CN105550189A - Ontology-based intelligent retrieval system for information security event - Google Patents

Abstract

The invention designs and realizes an ontology-based intelligent retrieval system for an information security event, which is a system for performing information retrieval of the information security event based on an ontology, and contains knowledge from the field of information security. The goal of designing the system is to provide knowledge accumulation in the field of information security for a user, and the system has a certain intelligent semantic retrieval function, so that the user can obtain required information security event related knowledge and information. A design concept is that firstly, an initial information security event domain ontology is established based on OWL, then information security event domain related information is acquired, and a relationship between information security event domain concepts is extracted, thereby realizing automatic expansion of the information security event domain ontology; secondly, an inference rule is designed according to a semantic relationship of the information security event ontology, and the information security event ontology is inferred based on Jena; and finally, the query expansion and sorting are carried out based on the information security event ontology and semantic similarity calculation, thereby realizing semantic retrieval of the information security event.

Description

Based on the information security events intelligent retrieval system of body

Technical field

The invention belongs to information retrieval technique category, be specially the information security events intelligent retrieval system based on body.Security-Oriented event field of the present invention, can provide acquisition and the intelligent retrieval function of information security events relevant knowledge for user.

Background technology

Along with the fast development of computer networking technology, China achieves huge development in network Construction.The internet produced along with the information industry development and Network Information Security Problem, also become the hot issue that relevant department of national governments, each large industry and enterprises and institutions leader pay close attention to.At present, the economic loss that the whole world causes due to the fragility of infosystem every year rises year by year, safety problem is day by day serious, information about information security events on internet also increases rapidly, in order to tackle information security events better, just need to get required information security events relevant information and knowledge quickly and accurately from the information ocean of vastness.Information retrieval system, as an important component part of network information platform, obtains user in the process of network information and has played irreplaceable effect, has become the requisite instrument of people's obtaining information.Along with people's improving constantly information retrieval demand, traditional information retrieval tool exposes many problems.First, traditional information retrieval tool mostly adopts the customer requirement retrieval mechanism based on keyword, user's request is understood not enough, query expansion cannot be realized, inevitably cause loss semantically, export junk information useless in a large number, and the intelligence degree of search is not high, cannot be retrieved by simple reasoning.

Body is the explicit description of generalities, the Formal Semantic it providing practical intelligence represents, the exchange of supported data, information and knowledge, reuse and share, and can in different modeling methods, normal form, carry out between language and Software tool translating and mapping, solve Heterogeneity.Body has good concept hierarchy and the support to reasoning from logic, ontology fusion in traditional information retrieval, not only can the advantage of information retrieval of inheriting tradition, and the limitation that can not process conceptual relation can also be overcome.Therefore, Security-Oriented event field of the present invention, proposing the construction method of information security body and the Automatic Extraction method of information security field concept and relation, for realizing the automatic expansion of information security events body, can greatly raise the efficiency on the one hand.Propose the query expansion based on body and Semantic Similarity Measurement model and sort method, can from semantically understanding and processes user queries.Devise inference rule according to the semantic relation in body, achieve simple information security events ontology inference, establish information security events intelligent retrieval system on this basis.

Summary of the invention

The object of the present invention is to provide a kind of information security events intelligent retrieval system based on body, automatic acquisition information security events domain knowledge and realize semantic retrieval.Specifically, content of the present invention comprise following some.

(1) based on the information security events Intelligent Information Resource Retrieval System framework of body: be made up of information acquisition, information security events ontological construction and the several part of expansion, semantic tagger, semantic indexing, query processing, retrieval and sequence.

(2) information security events ontology expansion and management: build initial information security events body based on OWL, adopt based on the concept extraction method of Bootstrapping with based on the mixed relationship abstracting method expanding correlation rule and Relation extraction rule, from information security field document, Automatic Extraction goes out the relation existed between field concept and concept, adopt OWL to construct operator representation out, and be added in ontology library based on structure of web page Extracting Information security incident example automatic powder adding.User can carry out message event knowledge query on foreground and example adds, revises and deletion action.

(3) based on information security events Ontology Query and the reasoning of Jena: inquiry and the reasoning of carrying out information security events domain knowledge based on Jena inference machine, infer related information according to user's inquiry, and the details of example can be checked.

(4) information security events semantic retrieval: for text document sets up index, expand based on the semantic relation in information security events body and input relevant concept or example to user, adopt the calculating carrying out similarity size based on the semantic similarity calculation method of body, only get concept in threshold range as expanding query word.Then adopt the sort method based on Semantic Similarity Measurement model improved, result for retrieval is returned to user by correlativity size, realizes semantic retrieval.

