CN116049343A - Method and system for document-level threat intelligence relationship extraction based on feature enhancement - Google Patents

Abstract

The invention belongs to the technical field of network space security, and particularly relates to a document-level threat intelligence relation extraction method and system based on feature enhancement, which are implemented by constructing an entity information extraction model and training and optimizing, wherein the entity information extraction model comprises the following components: the system comprises a BERT model, a fusion processing unit and an entity relation extraction model; inputting text data of a threat information document to be processed into a training optimized entity information extraction model, acquiring word entity mention context embedding vectors in the text data through a BERT model, fusing the word part embedding vectors and entity width information with the word entity mention context embedding vectors by utilizing a fusion processing unit, and acquiring entity relations of target entity pairs in the text data through an entity relation extraction model. The invention combines part-of-speech sequences, mentions additional document information such as width and the like to enhance entity representation characteristics, can improve entity relation extraction accuracy, and provides technical support for network security space threat modeling, risk analysis reasoning and the like.

Description

Document-level threat intelligence relationship extraction method and system based on feature enhancement

Technical Field

The present invention belongs to the field of cyberspace security technology, and in particular relates to a document-level threat intelligence relationship extraction method and system based on feature enhancement.

Background Art

With the rapid development of network and information technology, new threat attacks are showing a trend of continuous growth. The increasingly complex attack strategies and ever-changing attack scenarios make it difficult for traditional network defenses such as firewalls and signature registries to resist these new attacks. In order to better understand the threat situation and coordinate responses to unknown threats, security experts propose to use Cyber Threat Intelligence (CTI) for network defense. In 2013, Gartner first proposed that threat intelligence is knowledge about existing or upcoming threats to assets, including scenarios, mechanisms, indicators, revelations and actionable suggestions, etc. This knowledge can provide the subject with a strategy to respond to threats.

The knowledge of threat intelligence comes from security analysis reports, blogs, social networks, vulnerability libraries, threat intelligence libraries, etc., which can provide strong data support for situational awareness and active defense. However, most threat intelligence exists in the form of natural language text, contains a large amount of unstructured data, and it is difficult to visualize the internal connections of attack elements. In order to help researchers quickly understand the semantic associations of attack elements, it is necessary to design corresponding algorithms to mine entities and their relationships from large-scale threat intelligence documents and construct a threat intelligence knowledge graph.

Relation extraction aims to identify the relationship between entities in a given text. Although relationship extraction in general fields has achieved good results, the following problems still exist in the field of network security: 1) There is a lack of publicly available threat intelligence datasets; 2) Threat intelligence contains a large number of professional terms such as vulnerability names, malware, APT organizations, etc., and there is a serious OOV (Out of Vocabulary) problem; 3) Threat intelligence documents have complex structures, relatively long sentences, low entity and relationship frequencies, and serious imbalance in data label distribution. In addition, existing work mainly focuses on sentence-level text mining. However, in actual scenarios, the same entity may have multiple mentions, and the relationship between entities usually needs to rely on multiple sentences for inference. For this reason, there is an urgent need for a relationship extraction scheme that can meet the analysis and processing of threat intelligence text data with complex document structures.

Summary of the invention

To this end, the present invention provides a document-level threat intelligence relationship extraction method and system based on feature enhancement, which combines additional document information such as part-of-speech sequence and mention width to enhance entity representation features, thereby improving the accuracy of entity relationship extraction and providing technical support for threat modeling, risk analysis, attack reasoning, etc. in the network security space.

According to the design scheme provided by the present invention, a document-level threat intelligence relationship extraction method based on feature enhancement is provided, which includes the following contents:

Constructing an entity information extraction model and performing training optimization, wherein the entity information extraction model includes: a BERT model for encoding input text data to obtain a word entity mention context embedding vector of the text data, a fusion processing unit for enhancing the word entity mention context embedding vector by fusing part-of-speech embedding vectors and entity width information and obtaining a global representation of the entity, and an entity relationship extraction model for fusing a given entity pair's local context embedding with the entity's global representation, entity type information, and inter-entity spacing information to obtain a given entity pair's relationship probability through a nonlinear activation function;

The text data of the threat intelligence document to be processed is input into the trained and optimized entity information extraction model, and the word entity mention context embedding vector in the text data is obtained through the BERT model. The part-of-speech embedding vector and entity width information are fused with the word entity mention context embedding vector using the fusion processing unit, and the entity relationship of the target entity pair in the text data is obtained through the entity relationship extraction model.

