Multi-source heterogeneous network security knowledge graph construction method and device

Abstract

The invention discloses a multi-source heterogeneous network security knowledge graph construction method and device, and the method comprises the steps: responding to a triggering request for constructing a network security knowledge graph, and extracting matched entities and entity relationships from the semi-structured data set and the structured data set according to the entities and entity relationships defined by a preset network security knowledge ontology to generate a triple; identifying entities matched with the entities defined by the network security knowledge ontology from the unstructured data set according to different categories of the entities and a preset identification mode, wherein data in the unstructured data set is text data; inputting the text data into a word vector recognition model to obtain a word vector of each entity; extracting a model according to the entity pairs selected by a preset rule and a corresponding word vector input relationship to obtain relationships among the entity pairs, and generating a triple fusing the word vectors of the entities according to the entity pairs, the corresponding word vectors and the relationships among the entity pairs; and constructing a network security knowledge graph according to each triad.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a method and device for constructing a multi-source heterogeneous network security knowledge map. Background technique [0002] With the development of the big data era and the increasingly complex network security environment, network attacks occur frequently. In order to ensure the security of network space, enterprises monitor the security threats in the network by deploying various business systems such as firewalls, intrusion detection, and intrusion protection. Real-time monitoring of viruses, attacks, loopholes, vulnerabilities, etc., generates a large amount of network security event data such as alarm information and monitoring logs. At the same time, there is a large amount of information and knowledge related to network security in the network, such as the network security vulnerability data set CVE (Common Vulnerabilities and Exposures, public vul...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the problem in the prior art that the reliability of the constructed multi-source heterogeneous network security knowledge graph is low due to the low accuracy of knowledge extra

Images