基于提示问答数据增强的小样本网络安全事件检测方法

汤萌萌; 郭渊博; 张晗; 白庆春; 陈庆礼; 张博闻

doi:10.11959/j.issn.1000-436x.2024105

您当前的位置：

首页 >

文章列表页 >

基于提示问答数据增强的小样本网络安全事件检测方法

学术论文 | 更新时间：2024-09-10

- 基于提示问答数据增强的小样本网络安全事件检测方法
- Few-shot cybersecurity event detection method by data augmentation with prompting question answering
- 通信学报 2024年45卷第8期页码：62-74
- 作者机构：
  
  1.信息工程大学密码工程学院,河南郑州 450001
  2.海南大学网络空间安全学院,海南海口 570100
  3.郑州大学网络空间安全学院,河南郑州 450001
  4.上海开放大学上海开放远程教育工程技术研究中心,上海 200082
  5.郑州浪潮数据技术有限公司,河南郑州 450001
- 作者简介：
  
  [ "汤萌萌（1989- ），女，河南信阳人，信息工程大学博士生，主要研究方向为信息安全、网络安全事件抽取。" ]
  [ "郭渊博（1975- ），男，陕西周至人，博士，海南大学教授、博士生导师，主要研究方向为网络防御、数据挖掘、机器学习和人工智能安全等。" ]
  [ "张晗（1985- ），女，河南项城人，郑州大学讲师，主要研究方向为自然语言处理、信息安全。" ]
  [ "白庆春（1990- ），女，上海人，上海开放大学助理研究员，主要研究方向为自然语言处理、机器学习、教育大数据分析。" ]
  [ "陈庆礼（1998- ），男，河南新乡人，信息工程大学硕士生，主要研究方向为人工智能安全。" ]
  [ "张博闻（1998- ），男，河南郑州人，郑州浪潮数据技术有限公司工程师，主要研究方向为计算机通信、网络安全等。" ]
- 基金信息：
  
  国家自然科学基金资助项目(62276091;62307028);河南省重大公益专项基金资助项目;Major Public Welfare Project of Henan Province(201300311200);上海市自然科学基金资助项目(23ZR1441800);上海市启明星项目扬帆专项基金资助项目(23YF1426100)
- DOI：10.11959/j.issn.1000-436x.2024105
  中图分类号： TP391
- 收稿日期：2024-02-05，
  
  修回日期：2024-05-14，
  
  纸质出版日期：2024-08-25
- 稿件说明：
移动端阅览
汤萌萌,郭渊博,张晗等.基于提示问答数据增强的小样本网络安全事件检测方法[J].通信学报,2024,45(08):62-74.

TANG Mengmeng,GUO Yuanbo,ZHANG Han,et al.Few-shot cybersecurity event detection method by data augmentation with prompting question answering[J].Journal on Communications,2024,45(08):62-74.
汤萌萌,郭渊博,张晗等.基于提示问答数据增强的小样本网络安全事件检测方法[J].通信学报,2024,45(08):62-74. DOI： 10.11959/j.issn.1000-436x.2024105.

TANG Mengmeng,GUO Yuanbo,ZHANG Han,et al.Few-shot cybersecurity event detection method by data augmentation with prompting question answering[J].Journal on Communications,2024,45(08):62-74. DOI： 10.11959/j.issn.1000-436x.2024105.

摘要

针对网络安全领域的事件识别标注数据较为匮乏且场景和语义复杂，难以构建准确的事件识别模型的问题，提出了一种基于提示问答数据增强的小样本网络安全事件检测方法。首先利用提示信息获取事件表示知识，并结合标签词映射网络安全事件类型，从未标注的文本中生成新的数据来扩充训练数据；然后使用生成的高置信度的伪标注实例和原始数据来微调模型，以增强模型对网络安全事件的语义理解能力；最后在2个网络安全领域数据集上进行了实验验证。结果表明，与其他基线方法相比，所提方法在低资源网络安全事件检测任务上具有很强的优越性。

Abstract

The cybersecurity field lacks sufficient annotated data for event recognition

and the scenarios and semantics are complex

making it difficult to construct accurate event recognition models. A few-shot cybersecurity event detection method by data augmentation with prompting question answering was proposed. Firstly

event representation knowledge was obtained using prompt information and combined with label words to map cybersecurity event types. New data was generated from unlabeled text to expand the training data. Then

the generated high-confidence pseudo-annotated instances and raw data were used to fine-tune the model to enhance its semantic understanding of cybersecurity events. Experimental verification was conducted on two datasets in cybersecurity. The result showes that the proposed method’s substantial superiority in low-resource network security event detection tasks compared to other baseline methods.

