Network security emergency response knowledge graph entity alignment method

Abstract

The invention discloses a network security emergency response knowledge graph entity alignment method, which comprises the following steps: inputting a knowledge graph into a PR module based on a PARIS model for calculation, and outputting a security event entity mapping set and a corresponding equivalence probability thereof; selecting a corresponding security event entity mapping with a high equivalence probability from the obtained security event entity mapping set as an alignment seed, and inputting the alignment seed into an SE module based on an embedded MultiKE model for training; outputting a security event entity mapping set obtained by security event entity embedding and through a proximity retrieval algorithm and a similarity score of each mapping corresponding to the security event entity mapping set; taking the obtained data as input to carry out the next round of calculation; after K iterations, the PR module outputs a security event entity mapping set; according to the scheme, a plurality of different network security emergency response knowledge maps can be fused into a knowledge map process with more comprehensive knowledge and higher correctness.

Description

technical field [0001] The invention relates to the field of network security knowledge graphs, in particular to a method for aligning network security emergency response knowledge graph entities. Background technique [0002] In recent years, network threats have become more and more frequent. The new generation of network threats has the characteristics of fast propagation, wide coverage, and long incubation time, which makes the staff of the network security emergency team face huge challenges. A routine incident response often involves multiple systems or programs. In the face of hundreds of cyber attacks every day, a large number of repeated manual operations are required, and the response efficiency is low. To this end, a new type of security emergency response technology SOAR is proposed. Based on the network security emergency response knowledge map, according to different threat scenarios, scripts are automatically programmed and generated to prevent attacks, which ...

AI Technical Summary

Problems solved by technology

The acquisition of these known mappings requires a lot of manual work, which is often not easy to obtain in practical applications.

In addition, this type of model predicts the mapping of each entity independently, ignoring the overall analysis and logical consistency, which usually leads to some wrong mappings

[0006] However, the traditional model based on reasoning and vocabulary matching, although it makes up for the lack of logical reasoning of the former, has a certain degree of scalability, and does not require training on known mappings, but lacks the graphical structure and context of knowledge graphs. ability to use information

Images