软件安全漏洞知识图谱构建方法  

Construction approach of knowledge graph for software security vulnerability

作　　者：郭军军[1] 王乐 王正源 姚大春 王长元[1] GUO Jun-jun;WANG Le;WANG Zheng-yuan;YAO Da-chun;WANG Chang-yuan(School of Computer Science and Engineering,Xi’an Technological University,Xi’an 710021,China;School of Information Engineering,Chang’an University,Xi’an 710064,China)

机构地区：[1]西安工业大学计算机科学与工程学院,陕西西安710021 [2]长安大学信息工程学院,陕西西安710064

出　　处：《计算机工程与设计》2022年第8期2137-2145,共9页Computer Engineering and Design

基　　金：国家自然科学基金项目(52072293);陕西省重点研发计划基金项目(2018GY-023);陕西省教育厅科研计划基金项目(19JC021);西安市科技计划基金项目(2020KJRC0039)。

摘　　要：为解决当前漏洞数据利用率低、漏洞语义信息不够丰富、分析手段欠缺等问题,提出一种软件安全漏洞知识图谱构建方法。设计本体模型,利用网络爬虫对NVD和CVE漏洞库进行数据采集与预处理,通过基于规则方法与深度学习BiLSTM-CRF模型进行实体识别,进行关系抽取以及知识融合,将所获得的知识存储在Neo4j图数据库中。实验结果表明,所提方法简单有效,可广泛应用于漏洞挖掘等领域。Aiming at the low utilization rate of current vulnerability data,insufficient vulnerability semantics and lack of analysis methods,a software security vulnerability knowledge graph construction approach was proposed.Ontology model of vulnerability knowledge graph was designed.The data of NVD(national vulnerability database)and CVE(common vulnerabilities exposures)were collected and preprocessed by web crawler.The entity recognition was performed by combining rule-based method with deep learning BiLSTM-CRF model.The relationship extraction and knowledge fusion were carried out.The obtained knowledge was stored in the Neo4j graph database.The results show that the proposed method is simple and effective,which can be widely used in the fields such as vulnerability mining.

关 键 词：本体 深度学习 实体识别 知识图谱 漏洞挖掘 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]