CN112328805A

CN112328805A - Entity mapping method of vulnerability description information and database table based on NLP

Info

Publication number: CN112328805A
Application number: CN202011182308.4A
Authority: CN
Inventors: 沈传宝; 郝伟; 李岩
Original assignee: Beijing Huayuan Information Technology Co Ltd
Current assignee: Beijing Huayuan Information Technology Co Ltd
Priority date: 2020-10-29
Filing date: 2020-10-29
Publication date: 2021-02-05

Abstract

The embodiment of the disclosure provides an entity mapping method, device, equipment and computer-readable storage medium of vulnerability description information and a database table based on NLP. The method comprises the steps of extracting NLP keywords from vulnerability description information to obtain keywords; determining the attribute of the keyword according to a knowledge graph; establishing entity mapping of the keywords and a data table in a database according to the attributes of the keywords and a pre-established database dictionary; verifying the accuracy and integrity of the data table corresponding to the attribute of the keyword according to the entity mapping; and displaying the verification result to the user. In this way, labor cost can be reduced, and the error rate can be reduced, so that the working efficiency is improved.

Description

Entity mapping method of vulnerability description information and database table based on NLP

Technical Field

Embodiments of the present disclosure relate generally to the field of data processing, and more particularly, to an entity mapping method, apparatus, device and computer-readable storage medium for NLP-based vulnerability description information and database tables.

Background

With the improvement of the research level of the network security field, documents related to network security are more and more, and a high-lethality 'vulnerability' in the network security field can be called a nuclear weapon in the security field, so that various countries, organizations, enterprises and public institutions are actively researching and collecting vulnerability information.

Natural Language Processing (NLP) has been widely applied to identification of vulnerability information, and related vulnerability entities can be implemented by related technologies, but in the field of databases for vulnerability information management, mapping between vulnerability natural semantics and database tables still needs to be done manually.

Mining and establishing a complete vulnerability information base from a vulnerability text is a long-term and complex task, no prospective automatic implementation technology is provided in the industry aiming at vulnerability information mining at present, and the current prior art is mainly a rule-based extraction method. However, the conventional rule-based approach has many drawbacks, such as: the method has the biggest problems of high cost, high error rate, difficulty in removing the weight and the like, is relatively rigid and cannot be reused. Every time there is a new data input and database, it needs to perform manual intervention again to develop corresponding matching work. Even if some data templates are used, all the rules cannot be exhausted, so the method is poor in universality, and therefore the rule information needs to be continuously maintained manually, but the quantity of the rules is increased rapidly along with the continuous change of the information, and finally the maintenance cannot be performed.

Disclosure of Invention

According to the embodiment of the disclosure, an entity mapping scheme of vulnerability description information and a database table based on NLP is provided.

In a first aspect of the disclosure, an entity mapping method of vulnerability description information and a database table based on NLP is provided. The method comprises the following steps:

extracting NLP keywords from the vulnerability description information to obtain keywords;

determining the attribute of the keyword according to a knowledge graph;

establishing entity mapping of the keywords and a data table in a database according to the attributes of the keywords and a pre-established database dictionary;

verifying the accuracy and integrity of the data table corresponding to the attribute of the keyword according to the entity mapping;

and displaying the verification result.

Further, the extracting NLP keywords from the vulnerability description information includes:

and performing NLP analysis on the vulnerability description information through a pre-established vulnerability information corpus, and extracting keywords.

Further, the determining the attributes of the keyword according to the knowledge graph comprises:

the knowledge graph is established based on an STIX2.0 model and is used for describing the relation between the keywords and the attributes of the keywords.

Further, the attributes of the keywords include company, product, and/or vulnerability information.

Further, the verifying the accuracy and the integrity of the data table corresponding to the attribute of the keyword according to the entity mapping includes:

and searching the key words in a data table corresponding to the attributes of the key words according to the entity mapping, and verifying the accuracy and integrity of the data table corresponding to the attributes of the key words.

Further, still include:

and receiving feedback information of a user, and updating the knowledge graph according to the feedback information. .

In a second aspect of the present disclosure, an entity mapping apparatus of vulnerability description information and database table based on NLP is provided. The device includes:

the acquisition module is used for extracting the NLP keywords from the vulnerability description information to acquire the keywords;

the determining module is used for determining the attribute of the keyword according to the knowledge graph;

the mapping module is used for establishing entity mapping between the keywords and a data table in a database according to the attributes of the keywords and a pre-established database dictionary;

the searching module is used for verifying the accuracy and the integrity of the data table corresponding to the attribute of the keyword according to the entity mapping;

and the display module is used for displaying the verification result. .

In a third aspect of the disclosure, an electronic device is provided. The electronic device includes: a memory having a computer program stored thereon and a processor implementing the method as described above when executing the program.

In a fourth aspect of the present disclosure, a computer readable storage medium is provided, having stored thereon a computer program, which when executed by a processor, implements a method as in accordance with the first aspect of the present disclosure.