关键词

Keywords

references

SATYAPANICH T , FERRARO F , FININ T . CASIE: extracting cybersecurity event information from text [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2020 , 34 ( 5 ): 8749 - 8757 .

李涛 , 郭渊博 , 琚安康 . 融合对抗主动学习的网络安全知识三元组抽取 [J ] . 通信学报 , 2020 , 41 ( 10 ): 80 - 91 .

LI T , GUO Y B , JU A K . Knowledge triple extraction in cybersecurity with adversarial active learning [J ] . Journal on Communications , 2020 , 41 ( 10 ): 80 - 91 .

NGUYEN T H , GRISHMAN R . Event detection and domain adaptation with convolutional neural networks [C ] // Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 2: Short Papers) . Stroudsburg : Association for Computational Linguistics , 2015 : 365 - 371 .

LIN H Y , LU Y J , HAN X P , et al . Nugget proposal networks for Chinese event detection [C ] // Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2018 : 1565 - 1574 .

LU Y J , LIN H Y , XU J , et al . Text2Event: controllable sequence-to-structure generation for end-to-end event extraction [C ] // Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2021 : 2795 - 2806 .

MA Y B , WANG Z H , CAO Y X , et al . Few-shot event detection: an empirical study and a unified view [C ] // Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2023 : 11211 - 11236 .

BAYER M , FREY T , REUTER C . Multi-level fine-tuning, data augmentation, and few-shot learning for specialized cyber threat intelligence [J ] . Computers & Security , 2023 , 134 : 103430 .

CHEN J W , LIN H Y , HAN X P , et al . Honey or poison? solving the trigger curse in few-shot event detection via causal intervention [C ] // Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2021 : 8078 - 8088 .

DENG S M , ZHANG N Y , LI L Q , et al . OntoED: low-resource event detection with ontology embedding [C ] // Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2021 : 2828 - 2839 .

CONG X , CUI S Y , YU B W , et al . Few-shot event detection with prototypical amortized conditional random field [C ] // Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing(Voluml: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2021 : 28 - 40 .

XIA M Z , KONG X , ANASTASOPOULOS A , et al . Generalized data augmentation for low-resource translation [C ] // Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics . Stroudsburg : Association for Computational Linguistics , 2019 : 5786 - 5796 .

HOU Y , LIU Y , CHE W , et al . Sequence-to-sequence data augmentation for dialogue language understanding [C ] // Proceedings of the 27th International Conference on Computational Linguistics . Stroudsburg : Association for Computational Linguistics . 2018 : 1234 - 1245 .

WU X , LV S W , ZANG L J , et al . Conditional BERT contextual augmentation [C ] // International Conference on Computational Science . Berlin : Springer , 2019 : 84 - 95 .

WEI J , ZOU K . EDA: easy data augmentation techniques for boosting performance on text classification tasks [C ] // Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2019 : 6382 - 6388 .

LIU J , CHEN Y F , XU J N . Low-resource NER by data augmentation with prompting [C ] // Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence . California : International Joint Conferences on Artificial Intelligence Organization , 2022 : 4252 - 4258 .

BRUIJN J A D , MOEL H D , WEERTS A H , et al . Improving the classification of flood tweets with contextual hydrological information in a multimodal neural network [J ] . Computers & Geosciences , 2020 , 140 : 104485 .

HOSSEINI P , HOSSEINI P , BRONIATOWSKI D . Content analysis of Persian/Farsi Tweets during COVID-19 pandemic in Iran using NLP [C ] // Proceedings of the 1st Workshop on NLP for COVID-19 (Part 2) at EMNLP 2020 . Stroudsburg : Association for Computational Linguistics , 2020 : 1 - 16 .

LAMB A , PAUL M J , DREDZE M . Separating fact from fear: tracking flu infections on twitter [C ] // Proceedings of the 2013 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies . Stroudsburg : Association for Computational Linguistics , 2013 : 789 - 795 .

YAGCIOGLU S , SEYFIOGLU M S , CITAMAK B , et al . Detecting cybersecurity events from noisy short text [C ] // Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Lingusistics . Stroudsburg : Association for Computational Linguistics , 2019 : 1366 - 1372 .

