arXiv:2412.16484cs.CRcs.CL2024-12被引 1

构建专用于网络安全的问答数据集,提升信息抽取能力。

Automated CVE Analysis: Harnessing Machine Learning In Designing Question-Answering Models For Cybersecurity Information Extraction

  • 设计面向网络安全的专用问答数据集,支持精准信息提取。
  • 模型在多源安全数据库上实现高准确率,显著优于通用模型。
  • 适合安全研究人员与自动化威胁分析系统开发者使用。

大多数网络安全信息以非结构化文本形式存在,涵盖CVE、NVD、CWE、CAPEC及MITRE ATT&CK等关键数据库。这些数据对分析攻击模式和理解攻击行为至关重要。通过整合这些信息构建知识图谱可释放深层洞察,但处理海量数据需依赖先进的深度学习技术。其中,从非结构化文本中自动提取特定问题的答案是构建知识图谱的关键步骤。问答(QA)系统在此过程中发挥核心作用,能精确定位并提取信息,促进不同数据点间的关联映射。然而,网络安全领域的问答面临独特挑战,需基于大量领域特定信息进行语义理解与回答生成。为此,本文提出一个专用于网络安全的新型数据集,并训练了一个机器学习模型用于问答任务。文中还评估了模型性能与关键发现,在正式性与可读性间取得平衡。

原文摘要 · Abstract (English)

The vast majority of cybersecurity information is unstructured text, including critical data within databases such as CVE, NVD, CWE, CAPEC, and the MITRE ATT&CK Framework. These databases are invaluable for analyzing attack patterns and understanding attacker behaviors. Creating a knowledge graph by integrating this information could unlock significant insights. However, processing this large amount of data requires advanced deep-learning techniques. A crucial step towards building such a knowledge graph is developing a robust mechanism for automating the extraction of answers to specific questions from the unstructured text. Question Answering (QA) systems play a pivotal role in this process by pinpointing and extracting precise information, facilitating the mapping of relationships between various data points. In the cybersecurity context, QA systems encounter unique challenges due to the need to interpret and answer questions based on a wide array of domain-specific information. To tackle these challenges, it is necessary to develop a cybersecurity-specific dataset and train a machine learning model on it, aimed at enhancing the understanding and retrieval of domain-specific information. This paper presents a novel dataset and describes a machine learning model trained on this dataset for the QA task. It also discusses the model's performance and key findings in a manner that maintains a balance between formality and accessibility.

网络安全问答系统信息抽取

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。