Accompanying drawing explanation

Fig. 1 is the information security events intelligent retrieval system framework based on body;

Fig. 2 is information security events domain body extension framework;

Fig. 3 is the inference mechanism based on information security events body.

Embodiment

For making object of the present invention, technical scheme and advantage clearly understand, referring to accompanying drawing examples, the present invention is described in further detail.The system platform that the present invention realizes adopts MyEclipse8.5+Jena2.5+ICTCLAS5.

1. system architecture

System architecture as shown in Figure 1, first the relevant information of Information Monitoring security incident from internet is needed, and carry out pre-service and information extraction, obtain body from semantic net or build body according to field Search Requirement, by the concept in Method for Ontology Learning automatic acquisition body and the relationship of the concepts etc., or build body by the method for information extraction and mark, and ontology library is constantly expanded.In text document, identify the entity in body, comprise the class in body, attribute, example etc., then generate corresponding mark.Semantic tagger and traditional information retrieval Index process similar, just index is entity in body, instead of pure keyword.Namely the basis of semantic tagger result can be the index of text document foundation based on body, set up the connection of document and a series of semantic entity and semantic relation, give weight to semantic entity and relation, describe the semanteme of document with the semantic relation of conception of species each in domain body.For the query contents of user's input, need carry out the pre-service such as participle and mate with the content of body, carry out query expansion and reasoning based on the semantic relation of body and description logic axiom, obtain the new query word that more can reflect user's query intention.Finally new query word is retrieved, calculate the degree of correlation of example and document based on semantic relevancy after, also need the similarity etc. calculating query case and document, obtain the sequence score of each document, finally by sequence score height, sorted result for retrieval is returned to user.

2. information security events ontology expansion and management

The structure of body is the process of an iteration, and after initial information security events ontological construction completes, needs constantly improve and expansion.Information security events domain body automatic expansion framework as shown in Figure 2, comprises semantic relation extraction and formalization representation 4 ingredients between Domain resources, the extraction of information security events field concept, concept.First can existing knowledge in multiplexed information security incident knowledge source, as multiplexing existing information security events body, can also extract example information from information security events knowledge source, but information security events knowledge source need meet following requirement: knowledge is not outmoded, knowledge is with a high credibility (as standardized knowledge source), knowledge broad covered area etc.At present along with people more and more pay close attention to information security events, the information security events body set up from different perspectives also can get more and more, and can carry out multiplexing.About the information of information security events example, as information security events title, classification, time of origin, place, details, also can extract based on the structure of information security events knowledge source.

For not being the information security events field document coming from information security events knowledge source, need first therefrom to extract key message, obtain information security events language material, then carry out participle, remove the pre-service such as stop words, next based on the field concept abstracting method of Bootstrapping and extract the semantic relation between information security events concept and concept based on the method for expansion correlation rule and Relation extraction rule.Finally the structure molecular forms of obtained concept, the relationship of the concepts, example information OWL language is showed, the expansion of information security events domain body can be completed.User can information security events knowledge in manual editing's information security events body and instance properties information, the attribute can checking certain class and the example had, wherein inaccurate information can be revised, or directly delete, new example and attribute information thereof can also be added.

3. based on the information security events ontology inference of Jena

After information security events body is tentatively set up, can carry out inquiring about and reasoning based on it.Native system have employed RBR method and carries out reasoning to information security events body, first carries out information security events ontology inference Design with Rule, then imports Jena inference machine and carries out reasoning, draws the reasoning results and in information retrieval.

Inference rule grammer: Rule-Name:P1P2P3...Pn → C;

Wherein, Rule-Name is domain-planning name, Pi (i=1,2 ..., tlv triple n) for having existed in original model, C is the tlv triple that can derive.Whole inference rule is: if left side prerequisite is true, then obtain the conclusion on the right.

Native system describes the inference rule based on body based on the basic axiom of information security events body, description logic and OWLDL.Semantic relation according between information security events Ontological concept: the design such as classification relation, example relation, relation of equivalence, cause-effect relationship (cause, causedby), time relationship, similarity relation inference rule, such as:

[inverseOf：(？Powl：inverseOf？Q)，(？X？P？Y)-＞(？Y？Q？X)]

Illustrate: if P attribute and Q attribute reciprocal, there is P relation on attributes between X and Y, then there is Q relation on attributes between Y and X.

[inverseOf1：(？causeowl：inverseOf？causedby)∧(？H？cause？I)-＞(？I？causedby？H)]

Illustrate: cause and causeby is reciprocal attribute, between H and I, there is cause relation, then there is causedby relation between I and H.