According to the entity mapping method based on the NLP vulnerability description information and the database table, the NLP keyword extraction is carried out on the vulnerability description information to obtain the keywords; determining the attribute of the keyword according to a knowledge graph; establishing entity mapping of the keywords and a data table in a database according to the attributes of the keywords and a pre-established database dictionary; verifying the accuracy and integrity of the data table corresponding to the attribute of the keyword according to the entity mapping; and displaying the verification result. The intelligent analysis of the vulnerability data is realized, manual intervention is not needed, the error rate is reduced, and the working efficiency is improved.

It should be understood that the statements herein reciting aspects are not intended to limit the critical or essential features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description.

Drawings

The above and other features, advantages and aspects of various embodiments of the present disclosure will become more apparent by referring to the following detailed description when taken in conjunction with the accompanying drawings. In the drawings, like or similar reference characters designate like or similar elements, and wherein:

FIG. 1 illustrates a schematic diagram of an exemplary operating environment in which embodiments of the present disclosure can be implemented;

fig. 2 shows a flowchart of an entity mapping method of NLP-based vulnerability description information and database tables according to an embodiment of the present disclosure;

FIG. 3 illustrates a mapping relationship flow diagram according to an embodiment of the disclosure;

fig. 4 shows a block diagram of an entity mapping apparatus of NLP-based vulnerability description information and a database table according to an embodiment of the present disclosure;

FIG. 5 illustrates a block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure.

Detailed Description

To make the objects, technical solutions and advantages of the embodiments of the present disclosure more clear, the technical solutions of the embodiments of the present disclosure will be described clearly and completely with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are some, but not all embodiments of the present disclosure. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.

In addition, the term "and/or" herein is only one kind of association relationship describing an associated object, and means that there may be three kinds of relationships, for example, a and/or B, which may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.

FIG. 1 illustrates a schematic diagram of an exemplary operating environment 100 in which embodiments of the present disclosure can be implemented. Included in the runtime environment 100 are a client 101, a network 102, and a server 103.

It should be understood that the number of user clients, networks, and servers in FIG. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation. In particular, in the case where the target data does not need to be acquired from a remote place, the above system architecture may not include a network but only a terminal device or a server.

Fig. 2 shows a flowchart 200 of an entity mapping method of NLP-based vulnerability description information and a database table according to an embodiment of the present disclosure. As shown in fig. 2, the entity mapping method of the vulnerability description information and the database table based on the NLP includes:

s210, extracting the NLP keywords from the vulnerability description information to obtain the keywords.

In this embodiment, an execution subject (for example, a server shown in fig. 1) of the entity mapping method based on the NLP vulnerability description information and the database table may obtain the vulnerability description information in a wired manner or a wireless connection manner.

Optionally, a vulnerability information corpus is constructed in advance, the vulnerability description information is subjected to NLP analysis through the vulnerability information corpus, and keywords are extracted.

Optionally, the vulnerability information corpus includes text information (including webpage text information and the like) such as vulnerability-related descriptions, comments, tables and the like.

Optionally, the required related corpus information is crawled from the network by means of big data analysis.

Optionally, as shown in fig. 3, NLP analysis is performed on the vulnerability description information through the vulnerability information corpus to extract keywords such as "microsoft", "Windows", and "CNNVD-201404-.

And S220, determining the attribute of the keyword according to the knowledge graph.

Optionally, the knowledge graph is established based on the STIX2.0 model and the vulnerability information corpus, and is used for describing the relationship between the keyword and the attribute of the keyword.

Optionally, the attribute of the keyword includes company, product and/or vulnerability information, and the like.

As shown in fig. 3, by the knowledge graph, it can be known that: the keyword "Microsoft" attribute is corporation; the "Windows" attribute is product; the attribute CNNVD-201404-.

And S230, establishing entity mapping between the keywords and a data table in a database according to the attributes of the keywords and a pre-established database dictionary.

Optionally, a database dictionary is established, where the database dictionary is used to describe the association between the attribute of the keyword and the data table corresponding to the attribute of the keyword.

As shown in fig. 3 a-3 b, according to the attribute of the keyword and the database dictionary, the database table "Company" is located from the database by the attribute "Company" of the keyword; locating a database table 'Product' from the database through the attribute 'Product' of the keyword; the database table "Vulneravailability" is located from the database by the attribute "Vulnerability number" of the keyword. That is, an entity mapping of the keywords to data tables in a database is established.

Optionally, the table in the database is automatically constructed according to the attribute of the keyword and the database dictionary.

S240, verifying the accuracy and the integrity of the data table corresponding to the attribute of the keyword according to the entity mapping.

Optionally, the keyword is searched in a data table corresponding to the attribute of the keyword according to the entity mapping, and the data table corresponding to the attribute of the keyword is subjected to accuracy and integrity verification.

Optionally, the verifying the accuracy and integrity of the data table corresponding to the attribute of the keyword includes querying whether corresponding information is found from the corresponding data table, such as querying whether there is microsoft corporation from a Company table; namely, content authentication is performed.

And S250, displaying the verification result to the user.

Optionally, the verification result is presented to the user in a point-to-point plus possibility form, and is finally selected by the user. The verification results are presented to the user in rows for confirmation by the user, as shown in the table below.

