2016, 16(9): 45-50.
[6]	徐丽萍, 郝文江. 美国政企网络威胁情报现状及对我国的启示[J]. 信息网络安全, 2016, 16(9): 278-284.