[symmetricProperty1：(？Rrdf：typeowl：SymmetricProperty)∧(？N？R？O)-＞(？O？R？N)]

Illustrate: R has symmetry between N and O, to there is R relation on attributes, then also there is R relation on attributes between O and N.

[symmetricProperty2：(？resemblerdf：typeowl：SymmetricProperty)∧(？N？resemble？O)-＞(？O？resemble？N)]

Illustrate: rememble has symmetry between N and O, to there is resemble relation, then also there is resemble relation on attributes between O and N.

[resemble：(？acausedby？c)，(？bcausedby？c)，notEqual(？a，？b)-＞(？aresemble？b)]

Illustrate: if a is caused by c, b is caused by c, a and b non-equivalence, then a with b is similar.

After determining extensive inference rule, need the concrete semanteme considering object properties, abstraction rule is specialized, as inference rule inverseOf above and inverseOf1, symmetricProperty1 and symmetricProperty2, inverseOf1 is specializing of inverseOf, and symmetricProperty2 is specializing symmetricProperty1, can gradual perfection inference rule storehouse by constantly specializing inference rule.

When realizing the reasoning of information security events domain body based on Jena, mainly adopt the GenericRuleReasonerFactory in Factory method to obtain general rule inference machine, then introduce rule base file and reasoning is carried out to ontology library.Information security events ontology inference mechanism as shown in Figure 3.The inference rule that native system adopts is oneself definition, therefore must create specific inference machine according to custom rule.Ontology inference performing step based on Jena is as follows:

(1) use Jena reads the data in ontology library from OWL file, creates OntModel object;

(2) be loaded into ontology inference rule, resolve and create Rule object;

(3) the built-in OWL inference machine of Jena is obtained;

(4) by inference machine, certain domain-planning is bound;

(5) domain-planning bound through OWL inference machine is applied to information retrieval.

Such as, when a retrieval information security events information, similar information security events can be returned by reasoning.Here, similar information security events refers to the event caused by same safety problem.The domain-planning resemble constructed above is loaded in Jena inference machine, completes reasoning by Jena inference engine and the reasoning results is returned to user.In addition, the inquiry of information security events ontology knowledge can also be carried out based on Jena, such as, input message safety problem, the problem source of all information security security incidents and the correspondence caused by this safety problem can be seen in Query Result, click some events wherein, the details interface of event can be opened, click problem source name wherein, the details that problem of can also checking is originated.

4. based on the semantic retrieval of information security events body

In order to meet the semantic retrieval demand of user to problem origination event information, when receiving user and inputting, user's inquiry is analyzed and processed accordingly, then Ontology Matching is carried out, carry out semantic query expansion based on the multiple semantic relation in information security events body and Semantic Similarity Measurement model afterwards, obtain new query word set.In order to make before the Query Result of more heterogeneous pass comes, to be combined by the order models of Semantic Similarity Measurement model and Lucence itself, adopt new sort method to result ranking and export.Native system is the participle dictionary based on ontology expansion also, and the concept stored in ontology library all added in participle dictionary, along with the continuous expansion of ontology library, the word segmentation result of the event that can ensure information security Field Words is more accurate.

The enquiry expanding method based on information security events body of native system, not only consider the hyponymy, the synonymy that exist in body, and consider the certain semantic relations such as cause, is_before of existing in body, can ensure that the concept expanded is more comprehensive.By introducing concept similarity computation model, the threshold value of setting concept similarity, only gets concept in threshold range as expansion concept, avoids last query expansion result generation homogeneity.No matter be single keyword patterns, multi-keyword combination pattern, or the natural language querying pattern of more complicated, be all converted into the query pattern based on keyword.The attribute structure of example is identical with the attribute structure of class.There is hyponymy between the genus of domain body, the Hierarchy Structure of tree can be adopted to represent, node represents field concept, and its superior node is its parent, and leaf node is the example.Mated with the class in domain body, example respectively by each keyword in keyword set, the situation of coupling has two kinds, and the first is keyword and the mating of genus, and the second is keyword and the mating of instance concepts.Difference according to match objects need adopt different disposal routes.When the genus in searching keyword and domain body matches, the genus mated with searching keyword in expansion body has the concept of hyponymy, synonymy and certain semantic relation.If on the example match in query contents and domain body, then first obtain each attribute of example, using each with it for example attribute as one group of new searching keyword, the genus of expansion coupling afterwards belonging to example and the synonym of this genus, upper subordinate concept and have the concept of certain semantic relation.If do not mate, then query contents terminated with mating of Ontological concept.

