用可追溯的图文对齐训练模型,高效构建网络安全知识图谱。
GRID: Graph Representation of Intelligence Data for Security Text Knowledge Graph Construction

- 通过图文对齐生成领域监督信号,解决长文本转图谱难题。
- 任务银行奖励机制使模型在249篇数据上达68.53%平均F1,召回率最优。
- 支持离线复用奖励,降低训练成本,适合安全领域研究者使用。
安全知识图谱能为安全代理提供可计算的外部记忆,但从长篇网络安全情报(CTI)中构建仍具挑战:大模型缺乏扎实的安全领域知识,且端到端文档到图谱训练难以获得廉价稳定的奖励。本文提出GRID(情报数据的图表示),一个端到端的安全文本知识图谱构建框架。GRID首先通过图提取与知识图条件化文本修订,在CTI文章中建立可追溯的文章-图对齐,构建安全领域监督信号;随后将文档到图学习转化为包含四选一多选题与三元组级正则匹配目标的任务银行,相比反复使用大模型评分完整图谱输出,获得更稳定的任务特定奖励。基于此监督流程,我们训练了两个基于Qwen3-4B-Instruct-2507的4B抽取器:主任务银行奖励模型与次级端到端奖励模型(以大模型作为裁判,评估精确率/召回率)。在来自GRID、CASIE、CTINexus、MalKG和SecureNLP的249篇CTI文章上,任务银行奖励模型结合本体引导的GRID提取流程,达到84.62%源平均精确率、64.91%源平均召回率、68.53%平均F1,实现最高源平均召回率与接近顶尖的平均F1,同时减少令牌消耗与部署成本。端到端奖励模型表现为76.91%精确率、53.85%召回率、58.06%平均F1。进一步分析表明,任务银行奖励可一次性离线构建并重复用于后续微调,优于在线端到端大模型裁判奖励及仅选择题奖励或无强化学习的端到端SFT方案。
原文摘要 · Abstract (English)
Security knowledge graphs can provide computable external memory for security agents, but constructing them from long-form cyber threat intelligence (CTI) remains difficult: LLMs often lack grounded security-domain knowledge, and end-to-end document-to-graph training is hard to supervise with cheap, stable rewards. We present GRID (Graph Representation of Intelligence Data), an end-to-end framework for security text knowledge graph construction. GRID first builds security-domain supervision from CTI articles by creating traceable article-graph alignments through graph extraction and knowledge-graph-conditioned text revision. It then turns document-to-graph learning into a scripted task bank combining four-option multi-select questions with triple-level regex matching targets, yielding more stable task-specific rewards than repeatedly scoring full graph outputs with an LLM judge. Using this supervision pipeline, we train two Qwen3-4B-Instruct-2507-based 4B extractors: a primary Task-bank Reward model and a secondary End2End Reward model with LLM-as-judge precision/recall rewards. On 249 CTI articles from GRID, CASIE, CTINexus, MalKG, and SecureNLP, the Task-bank Reward model with the ontology-guided GRID extraction pipeline reaches 84.62% source-averaged precision, 64.91% source-averaged recall, and 68.53% Avg F1, achieving the best source-averaged recall and near-top Avg F1 with lower token usage and deployment cost. The End2End Reward model reaches 76.91% precision, 53.85% recall, and 58.06% Avg F1. Further analyses show that task-bank rewards can be built once offline and reused across later post-training runs, outperforming online End2End LLM-as-judge reward and weaker alternatives such as Choice-only Reward and End2End SFT without RL.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。