As a document-level threat intelligence relationship extraction method based on feature enhancement in the present invention, further, in the entity information extraction model training optimization, model training optimization is performed based on knowledge distillation, and the training optimization process includes: collecting sample label data, training a teacher model using the sample label data, and obtaining the teacher model by updating the teacher model parameters; then, performing knowledge distillation on the teacher model using the sample label data to obtain a student model, and using the student model as the entity information extraction model after training optimization.

As the document-level threat intelligence relationship extraction method based on feature enhancement in the present invention, further, the objective loss function in the training optimization is expressed as: L _RE =α ₁ L _AFL +α ₂ L _KD , wherein L _RE represents the total loss, L _AFL represents the adaptive loss of relation extraction as a multi-label separation problem, L _KD represents the knowledge distillation loss, and α ₁ and α ₂ are the weights of the adaptive loss and the knowledge distillation loss, respectively.

As a document-level threat intelligence relationship extraction method based on feature enhancement in the present invention, further, a BERT model is used to obtain a word entity mention context embedding vector in text data, comprising: first, a word segmentation process is performed on the input document text data through a word segmenter to obtain a word entity set, and the entity mention is marked with a preset mention symbol; then, a pre-trained BERT model is used as an encoder to encode the word entities in the text data to generate an entity mention context embedding vector.

As a document-level threat intelligence relationship extraction method based on feature enhancement of the present invention, further, a fusion processing unit is used to fuse the part-of-speech embedding vector and the entity width information with the word entity mention context embedding vector. First, a natural language processing tool is used to obtain the part-of-speech tag, and the part-of-speech embedding vector of the word entity in the text data is generated using the part-of-speech tag, and the part-of-speech embedding enhanced vector representation is generated by fusing it with the context embedding vector; then, the vector representation is enhanced by fusing the entity mention width information; then, for each entity, a pooling operation is performed to obtain the global representation of the entity.

As a document-level threat intelligence relationship extraction method based on feature enhancement of the present invention, further, for the word entity mention context embedding vector fused with the part-of-speech embedding vector, the attention score of each mention element in the word entity mention context embedding vector is obtained based on the multi-head attention mechanism, the attention score of each mention element is used as the attention of the corresponding entity mention, and the entity-level attention matrix is obtained by averaging the entity mention attention, and the entity-level attention matrix is used to represent the attention score of the corresponding entity to all entity mentions.

As a document-level threat intelligence relationship extraction method based on feature enhancement of the present invention, further, the entity relationship of the target entity pair in the text data is obtained through the entity relationship extraction model, including: first, the key context of the given entity pair is located through the entity-level attention matrix, and the local context embedding vector of the given entity pair is obtained according to the context; then, the local context embedding vector is fused with the global representation of the entity, the entity type information and the distance information between entities to obtain the context embedding representation of the target entity pair; then, a nonlinear activation function is used to obtain the relationship probability of the given target entity pair.

As a document-level threat intelligence relationship extraction method based on feature enhancement of the present invention, further, in obtaining the relationship probability of a given entity pair using a nonlinear activation function, the context embedding representation of the target entity pair is first grouped and feature fused to obtain an entity pair representation, and then the nonlinear activation function sigmoid is used to obtain the relationship probability of a given target entity pair.

Furthermore, the present invention also provides a document-level threat intelligence relationship extraction system based on feature enhancement, comprising: a model building module and a relationship extraction module, wherein:

A model building module, used to build an entity information extraction model and perform training optimization, wherein the entity information extraction model includes: a BERT model for encoding input text data to obtain a word entity mention context embedding vector of the text data, a fusion processing unit for enhancing the word entity mention context embedding vector by fusing the part-of-speech embedding vector and the entity width information and obtaining the entity global representation, and an entity relationship extraction model for fusing the local context embedding of a given entity pair with the entity global representation, entity type information and inter-entity spacing information to obtain the relationship probability of a given entity pair through a non-linear activation function;

The relationship extraction module is used to input the text data of the threat intelligence document to be processed into the trained and optimized entity information extraction model, obtain the word entity mention context embedding vector in the text data through the BERT model, use the fusion processing unit to fuse the part-of-speech embedding vector and entity width information with the word entity mention context embedding vector, and obtain the entity relationship of the target entity pair in the text data through the entity relationship extraction model.

