Network threat knowledge graph construction method based on SecBABC

Abstract

The invention discloses a network threat knowledge graph construction method based on SecBABC. The method can be applied to construction of a network threat knowledge graph. The method comprises the following steps: collecting existing network information, and constructing a network threat domain ontology CTDOM according to an STIX network threat information standard; the method comprises the following steps: constructing a SecBABC knowledge extraction model, capturing a complex semantic relationship between network threat intelligence through a pre-training model SecBert, constructing an adversarial training sample by using PGD, optimizing semantic understanding errors and inaccuracy conditions, updating model parameters through BiLSTM, and finally decoding entities and relationships of the network threat intelligence through CRF; constructing an entity alignment algorithm EAABNA, and performing knowledge fusion from two aspects of entity names and entity attributes; and constructing a network threat knowledge graph by using the fused network threat knowledge. By applying the knowledge extraction model constructed by the method, network threat intelligence can be effectively identified and extracted, and the efficiency and accuracy of knowledge graph construction are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular to a method for constructing a network threat knowledge graph based on SecBABC. Background Art

[0002] In recent years, with the rapid development of network technology, network attacks and exploits have become increasingly complex and frequent, greatly endangering user privacy and security. As of October 2023, the number of ransomware in the world has increased by 37.75%, and the effective attack load of ransomware has increased by 57.5%, setting a record high. At the same time, the application of generative artificial intelligence technology has greatly reduced the threshold of network attacks, making network security defense face more complex and intelligent threats. Therefore, it is of great significance to integrate and analyze network security intelligence, evaluate and manage network security risks, which can help security practitioners better prevent network attack threats and improve the overall level of network security.

[0003] The network threat knowledge graph is a network security knowledge graph that integrates and stores relevant knowledge in the network security field, and provides a comprehensive information view in a visual form to better understand and evaluate network security threats. The key technologies of the network threat knowledge graph mainly include three parts: knowledge extraction, knowledge fusion, and graph application.

[0004] Knowledge extraction is the first step in building a knowledge graph, and its goal is to extract valuable information from different sources and different structures. In the early days, knowledge was mainly extracted based on the scale template method. Although this method can extract high-quality knowledge, it requires experts to write rule templates and requires manual extraction, which is time-consuming and has poor portability. In recent years, deep learning has gradually become the mainstream method for knowledge extraction. Neural networks can automatically extract features, eliminate the dependence on manual rule templates, and are more flexible and scalable. BiLSTM-CRF is a classic named entity recognition model. By combining two independent LSTMs to capture contextual information in the input sequence, it can better understand the dependency relationship of words in the context and effectively extract knowledge, but there is still a problem of insufficient recognition accuracy. With the development of pre-trained models, the field of knowledge extraction has also ushered in major changes. The pre-trained model based on the Transformer architecture is trained and learned on large-scale texts, which significantly improves the accuracy of knowledge extraction, but low-quality knowledge will affect the model training process and reduce recognition accuracy.

[0005] The main research content of knowledge fusion in knowledge graph is data fusion. Since the sources of knowledge extraction are different, the same knowledge may be extracted. It is necessary to use knowledge fusion methods to merge such data, reduce duplicate redundant data, and improve the reliability of knowledge graph. Currently, similarity function-based and probability-based data fusion methods are commonly used. Similarity function-based methods include token-based similarity function, edit distance-based similarity function, etc. Probability-based methods include conditional random fields, probability propagation models, etc. These methods do not analyze entity characteristics and have poor alignment effects.

[0006] The research on cyber threat knowledge graph is still in its infancy. Oak Ridge Laboratory in the United States extracted relevant concepts and relationships based on its own cyber intelligence platform and constructed a cyber security knowledge graph Stucco. This graph not only helps to better understand cyber threats, but also provides strong auxiliary support for intelligent decision-making. MITRE Corporation built the CyGraph system, which provides strong support for core tasks such as attack surface identification and attack situation understanding in the field of critical asset protection in a graphical way. Jia et al. proposed a five-tuple model of cyber security knowledge base and successfully constructed a cyber security knowledge ontology based on this model. They used a path-based sorting algorithm for entity attribute reasoning, but the recognition effect of cyber security entities was not good, which affected the quality of the knowledge graph. Some scholars integrated public knowledge such as Common Vulnerability Enumeration (CWE), Common Vulnerability Exposures (CVE), and Common Attack Pattern Enumeration and Classification (CAPEC) to construct a cyber security knowledge graph SEPSES, but did not include cyber threat intelligence, which to a certain extent limited the breadth of its knowledge scope.

