Transformer assisted joint entity and relation extraction
Systems and methods are provided for adapting a pretrained language model to perform cybersecurity-specific named entity recognition and relation extraction. The method includes introducing a pretrained language model and a corpus of security text to a model adaptor, and generating a fine-tuned language model through unsupervised training utilizing the security text corpus. The method further includes combining a joint extraction model from a head for joint extraction with the fine-tuned language model to form an adapted joint extraction model that can perform entity and relation label prediction. The method further includes applying distant labels to security text in the corpus of security text to produce security text with distant labels, and performing Distant Supervision Training for joint extraction on the adapted joint extraction model using the security text to transform the adapted joint extraction model into a Security Language Model for name-entity recognition (NER) and relation extraction (RE).
1. A method of adapting a pretrained language model to perform cybersecurity-specific named entity recognition and relation extraction, comprising:
introducing a pretrained language model and a corpus of security text to a model adaptor;
generating a fine-tuned language model through unsupervised training on the pretrained model by the model adapter utilizing the security text corpus;
combining a language model from a head for joint extraction with the fine-tuned language model to form an adapted joint extraction model that can perform entity and relation label prediction by retraining the adapted joint extraction model to predict masked sentences from security text;
generating distant labels by applying noise, including false positives and false negatives, to security text in the corpus of security text aligned with security knowledge bases through similarity to produce security text with distant labels; and
performing Distant Supervision Training for joint extraction on the adapted joint extraction model using the security text with the distant labels to transform the adapted joint extraction model into a Security Language Model for name-entity recognition (NER) and relation extraction (RE) by:
predicting entity labels for determined important tokens in a query word based on position-aware and context-aware representations generated using position attention that encodes query entity information and context information of a query sentence;
calculating confidence scores for the entity labels by determining indicative relation pattern phrases from labeled sentences through relation pattern discovery; and
training the adapted joint extraction model with a training dataset that includes labeled sentences with the entity labels having confidence scores above a quality threshold.
2. The method of claim 1 , wherein the pretrained model is GPT-2.
3. The method of claim 2 , wherein applying labels to security text utilizes a security ontology that provides a schema of structured knowledge, wherein the security ontology includes entity types and relations for cybersecurity and used as labels on the cybersecurity text.
4. The method of claim 3 , wherein there are eight entity types, that include: (1) VULN denoting a vulnerability entity; (2) ACTOR denoting malicious actors that pose threats; (3) THREAT denoting a descriptive entity of threats to a target system; (4) FUNCTION denoting a program function name that appears in security-related reports; (5) FILE denoting a filename; (6) PRODUCT denoting a product name; (7) VERSION denoting a version number of the product; and (8) OBJECT denoting miscellaneous entities.
5. The method of claim 4 , wherein there are seven relation types, that include: (1) VULN_RESULTS_IN_THREAT indicating a potential causal relation between VULN and THREAT entities; (2) VULN_AFFECTS_PRODUCT indicating an effect of a VULN entity on a PRODUCT entity; (3) VULN_HAS_ROOT_CAUSE_IN_FUNCTION indicating a causal relation between VULN and FUNCTION entities; (4) VULN_HAS_ROOT_CAUSE_IN_FILE indicating a causal relation between VULN and FILE entities; (5) ACTOR_EXPLOITS_VULN indicating that an ACTOR entity exploits a VULN entity; (6) THREAT_INVOLVES_OBJECT indicating that a THREAT entity involves one or more OBJECT entities in a course of an instance of cyberattack; and (7) PRODUCT_HAS_VERSION indicating a PRODUCT entity has a specific VERSION.
6. The method of claim 3 , further comprising distant label generation, wherein distant label generation takes in unlabeled security text, and automatically generates the distant labels for entities and relations in accordance with the security ontology and in reference to Knowledge bases.
7. The method of claim 6 , wherein the fine-tuned language model extracts named entities and relations jointly from the corpus of security text.
8. The method of claim 7 , wherein the GPT-2 is a multilayer bidirectional Transformer that converts an input sequence of the cybersecurity text into token-level representations, H 0 ={h t } t=1 T , where h t ∈ d is a d-dimensional vector corresponding to a t-th token in a cybersecurity text sentence.
