Few-shot cybersecurity event detection method by data augmentation with prompting question answering

TANG Mengmeng; GUO Yuanbo; ZHANG Han; BAI Qingchun; CHEN Qingli; ZHANG Bowen

doi:10.11959/j.issn.1000-436x.2024105

您当前的位置：

首页 >

文章列表页 >

Few-shot cybersecurity event detection method by data augmentation with prompting question answering

Papers | 更新时间：2024-09-10

- Few-shot cybersecurity event detection method by data augmentation with prompting question answering
- Journal on Communications Vol. 45, Issue 8, Pages: 62-74(2024)
- 作者机构：
  
  1.信息工程大学密码工程学院,河南郑州 450001
  2.海南大学网络空间安全学院,海南海口 570100
  3.郑州大学网络空间安全学院,河南郑州 450001
  4.上海开放大学上海开放远程教育工程技术研究中心,上海 200082
  5.郑州浪潮数据技术有限公司,河南郑州 450001
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62276091;62307028);Shanghai Natural Science Foundation(23ZR1441800);Shanghai Sailing Program(23YF1426100)
- DOI：10.11959/j.issn.1000-436x.2024105
  CLC： TP391
- Received：05 February 2024，
  
  Revised：2024-05-14，
  
  Published：25 August 2024
- 稿件说明：
移动端阅览
汤萌萌,郭渊博,张晗等.基于提示问答数据增强的小样本网络安全事件检测方法[J].通信学报,2024,45(08):62-74.

TANG Mengmeng,GUO Yuanbo,ZHANG Han,et al.Few-shot cybersecurity event detection method by data augmentation with prompting question answering[J].Journal on Communications,2024,45(08):62-74.
汤萌萌,郭渊博,张晗等.基于提示问答数据增强的小样本网络安全事件检测方法[J].通信学报,2024,45(08):62-74. DOI： 10.11959/j.issn.1000-436x.2024105.

TANG Mengmeng,GUO Yuanbo,ZHANG Han,et al.Few-shot cybersecurity event detection method by data augmentation with prompting question answering[J].Journal on Communications,2024,45(08):62-74. DOI： 10.11959/j.issn.1000-436x.2024105.

摘要

针对网络安全领域的事件识别标注数据较为匮乏且场景和语义复杂，难以构建准确的事件识别模型的问题，提出了一种基于提示问答数据增强的小样本网络安全事件检测方法。首先利用提示信息获取事件表示知识，并结合标签词映射网络安全事件类型，从未标注的文本中生成新的数据来扩充训练数据；然后使用生成的高置信度的伪标注实例和原始数据来微调模型，以增强模型对网络安全事件的语义理解能力；最后在2个网络安全领域数据集上进行了实验验证。结果表明，与其他基线方法相比，所提方法在低资源网络安全事件检测任务上具有很强的优越性。

Abstract

The cybersecurity field lacks sufficient annotated data for event recognition

and the scenarios and semantics are complex

making it difficult to construct accurate event recognition models. A few-shot cybersecurity event detection method by data augmentation with prompting question answering was proposed. Firstly

event representation knowledge was obtained using prompt information and combined with label words to map cybersecurity event types. New data was generated from unlabeled text to expand the training data. Then

the generated high-confidence pseudo-annotated instances and raw data were used to fine-tune the model to enhance its semantic understanding of cybersecurity events. Experimental verification was conducted on two datasets in cybersecurity. The result showes that the proposed method’s substantial superiority in low-resource network security event detection tasks compared to other baseline methods.

关键词

Keywords

references

SATYAPANICH T , FERRARO F , FININ T . CASIE: extracting cybersecurity event information from text [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2020 , 34 ( 5 ): 8749 - 8757 .

李涛 , 郭渊博 , 琚安康 . 融合对抗主动学习的网络安全知识三元组抽取 [J ] . 通信学报 , 2020 , 41 ( 10 ): 80 - 91 .

LI T , GUO Y B , JU A K . Knowledge triple extraction in cybersecurity with adversarial active learning [J ] . Journal on Communications , 2020 , 41 ( 10 ): 80 - 91 .

NGUYEN T H , GRISHMAN R . Event detection and domain adaptation with convolutional neural networks [C ] // Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 2: Short Papers) . Stroudsburg : Association for Computational Linguistics , 2015 : 365 - 371 .