Beneficial effects of the present invention:

In order to solve the OOV problem in threat intelligence, the present invention uses the Bert pre-trained model as an encoder to generate word embeddings and integrates additional features such as entity width, entity distance, entity type, etc., which can make full use of the text information in the document and effectively improve the accuracy of relationship extraction. In order to solve the problems of low frequency of entity relationships in threat intelligence and serious imbalance of data labels, the present invention introduces a teacher-student model, uses soft-label statistical data to calculate the effective information of the data set, retains the inter-class correlation information, removes some invalid redundant information, realizes knowledge distillation, improves the performance of the relationship extraction model, facilitates the processing of threat intelligence documents with complex structures, and provides support for data analysis and knowledge reasoning for threat modeling, risk analysis, attack reasoning, etc. in the network security space, which has good application prospects.

Description of the drawings:

FIG1 is a schematic diagram of a document-level threat intelligence relationship extraction process based on feature enhancement in an embodiment;

FIG2 is a schematic diagram of an entity information extraction model architecture in an embodiment;

FIG3 is a diagram showing a teacher-student model in an embodiment;

FIG4 is a schematic diagram of a threat intelligence entity in an embodiment;

FIG5 is a schematic diagram of a portion of the threat intelligence knowledge graph in the embodiment.

Specific implementation method:

In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

In this embodiment, as shown in FIG1 , a document-level threat intelligence relationship extraction method based on feature enhancement is provided, comprising:

S101, constructing an entity information extraction model and performing training optimization, wherein the entity information extraction model includes: a BERT model for encoding input text data to obtain a word entity mention context embedding vector of the text data, a fusion processing unit for enhancing the word entity mention context embedding vector by fusing the part-of-speech embedding vector and the entity width information and obtaining the entity global representation, and an entity relationship extraction model for fusing the local context embedding of a given entity pair with the entity global representation, entity type information and inter-entity spacing information to obtain the relationship probability of a given entity pair through a non-linear activation function;

S102. Input the text data of the threat intelligence document to be processed into the trained and optimized entity information extraction model, obtain the word entity mention context embedding vector in the text data through the BERT model, fuse the part-of-speech embedding vector and entity width information with the word entity mention context embedding vector using a fusion processing unit, and obtain the entity relationship of the target entity pair in the text data through the entity relationship extraction model.

In the embodiment of this case, as shown in Figures 2 and 3, by constructing a threat intelligence ontology, integrating features such as entity width, entity distance, and entity type, the information in the document is fully utilized to improve the accuracy of relationship extraction; and the Bert pre-training model is used to generate word embeddings to effectively improve the OOV problem.

As a preferred embodiment, further, in the entity information extraction model training optimization, model training optimization is performed based on knowledge distillation, and the training optimization process includes: collecting sample label data, training the teacher model using the sample label data, and obtaining the teacher model by updating the teacher model parameters; then, performing knowledge distillation on the teacher model using the sample label data to obtain a student model, and using the student model as the entity information extraction model after training optimization.

The same batch of labeled sample data can be put into two models at the same time. The predicted output of the teacher model is used as the soft label, and the true label is used as the hard label. The two losses of the student model are calculated separately. Finally, the weighted sum of the two losses is used as the final loss to update the network parameters. During actual prediction, only the student model is used.

Furthermore, the objective loss function in training optimization is expressed as: L _RE = α ₁ L _AFL + α ₂ L _KD , where L _RE represents the total loss, L _AFL represents the adaptive loss of relation extraction as a multi-label separation problem, L _KD represents the knowledge distillation loss, and α ₁ and α ₂ are the weights of the adaptive loss and knowledge distillation loss, respectively. The mean square error loss function can be used to calculate the difference between the logits generated by the student model and the soft labels generated by the teacher model, and combined with the adaptive Focal Loss loss weighted as the overall loss function of the model to further improve the model performance.

As a preferred embodiment, further, a BERT model is used to obtain a context embedding vector of a word entity mention in text data, comprising: first, a word segmentation process is performed on the input document text data through a word segmenter to obtain a word entity set, and the entity mention is marked with a preset mention symbol; then, a pre-trained BERT model is used as an encoder to encode the word entities in the text data to generate an entity mention context embedding vector.

x_t表示文档中位置为t的单词。可利用特殊符号对实体提及进行标记：即可在实体提及其前后添加“*”。接着利用Bert对文档进行编码，生成上下文嵌入H，编码过程可表示为：The pre-trained model Bert is used as the document encoder. For a document of length l

x _t represents the word at position t in the document. Special symbols can be used to mark entity mentions: you can add "*" before and after the entity mention. Then use Bert to encode the document and generate the context embedding H. The encoding process can be expressed as:

H=Bert([x ₁ ,..., x _l ])=[h ₁ ,..., h _l ]

d₁是预训练模型的隐藏层维度。in

_d1 is the hidden layer dimension of the pre-trained model.

