Network security knowledge graph generation method based on threat intelligence

Abstract

The invention belongs to the technical field of industrial control network security, and particularly relates to a network security knowledge graph generation method based on threat intelligence. Comprising the steps of collecting high-efficiency distributed threat intelligence data; making a network security threat intelligence data set through a distributed threat intelligence crawling system; improving the network security threat intelligence data quality; performing network security entity identification on the manufactured network security threat intelligence data set; extracting a network security entity relationship; and organizing data. Through a large number of experiments, it is verified that the threat intelligence data quality improvement algorithm, network security threat intelligence, entity recognition and entity relation extraction in an intelligence text and the quality of a generated knowledge graph are all remarkably improved; and the invention has good local network weakness visualization capability and attack pre-judgment analysis capability.

Description

technical field [0001] The invention belongs to the technical field of industrial control network security, and in particular relates to a method for generating a network security knowledge graph based on threat intelligence. Background technique [0002] With the rapid development of network technology, all walks of life have introduced a large number of network technologies to improve productivity, followed by network security issues. As the network security situation becomes increasingly complex, threat intelligence-driven network security dynamic defense has become the focus of the industry. Threat intelligence has the characteristics of rich data content, high accuracy, and strong real-time performance, and can often reflect the attack chain of the entire attack event, so it has extremely high application and analysis value. [0003] As a comprehensive data integration and organization method, knowledge graph can effectively extract attack information from massive thre...

AI Technical Summary

Problems solved by technology

[0006] 1. Low data quality, high data false positive rate, and missing or wrong attributes of data entities are common problems in open source threat intelligence on the Internet.

Low-quality threat intelligence data will inevitably lead to the problem of low quality of the generated network security knowledge map, which cannot correctly perceive the network security situation and make wrong predictions about the current network attack behavior

The current data quality improvement algorithm mainly relies on the truth-value discovery algorithm, which is mostly used in the single-truth discovery problem, and cannot adapt to the situation that entities in the network security threat intelligence data have multiple truth values ​​and the network security threat intelligence data has strong temporal The traditional truth discovery algorithm assumes that the truth does not change with time. This assumption of weak sensitivity to time changes will inevitably lead to the inability of the existing truth discovery algorithms to adapt to the quality improvement of network security threat intelligence data.

[0007] 2. The existing entity recognition and entity relationship extraction methods are mainly based on traditional rule recognition, machine learning and the recently popular deep learning methods, which require a large number of labeled text data samples and require high data quality

Although the above methods have been widely used in other fields such as natural language processing, due to the lack of large-scale high-quality security entity labeling data in the field of network security, the mixing of multiple entity types in the data, and the different entity category labels in the full text of the data, etc. , making it difficult to apply the above method to entity recognition and entity relationship extraction in the field of network security

[0008] At present, there are no effective network security entity recognition and entity relationship extraction methods in the field of network security.

Images