LIN H Y , LU Y J , HAN X P , et al . Nugget proposal networks for Chinese event detection [C ] // Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2018 : 1565 - 1574 .

LU Y J , LIN H Y , XU J , et al . Text2Event: controllable sequence-to-structure generation for end-to-end event extraction [C ] // Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2021 : 2795 - 2806 .

MA Y B , WANG Z H , CAO Y X , et al . Few-shot event detection: an empirical study and a unified view [C ] // Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2023 : 11211 - 11236 .

BAYER M , FREY T , REUTER C . Multi-level fine-tuning, data augmentation, and few-shot learning for specialized cyber threat intelligence [J ] . Computers & Security , 2023 , 134 : 103430 .

CHEN J W , LIN H Y , HAN X P , et al . Honey or poison? solving the trigger curse in few-shot event detection via causal intervention [C ] // Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2021 : 8078 - 8088 .

DENG S M , ZHANG N Y , LI L Q , et al . OntoED: low-resource event detection with ontology embedding [C ] // Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2021 : 2828 - 2839 .

CONG X , CUI S Y , YU B W , et al . Few-shot event detection with prototypical amortized conditional random field [C ] // Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing(Voluml: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2021 : 28 - 40 .

XIA M Z , KONG X , ANASTASOPOULOS A , et al . Generalized data augmentation for low-resource translation [C ] // Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics . Stroudsburg : Association for Computational Linguistics , 2019 : 5786 - 5796 .

HOU Y , LIU Y , CHE W , et al . Sequence-to-sequence data augmentation for dialogue language understanding [C ] // Proceedings of the 27th International Conference on Computational Linguistics . Stroudsburg : Association for Computational Linguistics . 2018 : 1234 - 1245 .

WU X , LV S W , ZANG L J , et al . Conditional BERT contextual augmentation [C ] // International Conference on Computational Science . Berlin : Springer , 2019 : 84 - 95 .

WEI J , ZOU K . EDA: easy data augmentation techniques for boosting performance on text classification tasks [C ] // Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2019 : 6382 - 6388 .

LIU J , CHEN Y F , XU J N . Low-resource NER by data augmentation with prompting [C ] // Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence . California : International Joint Conferences on Artificial Intelligence Organization , 2022 : 4252 - 4258 .

BRUIJN J A D , MOEL H D , WEERTS A H , et al . Improving the classification of flood tweets with contextual hydrological information in a multimodal neural network [J ] . Computers & Geosciences , 2020 , 140 : 104485 .

HOSSEINI P , HOSSEINI P , BRONIATOWSKI D . Content analysis of Persian/Farsi Tweets during COVID-19 pandemic in Iran using NLP [C ] // Proceedings of the 1st Workshop on NLP for COVID-19 (Part 2) at EMNLP 2020 . Stroudsburg : Association for Computational Linguistics , 2020 : 1 - 16 .

LAMB A , PAUL M J , DREDZE M . Separating fact from fear: tracking flu infections on twitter [C ] // Proceedings of the 2013 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies . Stroudsburg : Association for Computational Linguistics , 2013 : 789 - 795 .

YAGCIOGLU S , SEYFIOGLU M S , CITAMAK B , et al . Detecting cybersecurity events from noisy short text [C ] // Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Lingusistics . Stroudsburg : Association for Computational Linguistics , 2019 : 1366 - 1372 .

QIU X Y , LIN X X , QIU L K . Feature representation models for cyber attack event extraction [C ] // Proceedings of the 2016 IEEE/WIC/ACM International Conference on Web Intelligence Workshops . Piscataway : IEEE Press , 2016 : 29 - 32 .

RITTER A , WRIGHT E , CASEY W , et al . Weakly supervised extraction of computer security events from twitter [C ] // Proceedings of the 24th International Conference on World Wide Web . Piscataway : IEEE Press , 2015 : 896 - 905 .

LUO N , DU X Y , HE Y T , et al . A framework for document-level cybersecurity event extraction from open source data [C ] // Proceedings of the 24th International Conference on Computer Supported Cooperative Work in Design . Piscataway : IEEE Press , 2021 : 422 - 427 .