As a preferred embodiment, further, a fusion processing unit is used to fuse the part-of-speech embedding vector and the entity width information with the word entity mention context embedding vector. First, a natural language processing tool is used to obtain the part-of-speech tag, and the part-of-speech tag is used to generate a part-of-speech embedding vector of the word entity in the text data, and then the part-of-speech embedding-enhanced vector representation is generated by fusing it with the context embedding vector; then, the vector representation is enhanced by fusing the entity mention width information; then, for each entity, a pooling operation is performed to obtain a global representation of the entity.

Use the Nltk library in Python to generate part-of-speech tags and generate the part-of-speech embedding matrix P. The specific process can be expressed as:

P=Pos([x ₁ ,...,x _l ])=[p ₁ ,..., p _l ]

d₂是词性嵌入的维度。in

_d2 is the dimension of part-of-speech embedding.

It is fused with the context embedding H to generate a token representation enhanced by part-of-speech embedding.

C＝[h ₁ |p ₁ ,..., h _l |p _l ]=[c ₁ ,..., c _l ]

[|]表示连接操作。in

[|] indicates a concatenation operation.

The pre-generated width embedding matrix W and distance embedding matrix D are used to fuse the width information of entity mentions and the distance information between entities.

d₃和d₄分别为宽度嵌入和距离嵌入的维度。in

_d3 and _d4 are the dimensions of width embedding and distance embedding respectively.

将其与宽度嵌入融合，融合过程可表示为：The embedding vector of the “*” at the beginning of the entity mention is used as the embedding of the mention, denoted as

Fusing it with width embedding, the fusion process can be expressed as:

个提及

的实体e_i，利用logsumexp池化操作获得该实体的全局表示，池化操作过程可表示为：For including

Mentions

The entity e _i is represented by the logsumexp pooling operation, and the pooling operation process can be expressed as:

As a preferred embodiment, further, for the word entity mention context embedding vector fused with the part-of-speech embedding vector, the attention score of each mention element in the word entity mention context embedding vector is obtained based on the multi-head attention mechanism, the attention score of each mention element is used as the attention of the corresponding entity mention, and the entity-level attention matrix is obtained by averaging the entity mention attentions, and the entity-level attention matrix is used to represent the attention scores of the corresponding entity to all entity mentions.

表示第i个实体到所有token的注意力分数。Using the pre-trained multi-head attention matrix A∈R ^HD×l×l , _Aijk represents the attention score from token j to token k in the ith attention head, i.e., the mention-level attention. The mention-level attention is averaged to obtain the entity-level attention matrix

Represents the attention score of the i-th entity to all tokens.

As a preferred embodiment, further, the entity relationship of the target entity pair in the text data is obtained through the entity relationship extraction model, including: first, locating the key context of the given entity pair through the entity-level attention matrix, and obtaining the local context embedding vector of the given entity pair based on the context; then, the local context embedding vector is fused with the global representation of the entity, the entity type information and the distance information between entities to obtain the context embedding representation of the target entity pair; then, a nonlinear activation function is used to obtain the relationship probability of the given target entity pair.

Generate the entity type embedding matrix T and fuse the entity type information. The fusion process can be expressed as:

d₅为类型嵌入的维度。in

d ₅ is the dimension of type embedding.

For a given entity pair ( _es , _eo ), the attention matrix can be used to locate its important context and calculate the local context embedding of a specific entity pair. The specific process can be expressed as follows:

a ^{(s, o)} = q ^{(s, o)} /1 ^T q ^{(s, o)}

c ^(s，o) ＝Ha ^(s，o)

The local context embedding is fused with the global entity representation, type embedding, and distance embedding to obtain the embedding representation of a specific entity pair. The fusion process can be expressed as follows:

where d _so represents the relative distance between the first mention of entity s and entity o.

