Research And Implementation Of Few-Shot Relation Extraction Technology For Threat Intelligence Field

In recent years,network security incidents have increased due to the continuous development of the internet.The threat of network attacks has also increased with the emergence of new advanced persistent threats(APTs)that use complex and targeted attack methods.Network threat intelligence Relation extraction technology has become a popular research hotspot in the field of network security.This technology aims to identify the semantic relation between network security entities by analyzing and learning contextual information from threat intelligence texts.However,the relation extraction task in this field faces challenges such as a lack of data and high annotation costs.Models trained on small amounts of threat intelligence data often fail to meet expected standards.(1)To address the problem of a lack of threat intelligence data and high annotation costs,this thesis proposes a few-shot relation extraction based on threat intelligence domain(FRTI).The model adopts a meta-learning model architecture with a pre-trained language model and a prototype network at its core.The model encourages learning the ability of rapid learning from meta-training tasks and quickly applies it to new classification tasks.Meanwhile,this thesis constructs a threat intelligence dataset for model training and validates the feasibility of the proposed model through experiments on the dataset.(2)The thesis proposes a new prototype network model that improves the FRTI model through a multi-layer attention mechanism and a hybrid prototype network.The model highlights the important semantic features in the statement while reducing the impact of incorrect label samples on the model training,thereby enhancing the accuracy and robustness of the model.Experiments on the threat intelligence dataset show that the hybrid prototype FRTI-Matt model achieved an accuracy rate of 68.95% in the 5-way-1-shot task,which is 4.85% higher than other few-shot relation extraction models.The FRTI-Matt model outperforms other models in two few-shot scenarios.(3)The thesis further improves the FRTI model using self-training and contrastive learning methods,respectively,by improving the encoding layer and prototype network layer of the relation extraction model.The model gains more domain knowledge in the encoding phase and enhances the prototype network’s ability to classify similar sentence patterns.Experiments on the threat intelligence dataset show that the proposed model improvement methods increase the accuracy of the FRTI-Matt-CL-ST model by 5.11%and 5.41%,respectively,in two few-shot scenarios.Finally,the thesis demonstrates the practical application value of the proposed method and model by constructing a threat intelligence relation extraction system based on the FRTI-Matt-CL-ST model proposed in this study and verifying its applicability.