9. The method of claim 8 , wherein for a given input security text sentence, S={w t } t=1 T , an entity pair (e 1 , e 2 ) in S, a relation label, y, and a relation pattern, m, that explains the relation y of e 1 to e 2 , a corresponding attention guidance score, a m , is calculated according to a pattern mention significance conditional on the relation pattern, m.
10. The method of claim 9 , wherein each transformer layer of the multilayer bidirectional Transformer includes a multi-head self-attention operation.
11. A method of adapting a pretrained language model to perform cybersecurity-specific named entity recognition and relation extraction, comprising:
introducing a pretrained GPT-2 language model and a corpus of security text to a model adaptor, wherein the GPT-2 is a multilayer bidirectional Transformer that converts an input sequence of a cybersecurity text into token-level representations, H 0 ={h t } t=1 T , where h t ∈ d is a d-dimensional vector corresponding to a t-th token in a cybersecurity text sentence;
generating a fine-tuned language model through unsupervised training on the pretrained model by the model adapter utilizing the security text corpus;
combining a language model from a head for joint extraction with the fine-tuned language model to form an adapted joint extraction model that can perform entity and relation label prediction by retraining the adapted joint extraction model to predict masked sentences from security text;
generating distant labels by applying noise, including false positives and false negatives, to security text in the corpus of security text to produce security text with distant labels; and
performing Distant Supervision Training for joint extraction on the adapted joint extraction model using the security text with the distant labels to transform the adapted joint extraction model into a Security Language Model for name-entity recognition (NER) and relation extraction (RE) by:
predicting entity labels for determined important tokens in a query word based on position-aware and context-aware representations generated using position attention that encodes query entity information and context information of a query sentence;
calculating confidence scores for the entity labels by determining indicative relation pattern phrases from labeled sentences through relation pattern discovery; and
training the adapted joint extraction model with a training dataset that includes labeled sentences with the entity labels having confidence scores above a quality threshold.
12. The method of claim 11 , wherein each transformer layer of the multilayer bidirectional Transformer includes a multi-head self-attention operation.
13. The method of claim 12 , wherein applying labels to security text utilizes a security ontology that provides a schema of structured knowledge, wherein the security ontology includes entity types and relations for cybersecurity and used as labels on the cybersecurity text.
14. The method of claim 13 , wherein there are eight entity types, that include: (1) VULN denoting a vulnerability entity; (2) ACTOR denoting malicious actors that pose threats; (3) THREAT denoting a descriptive entity of threats to a target system; (4) FUNCTION denoting a program function name that appears in security-related reports; (5) FILE denoting a filename; (6) PRODUCT denoting a product name; (7) VERSION denoting a version number of the product; and (8) OBJECT denoting miscellaneous entities.
15. The method of claim 14 , wherein there are seven relation types, that include: (1) VULN_RESULTS_IN_THREAT indicating a potential causal relation between VULN and THREAT entities; (2) VULN_AFFECTS_PRODUCT indicating an effect of a VULN entity on a PRODUCT entity; (3) VULN_HAS_ROOT_CAUSE_IN_FUNCTION indicating a causal relation between VULN and FUNCTION entities; (4) VULN_HAS_ROOT_CAUSE_IN_FILE indicating a causal relation between VULN and FILE entities; (5) ACTOR_EXPLOITS_VULN indicating that an ACTOR entity exploits a VULN entity; (6) THREAT_INVOLVES_OBJECT indicating that a THREAT entity involves one or more OBJECT entities in a course of an instance of cyberattack; and (7) PRODUCT_HAS_VERSION indicating a PRODUCT entity has a specific VERSION.
16. The method of claim 15 , wherein for a given input security text sentence, S={w t } t=1 T , an entity pair (e 1 , e 2 ) in S, a relation label, y, and a relation pattern, m, that explains the relation y of e 1 to e 2 , a corresponding attention guidance score, a m , is calculated according to a pattern mention significance conditional on the relation pattern, m.
17. The method of claim 16 , wherein each transformer layer of the multilayer bidirectional Transformer includes a multi-head self-attention operation.
18. The method of claim 17 , wherein for a sequence of labels y={y t } t=1 T , a decoding score, score (Z, y), is calculated as a sum of a transition score from a tag y t to a tag y t+1 , plus an input score z t y t for each token position t.
19. The method of claim 18 , wherein a tag sequence y* is computed using a Viterbi algorithm.