In order to reduce the number of parameters and computational complexity, the entity representations are evenly divided into k groups, and feature fusion is performed to obtain entity pair representations. The fusion process can be expressed as follows:

The nonlinear activation function sigmoid is used to obtain the relationship probability of a specific entity pair. The specific process can be expressed as:

Relation extraction can be viewed as a multi-label classification problem. Traditional baselines usually use binary cross entropy loss as the loss function and specify a global threshold as the criterion for whether a relationship label exists. However, for different entity pairs, the model may have different confidence levels for the relationship threshold, and it is difficult to meet the requirements using only the global threshold. To address this problem, a learnable adaptive threshold is introduced to effectively reduce decision errors in the inference process. For each entity pair ( _es , _eo ), the class with a score greater than the threshold is predicted as a positive class, and the rest is predicted as a negative class. On this basis, for the long-tail class, the adaptive Focal Loss in previous work is introduced, and the loss function can be expressed as follows:

Furthermore, based on the above method, an embodiment of the present invention also provides a document-level threat intelligence relationship extraction system based on feature enhancement, comprising: a model building module and a relationship extraction module, wherein:

A model building module, used to build an entity information extraction model and perform training optimization, wherein the entity information extraction model includes: a BERT model for encoding input text data to obtain a word entity mention context embedding vector of the text data, a fusion processing unit for enhancing the word entity mention context embedding vector by fusing the part-of-speech embedding vector and the entity width information and obtaining the entity global representation, and an entity relationship extraction model for fusing the local context embedding of a given entity pair with the entity global representation, entity type information and inter-entity spacing information to obtain the relationship probability of a given entity pair through a non-linear activation function;

The relationship extraction module is used to input the text data of the threat intelligence document to be processed into the trained and optimized entity information extraction model, obtain the word entity mention context embedding vector in the text data through the BERT model, use the fusion processing unit to fuse the part-of-speech embedding vector and entity width information with the word entity mention context embedding vector, and obtain the entity relationship of the target entity pair in the text data through the entity relationship extraction model.

In order to verify the effectiveness of this solution, the following is an explanation based on specific data:

In order to address the lack of public data sets in the field of cybersecurity, we collected 227 pieces of threat intelligence and manually annotated them based on a custom ontology. We selected 151 of them as training sets and the remaining 76 as test sets.

Using the content in this case solution, the pre-trained model Bert is used as the document encoder, and then the Nltk library in Python is used to generate part-of-speech tags, generate part-of-speech embeddings, and fuse them with the context embeddings generated by the encoder. Generate width embeddings and distance embeddings respectively, and fuse the width information of entity mentions and the distance information between entities. Use the logsumexp pooling operation to obtain the global representation of the entity. Generate entity type embeddings and fuse the type information of the entity. Use the attention matrix to locate important contexts and calculate the local context embeddings of specific entity pairs. Then fuse the local context embeddings with the global entity representation, type embeddings, and distance embeddings to obtain the embedding representation of the specific entity pair. Finally, use the classifier to obtain the relationship probability of the specific entity pair. The threat intelligence ontology is shown in Figure 4. The threat intelligence is input into the entity information extraction model, and the relationship between all entity pairs in the text is predicted to fill in the knowledge graph. The Neo4j graph database is used for presentation, and the results can be shown in Figure 5. Through the display of Figure 5, it can be further verified that the solution of this case can be applied to the analysis and processing of threat intelligence with complex structures, and can provide strong data support for situation awareness and active defense.

Unless otherwise specifically stated, the relative steps, numerical expressions and values of the components and steps set forth in these embodiments do not limit the scope of the present invention.

In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module/unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims (10)