For the query word that preliminary propagation goes out, except the combination keyword of example and attribute, similarity between application semantics similarity calculation and original query word calculates, query word less for similarity is given up, only retain the expansion word that similarity reaches given threshold value, if coupling is genus in body, then the expansion word retained is inputted as last inquiry; If coupling is example in body, then the combination keyword of the expansion word retained and example and attribute is inputted as last inquiry.Similarity value between the combination keyword of example and attribute and original query word is 1.

In order to avoid causing theme to offset, native system, in conjunction with Semantic Similarity Measurement model, improves Lucene ordering mechanism, and the sequence score computing formula obtained is such as formula (1):

$\mathrm{score}(q,\mathrm{eq},d)=\underset{j=1}{\overset{n}{\mathrm{\Σ}}}\mathrm{tf}\left(\begin{array}{ccc}\mathrm{eq}& \mathrm{in}& d\end{array}\right)\·\mathrm{idf}\left(\mathrm{eq}\right)\·\mathrm{lengthNorm}\left(\mathrm{eq}\right)\·\mathrm{sim}(\mathrm{eq},q)$ Formula (1)

$\mathrm{tf}\left(\begin{array}{ccc}\mathrm{eq}& \mathrm{in}& d\end{array}\right)=\mathrm{sqrt}\left(n(\mathrm{eq},d)\right)$ Formula (2)

$\mathrm{idf}\left(\mathrm{eq}\right)=1+\log \frac{n}{n\left(\mathrm{eq}\right)+1}$ Formula (3)

Wherein, q is query word, and eq represents expanding query word, and the sequence score returned to document when score (q, eq, d) represents and uses expanding query word and search, sim (eq, q) represents the Similarity value of expanding query word eq and original query word q.Tf (qind) represents the frequency that q occurs in a document, idf (q) is reversion document frequency, implication occurs in document that the frequency of q is higher to seem that document is more inessential, n represents the sum of search file, n (q) represents the number of files comprising query word q, the total number of the computing method of lengthNorm (q) to be 1.0/Math.sqrt (numTerms), numTerms parameter be entry in this Field.For original query word, when calculating sequence score, Similarity value gets 1.In queries, different inquiries may retrieve identical document, but their score is different, so gets the score the higher person of the two, thus removes reproducible results, finally by document scores order from high to low, corresponding result for retrieval is returned to user.

Claims (6)

1. based on the information security events intelligent retrieval system of body, it is characterized in that, this system achieves following function:

Based on the information security events intelligent retrieval system framework of body;

The expansion of information security events body;

The management of information security events body;

Information security events Ontology Query and reasoning;

Based on the semantic retrieval of information security events body.

2. system according to claim 1, is characterized in that, this system is made up of information acquisition, information security events ontological construction and a few part of expansion, semantic tagger, semantic indexing, query processing, retrieval and sequence.

3. system according to claim 1, it is characterized in that, initial information security events domain body is built based on OWL, adopt based on the concept extraction method of Bootstrapping with based on the mixed relationship abstracting method expanding correlation rule and Relation extraction rule, from the document of information security events field, Automatic Extraction goes out the relation existed between field concept and concept, adopt OWL to construct operator representation out, and add in ontology library based on structure of web page Extracting Information security incident example.

4. system according to claim 1, it is characterized in that, information security events knowledge in information security events body is shown, system manager can add example and attribute information thereof in ontology knowledge base, certain or some attribute of amendment example and and other related notions between semantic relation, and delete example and relevant information thereof.

5. system according to claim 1, it is characterized in that, user can select input message safety event or information security issue key word, system is by the title of return message security incident from information security events body, key word and relative information security issue title, user can check the time of information security events, place, the unit occurred, safety problem is originated, relevant safety problem, the information such as the event similar to it, the information of its details and the event similar to it can also be checked, click safety problem source name, the brief introduction that safety problem is originated can be checked, classification, harm, the information such as corresponding safety problem and the event relevant with it.Information security events knowledge-based reasoning can be carried out based on Jena inference machine, infer related information according to user's inquiry.

6. system according to claim 1, it is characterized in that, expand based on the semantic relation in information security events body and input relevant concept or example to user, adopt the calculating carrying out similarity size based on the semantic similarity calculation method of body, only get concept in threshold range as expanding query word.Then adopt the sort method based on Semantic Similarity Measurement model improved, result for retrieval is returned to user by correlativity size, realizes semantic retrieval.