Distributed knowledge graph construction system and method based on knowledge body

Abstract

The invention discloses a distributed knowledge graph construction system and method based on a knowledge body, and the distributed knowledge graph construction system employs a soft component idea todecompose a knowledge graph into running knowledge bodies one by one, thereby constructing a knowledge body-based distributed knowledge graph, wherein a knowledge body factory is used for generatingand assembling knowledge bodies; a knowledge body library stores knowledge bodies and establishes a directory index; a knowledge body search device is used for searching the knowledge bodies from a knowledge body directory and searching basic components from a component library; a knowledge body deployer is used for deploying the knowledge bodies into a knowledge body container for running; and the directory service is used for registering the running knowledge bodies into the knowledge body directory. The constructed distributed network security knowledge graph supports nearby network security knowledge matching and network security event discovery, and a plurality of knowledge bodies can interact with one another, and collaborative calculation and collaborative reasoning of multi-knowledge-body face-to-face tasks are also supported, so that complex attacks and larger-scale network security events are discovered.

Description

technical field [0001] The invention relates to the technical field of network and information security, in particular to a system and method for constructing a distributed knowledge graph based on a body of knowledge. Background technique [0002] Network security incidents occur frequently in cyberspace and have a huge impact. Therefore, all walks of life and departments in cyberspace, such as government affairs, finance, e-commerce, banking, transportation, etc., have deployed firewalls, intrusion Various security products such as detection and antivirus. At present, various security products report to the police for network security incidents or network attacks discovered locally, but the attacks detected by these security products lack mutual correlation, and there is also a lack of corresponding correlation between attacks, assets, and system status. For example, network attacks are related to asset vulnerabilities. If the assets targeted by the network attack have th...

AI Technical Summary

Problems solved by technology

However, this existing technology faces some problems: (1) The network security knowledge graph has a huge scale, low matching and query performance, and it is difficult to discover network security events in real time

(2) The centralized storage of the network security knowledge graph makes it necessary to access the remote network security knowledge graph for the matching of all network security events, resulting in a large amount of data transmission, a large amount of concurrent access, and low efficiency.

Images