CHEN Y B , XU L H , LIU K , et al . Event extraction via dynamic multi-pooling convolutional neural networks [C ] // Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2015 : 167 - 176 .

NGUYEN T H , CHO K , GRISHMAN R . Joint event extraction via recurrent neural networks [C ] // Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies . Stroudsburg : Association for Computational Linguistics , 2016 : 300 - 309 .

NGUYEN T , GRISHMAN R . Graph convolutional networks with argument-aware pooling for event detection [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2018 , 32 ( 1 ): 5900 - 5907 .

PENG H R , SONG Y Q , ROTH D . Event detection and co-reference with minimal supervision [C ] // Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2016 : 392 - 402 .

LAI V D , DERNONCOURT F , NGUYEN T H . Extensively matching for few-shot learning event detection [J ] . arXiv Preprint , arXiv: 2006.10093 , 2020 .

DENG S M , ZHANG N Y , KANG J J , et al . Meta-learning with dynamic-memory-based prototypical network for few-shot event detection [C ] // Proceedings of the 13th International Conference on Web Search and Data Mining . New York : ACM Press , 2020 : 151 - 159 .

ZHANG R H , WEI W , MAO X L , et al . HCL-TAT: a hybrid contrastive learning method for few-shot event detection with task-adaptive threshold [C ] // Proceedings of the Findings of the Association for Computational Linguistics . Stroudsburg : Association for Computational Linguistics , 2022 : 1808 - 1819 .

DU X Y , CARDIE C . Event extraction by answering (almost) natural questions [C ] // Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2020 : 671 - 683 .

LIU J , CHEN Y F , XU J N . Document-level event argument linking as machine reading comprehension [J ] . Neurocomputing , 2022 , 488 : 414 - 423 .

GAO J , ZHAO H , YU C , et al . Exploring the feasibility of ChatGPT for event extraction [J ] . arXiv Preprint , arXiv: 2303.03836 , 2023 .

GAO T Y , YAO X C , CHEN D Q . SimCSE: simple contrastive learning of sentence embeddings [C ] // Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing . Stroudsburg : Association for Computational Linguistics , 2021 : 6894 - 6910 .

XIE Q Z , DAI Z H , HOVY E , et al . Unsupervised data augmentation for consistency training [J ] . Advances in Neural Information Processing Systems , 2020 , 33 : 6256 - 6268 .

HUANG G H , ZHONG J , WANG C , et al . Prompt-based self-training framework for few-shot named entity recognition [C ] // International Conference on Knowledge Science, Engineering and Management . Berlin : Springer , 2022 : 91 - 103 .

CUI G Q , HU S D , DING N , et al . Prototypical verbalizer for prompt-based few-shot tuning [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2022 : 7014 - 7024 .

HU S D , DING N , WANG H D , et al . Knowledgeable prompt-tuning: incorporating knowledge into prompt verbalizer for text classification [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Stroudsburg : Association for Computational Linguistics , 2022 : 2225 - 2240 .

TANG M M , GUO Y B , BAI Q C , et al . Trigger-free cybersecurity event detection based on contrastive learning [J ] . The Journal of Supercomputing , 2023 , 79 ( 18 ): 20984 - 21007 .

SNELL J , SWERSKY K , ZEMEL R S . Prototypical networks for few-shot learning [J ] . arXiv Preprint , arXiv: 1703.05175 , 2017 .

Views

1589

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

RL-WGAN based method for 5G network anomalous data generation

Research on knowledge graph construction technology for cyber threat intelligence based on large language models

Research on self-training neural machine translation based on monolingual priority sampling

Fault diagnosis method of timing signal based on Nadam-TimeGAN and XGBoost

Radio frequency fingerprint data augmentation for indoor localization based on diffusion model

Related Author

Xiong Xuanrui

Ouyang Ruiqi

Zhou Li

Zou Daoyuan

Ning Zhaolong

ZHOU Changling

JIN Jiandong

LAI Qingnan

Related Institution

College of Electronic Science and Technology, National University of Defense Technology

School of Communications and Information Engineering, Chongqing University of Posts and Telecommunications

Computing Center, Peking University

School of Computer Science (National Pilot Software Engineering School), Beijing University of Posts and Telecommunications

Shaanxi Key Laboratory of Network Computing and Security Technology

AI问答

⁰