Optionally, feedback information (confirmation information) of the user is received and recorded, and if the recorded feedback information reaches a preset threshold (for example, 1000 pieces), the knowledge graph is updated according to the recorded feedback information. That is, the correspondence between the keywords and the keyword attributes is added to the knowledge graph.

According to the embodiment of the disclosure, the following technical effects are achieved:

the method and the device can automatically analyze and extract vulnerability information in various carriers such as web pages, texts and the like, and complete the association mapping of the data table. The data model can be established without manually prefabricating a large number of rules. For example, the data model is built through a vulnerability information corpus (predefined criteria), refer to step S220. The technology can greatly reduce labor cost and reduce error rate, thereby improving working efficiency.

It is noted that while for simplicity of explanation, the foregoing method embodiments have been described as a series of acts or combination of acts, it will be appreciated by those skilled in the art that the present disclosure is not limited by the order of acts, as some steps may, in accordance with the present disclosure, occur in other orders and concurrently. Further, those skilled in the art should also appreciate that the embodiments described in the specification are exemplary embodiments and that acts and modules referred to are not necessarily required by the disclosure.

The above is a description of embodiments of the method, and the embodiments of the apparatus are further described below.

Fig. 4 shows a block diagram of an entity mapping apparatus 400 based on NLP vulnerability description information and a database table according to an embodiment of the present disclosure. As shown in fig. 4, the apparatus 400 includes:

an obtaining module 410, configured to perform NLP keyword extraction on the vulnerability description information, and obtain a keyword;

a determining module 420, configured to determine an attribute of the keyword according to a knowledge graph;

the mapping module 430 is configured to establish entity mapping between the keyword and a data table in a database according to the attribute of the keyword and a pre-established database dictionary;

the searching module 440 is configured to perform accuracy and integrity verification on the data table corresponding to the attribute of the keyword according to the entity mapping;

and a display module 450, configured to display the verification result.

It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working process of the described module may refer to the corresponding process in the foregoing method embodiment, and is not described herein again.

FIG. 5 shows a schematic block diagram of an electronic device 500 that may be used to implement embodiments of the present disclosure. As shown, device 500 includes a Central Processing Unit (CPU)501 that may perform various appropriate actions and processes in accordance with computer program instructions stored in a Read Only Memory (ROM)502 or loaded from a storage unit 508 into a Random Access Memory (RAM) 503. In the RAM503, various programs and data required for the operation of the device 500 can also be stored. The CPU 501, ROM 502, and RAM503 are connected to each other via a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.

A number of components in the device 500 are connected to the I/O interface 505, including: an input unit 506 such as a keyboard, a mouse, or the like; an output unit 507 such as various types of displays, speakers, and the like; a storage unit 508, such as a magnetic disk, optical disk, or the like; and a communication unit 509 such as a network card, modem, wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information/data with other devices through a computer network such as the internet and/or various telecommunication networks.

The processing unit 501 performs the various methods and processes described above. For example, in some embodiments, the methods may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and/or installed onto the device 500 via the ROM 502 and/or the communication unit 509. When the computer program is loaded into RAM503 and executed by CPU 501, one or more steps of the method described above may be performed. Alternatively, in other embodiments, CPU 501 may be configured to perform the method by any other suitable means (e.g., by way of firmware).

The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a load programmable logic device (CPLD), and the like.

Program code for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program codes, when executed by the processor or controller, cause the functions/operations specified in the flowchart and/or block diagram to be performed. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

Further, while operations are depicted in a particular order, this should be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. Under certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are included in the above discussion, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single implementation. Conversely, various features that are described in the context of a single implementation can also be implemented in multiple implementations separately or in any suitable subcombination.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims, and the scope of the invention is not limited thereto, as modifications and substitutions may be readily made by those skilled in the art without departing from the spirit and scope of the invention as disclosed herein.

Claims

1. An entity mapping method of vulnerability description information and a database table based on NLP is characterized by comprising the following steps:

determining the attribute of the keyword according to a knowledge graph;

and displaying the verification result to the user.

2. The method of claim 1, wherein the NLP keyword extraction of the vulnerability description information comprises:

3. The method of claim 2, wherein determining attributes of the keyword from the knowledge-graph comprises:

4. The method of claim 3, wherein the attributes of the keywords comprise company, product, and/or vulnerability information.

5. The method of claim 4, wherein the verifying the accuracy and completeness of the data table corresponding to the attribute of the keyword according to the entity mapping comprises:

6. The method of claim 5, further comprising:

and receiving feedback information of a user, and updating the knowledge graph according to the feedback information.

7. The utility model provides a vulnerability description information and database table's entity mapping device based on NLP which characterized in that includes:

and the display module is used for displaying the verification result.

8. An electronic device comprising a memory and a processor, the memory having stored thereon a computer program, wherein the processor, when executing the program, implements the method of any of claims 1-6.

9. A computer-readable storage medium, on which a computer program is stored, which program, when being executed by a processor, carries out the method of any one of claims 1 to 6.