Research On Key Technologies Of Network Security Knowledge Graph Construction

With the development of big data technology,the network environment is becoming more and more complex.The cyberspace contains a lot of valuable cyber threat intelligence data.How to dig out associations and attack patterns from fragmented and sea-quantized threat intelligence data is the focus of threat intelligence analysis research.Therefore,threat intelligence analysis based on the network security knowledge graph construction technology has become a research hotspot.Network security knowledge graph can be used to analyze and mine multi-source heterogeneous threat intelligence data with fine-grained depth correlation.The foundation of network security knowledge graph construction is information extraction.In this paper,we focuses on the network security entity recognition and the relationship extraction between entities in massive network security text data.Firstly,traditional named entity recognition method is difficult to identify new or mixed Chinese and English security entities in network security field,and the extracted features are not sufficient,so it is difficult to accurately identify network security entities.Aiming at this problem,in this paper,we propose a network security entity recognition method by using combination of CNN-BiLSTM-CRF model and feature template.The method firstly utilizes artificial feature template to extract local context features,and then uses CNN model to extract character features.Combine character vector features and local context features,pass in BiLSTM model and extract semantic features.Finally,Utilize CRF to annotate entities.The experimental results show that,on the large-scale network security dataset,the proposed network security entity recognition method outperforms other models when comparing relevant evaluation index,and F-value reaches 86%.Secondly,aiming at the problem of noise data introduced by distant supervision method in constructing corpus,in this paper,we proposes a distant supervision relationship extraction method ResPCNN-ATT based on distant supervision model PCNN-ATT.The model uses PCNN to extract semantic features,introduces deep residual learning to solve the gradient disappearance problem caused by noise data,and further uses the multi-instance attention mechanism to calculate the correlation between the instance and the corresponding relationship to reduce the influence of noise data.The experimental results show that the proposed method achieves state-of-the-art accuracy of relation extraction on NYT and NSER datasets.