1. A document-level threat intelligence relationship extraction method based on feature enhancement, characterized by comprising the following contents: Constructing an entity information extraction model and performing training optimization, wherein the entity information extraction model includes: a BERT model for encoding input text data to obtain a word entity mention context embedding vector of the text data, a fusion processing unit for enhancing the word entity mention context embedding vector by fusing part-of-speech embedding vectors and entity width information and obtaining a global representation of the entity, and an entity relationship extraction model for fusing a given entity pair's local context embedding with the entity's global representation, entity type information, and inter-entity spacing information to obtain a given entity pair's relationship probability through a nonlinear activation function; The text data of the threat intelligence document to be processed is input into the trained and optimized entity information extraction model, and the word entity mention context embedding vector in the text data is obtained through the BERT model. The part-of-speech embedding vector and entity width information are fused with the word entity mention context embedding vector using the fusion processing unit, and the entity relationship of the target entity pair in the text data is obtained through the entity relationship extraction model. 2. According to the feature-enhanced document-level threat intelligence relationship extraction method according to claim 1, it is characterized in that in the entity information extraction model training optimization, model training optimization is performed based on knowledge distillation, and the training optimization process includes: collecting sample label data, training the teacher model using the sample label data, and obtaining the teacher model by updating the teacher model parameters; then, performing knowledge distillation on the teacher model using the sample label data to obtain a student model, and using the student model as the entity information extraction model after training optimization. 3. According to the feature enhancement-based document-level threat intelligence relationship extraction method of claim 2, it is characterized in that the objective loss function in the training optimization is expressed as: L _RE =α ₁ L _AFL +α ₂ L _KD , wherein L _RE represents the total loss, L _AFL represents the adaptive loss of relation extraction as a multi-label separation problem, L _KD represents the knowledge distillation loss, and α ₁ and α ₂ are the weights of the adaptive loss and the knowledge distillation loss, respectively. 4. According to the feature-enhanced document-level threat intelligence relationship extraction method according to claim 1, it is characterized in that the word entity mention context embedding vector in the text data is obtained through the BERT model, which includes: first, the input document text data is segmented by a word segmenter to obtain a word entity set, and the entity mention is marked with a preset mention symbol; then, the pre-trained BERT model is used as an encoder to encode the word entities in the text data to generate an entity mention context embedding vector. 5. According to the feature-enhanced document-level threat intelligence relationship extraction method according to claim 1 or 4, it is characterized in that the part-of-speech embedding vector and entity width information are fused with the word entity mention context embedding vector using a fusion processing unit. First, the part-of-speech tag is obtained using a natural language processing tool, and the part-of-speech embedding vector of the word entity in the text data is generated using the part-of-speech tag, and the part-of-speech embedding vector is generated by fusing it with the context embedding vector to generate a vector representation enhanced by the part-of-speech embedding; then, the vector representation is enhanced by fusing the entity mention width information; then, for each entity, a global representation of the entity is obtained through a pooling operation. 6. According to the feature-enhanced document-level threat intelligence relationship extraction method described in claim 1, it is characterized in that, for the word entity mention context embedding vector fused with the part-of-speech embedding vector, the attention score of each mention element in the word entity mention context embedding vector is obtained based on a multi-head attention mechanism, the attention score of each mention element is used as the attention of the corresponding entity mention, and the entity-level attention matrix is obtained by averaging the entity mention attention, and the entity-level attention matrix is used to represent the attention score of the corresponding entity to all entity mentions. 7. According to the feature-enhanced document-level threat intelligence relationship extraction method described in claim 6, it is characterized in that the entity relationship of the target entity pair in the text data is obtained through the entity relationship extraction model, which includes: first, locating the key context of the given entity pair through the entity-level attention matrix, and obtaining the local context embedding vector of the given entity pair based on the context; then, the local context embedding vector is fused with the global representation of the entity, the entity type information and the distance information between entities to obtain the context embedding representation of the target entity pair; then, a nonlinear activation function is used to obtain the relationship probability of the given target entity pair. 8. According to the feature-enhanced document-level threat intelligence relationship extraction method of claim 7, it is characterized in that, in obtaining the relationship probability of a given entity pair using a nonlinear activation function, the context embedding representation of the target entity pair is first grouped and feature-fused to obtain an entity pair representation, and then the nonlinear activation function sigmoid is used to obtain the relationship probability of the given target entity pair. 9. A document-level threat intelligence relationship extraction system based on feature enhancement, characterized in that it comprises: a model building module and a relationship extraction module, wherein: A model building module, used to build an entity information extraction model and perform training optimization, wherein the entity information extraction model includes: a BERT model for encoding input text data to obtain a word entity mention context embedding vector of the text data, a fusion processing unit for enhancing the word entity mention context embedding vector by fusing the part-of-speech embedding vector and the entity width information and obtaining the entity global representation, and an entity relationship extraction model for fusing the local context embedding of a given entity pair with the entity global representation, entity type information and inter-entity spacing information to obtain the relationship probability of a given entity pair through a non-linear activation function; The relationship extraction module is used to input the text data of the threat intelligence document to be processed into the trained and optimized entity information extraction model, obtain the word entity mention context embedding vector in the text data through the BERT model, use the fusion processing unit to fuse the part-of-speech embedding vector and entity width information with the word entity mention context embedding vector, and obtain the entity relationship of the target entity pair in the text data through the entity relationship extraction model. 10. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 8 are implemented.

Images