A network security emergency response knowledge map entity alignment method

Abstract

The invention discloses a network security emergency response knowledge map entity alignment method, which includes: inputting the knowledge map into a PR module based on the PARIS model for calculation, and outputting a security event entity mapping set and its corresponding equivalent probability; In the security event entity mapping set, select the corresponding security event entity mapping with high equivalent probability as the alignment seed, input the SE module based on the embedded MultiKE model for training; output the security event entity embedding and the security event obtained by the proximity retrieval algorithm The entity mapping set and the similarity score of each corresponding mapping; the obtained one is used as input for the next round of calculation; after K iterations, the PR module outputs the security event entity mapping set; this scheme can combine multiple different network The safety emergency response knowledge map is fused into a knowledge map with more comprehensive knowledge and higher accuracy.

Description

technical field [0001] The invention relates to the field of network security knowledge map, in particular to a network security emergency response knowledge map entity alignment method. Background technique [0002] In recent years, the problem of network threats has become more and more frequent. The new generation of network threats has the characteristics of fast spreading, wide coverage and long latency, which makes the staff of the network security emergency response team face huge challenges. A routine incident response often involves multiple systems or procedures. Facing hundreds of thousands of network attacks every day, a large number of repetitive manual operations are required, resulting in low response efficiency. To this end, a new security emergency technology SOAR is proposed. Based on the knowledge map of network security emergency response, according to different threat scenarios, scripts are automatically generated to prevent attacks, which greatly saves ...

AI Technical Summary

Problems solved by technology

The acquisition of these known mappings requires a lot of manual work, which is often not easy to obtain in practical applications.

In addition, this type of model predicts the mapping of each entity independently, ignoring the overall analysis and logical consistency, which usually leads to some wrong mappings

[0006] However, the traditional model based on reasoning and vocabulary matching, although it makes up for the lack of logical reasoning of the former, has a certain degree of scalability, and does not require training on known mappings, but lacks the graphical structure and context of knowledge graphs. ability to use information

Images