QIU X Y , LIN X X , QIU L K . Feature representation models for cyber attack event extraction [C ] // Proceedings of the 2016 IEEE/WIC/ACM International Conference on Web Intelligence Workshops . Piscataway : IEEE Press , 2016 : 29 - 32 .

RITTER A , WRIGHT E , CASEY W , et al . Weakly supervised extraction of computer security events from twitter [C ] // Proceedings of the 24th International Conference on World Wide Web . Piscataway : IEEE Press , 2015 : 896 - 905 .

LUO N , DU X Y , HE Y T , et al . A framework for document-level cybersecurity event extraction from open source data [C ] // Proceedings of the 24th International Conference on Computer Supported Cooperative Work in Design . Piscataway : IEEE Press , 2021 : 422 - 427 .

CHEN Y B , XU L H , LIU K , et al . Event extraction via dynamic multi-pooling convolutional neural networks [C ] // Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2015 : 167 - 176 .

NGUYEN T H , CHO K , GRISHMAN R . Joint event extraction via recurrent neural networks [C ] // Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies . Stroudsburg : Association for Computational Linguistics , 2016 : 300 - 309 .

NGUYEN T , GRISHMAN R . Graph convolutional networks with argument-aware pooling for event detection [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2018 , 32 ( 1 ): 5900 - 5907 .

PENG H R , SONG Y Q , ROTH D . Event detection and co-reference with minimal supervision [C ] // Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2016 : 392 - 402 .

LAI V D , DERNONCOURT F , NGUYEN T H . Extensively matching for few-shot learning event detection [J ] . arXiv Preprint , arXiv: 2006.10093 , 2020 .

DENG S M , ZHANG N Y , KANG J J , et al . Meta-learning with dynamic-memory-based prototypical network for few-shot event detection [C ] // Proceedings of the 13th International Conference on Web Search and Data Mining . New York : ACM Press , 2020 : 151 - 159 .

ZHANG R H , WEI W , MAO X L , et al . HCL-TAT: a hybrid contrastive learning method for few-shot event detection with task-adaptive threshold [C ] // Proceedings of the Findings of the Association for Computational Linguistics . Stroudsburg : Association for Computational Linguistics , 2022 : 1808 - 1819 .

DU X Y , CARDIE C . Event extraction by answering (almost) natural questions [C ] // Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2020 : 671 - 683 .

LIU J , CHEN Y F , XU J N . Document-level event argument linking as machine reading comprehension [J ] . Neurocomputing , 2022 , 488 : 414 - 423 .

GAO J , ZHAO H , YU C , et al . Exploring the feasibility of ChatGPT for event extraction [J ] . arXiv Preprint , arXiv: 2303.03836 , 2023 .

GAO T Y , YAO X C , CHEN D Q . SimCSE: simple contrastive learning of sentence embeddings [C ] // Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2021 : 6894 - 6910 .

XIE Q Z , DAI Z H , HOVY E , et al . Unsupervised data augmentation for consistency training [J ] . Advances in Neural Information Processing Systems , 2020 , 33 : 6256 - 6268 .

HUANG G H , ZHONG J , WANG C , et al . Prompt-based self-training framework for few-shot named entity recognition [C ] // International Conference on Knowledge Science, Engineering and Management . Berlin : Springer , 2022 : 91 - 103 .

CUI G Q , HU S D , DING N , et al . Prototypical verbalizer for prompt-based few-shot tuning [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2022 : 7014 - 7024 .

HU S D , DING N , WANG H D , et al . Knowledgeable prompt-tuning: incorporating knowledge into prompt verbalizer for text classification [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2022 : 2225 - 2240 .

TANG M M , GUO Y B , BAI Q C , et al . Trigger-free cybersecurity event detection based on contrastive learning [J ] . The Journal of Supercomputing , 2023 , 79 ( 18 ): 20984 - 21007 .

SNELL J , SWERSKY K , ZEMEL R S . Prototypical networks for few-shot learning [J ] . arXiv Preprint , arXiv: 1703.05175 , 2017 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于大语言模型的网络威胁情报知识图谱构建技术研究

基于单语优先级采样自训练神经机器翻译的研究

基于Nadam-TimeGAN和XGBoost的时序信号故障诊断方法

基于扩散模型的室内定位射频指纹数据增强方法

轨道交通移动边缘计算网络安全综述