[0007] In summary, although there have been a large number of studies related to network threat knowledge graphs, there are still some issues that deserve attention: (1) The methods of entity recognition in the field of network threats need to be improved. Due to the rapid update and iteration of network attacks, the existing entity recognition methods have poor recognition effects when facing new attack technologies and network threats, which in turn affects the overall quality and credibility of the knowledge graph; (2) The performance of the current pre-trained recognition model depends to a large extent on the quality of the training data. However, network threat intelligence has the characteristics of multi-source heterogeneity and uneven data quality. Low-quality network threat intelligence will affect the accuracy of recognition; (3) The entity alignment method in the field of network threats is too simple and does not comprehensively consider the characteristics of the entities. The knowledge fusion effect is poor, which affects the overall quality and credibility of the knowledge graph. Summary of the invention

[0008] The purpose of the present invention is to provide a method for constructing a network threat knowledge graph based on SecBABC in order to solve the problems existing in the above-mentioned prior art. The data sources of the method include public vulnerability databases, network threat intelligence and security knowledge of network security blogs, so as to expand the coverage of the network threat knowledge graph. At the same time, named entity recognition and relationship extraction are performed based on the SecBABC model, and entity alignment is performed through the EAABNA algorithm, which can effectively improve the accuracy of knowledge extraction and improve the quality of knowledge graph construction.

[0009] The technical solution to achieve the purpose of the present invention is: a method for constructing a network threat knowledge graph based on SecBABC, the method comprising the following steps:

[0010] Step 1: Obtain network threat intelligence, preprocess the intelligence data, and build a data set;

[0011] Step 2, extract relevant features from the data set, and build a network threat domain ontology model CTDOM based on the characteristics of the target network according to the STIX network threat intelligence standard;

[0012] Step 3, construct the network threat knowledge extraction model SecBABC;

[0013] Step 4: Use the SecBABC model to extract knowledge from threat attack intelligence;

[0014] Step 5: construct the entity alignment algorithm EAABNA to perform knowledge fusion processing on the extracted knowledge from the aspects of entity name and entity attribute;

[0015] Step 6: Import the integrated knowledge into the neo4j graph database to store the network threat knowledge graph and realize graph visualization.

[0016] Furthermore, the network threat domain ontology model CTDOM in step 2 is defined as a four-tuple model as shown in the following formula:

[0017] CTDOM=<Entities,Properties,Relations,Axioms>

[0018] Among them, Entities represents the set of entity classes in the network threat domain ontology, Properties represents the set of attribute classes corresponding to the entity class, Relations represents the set of relationships between entity classes, and Axioms represents the set of axioms existing in the network threat domain ontology.

[0019] Furthermore, the network threat knowledge extraction model SecBABC in step 3 includes a pre-training model SecBer, a projected gradient descent adversarial training method PGD, a bidirectional long short-term memory network model BiLSTM and a conditional random field model CRF;

[0020] The steps of constructing the network threat knowledge extraction model SecBABC include:

[0021] Step 3.1, SecBABC uses the network security pre-training model SecBert to convert the input text into word embedding representation, paragraph embedding representation and position embedding representation, and finally outputs a threat intelligence representation sequence. The specific input Input (SecBert) and output Output (SecBert) are as follows:

[0022]

[0023] Among them, Set(threat) represents the network threat intelligence set, Set(T SecSeq ) represents a set of network threat intelligence representation sequences;

[0024] Step 3.2, add the PGD adversarial training module, input the threat intelligence representation sequence into PGD, and generate adversarial samples. The specific input Input(PGD) and output Output(PGD) are as follows:

[0025]

[0026] Among them, Set(T SecSeq ) represents a sequence set of network threat intelligence, Set(AT SecSeq ) represents the set of adversarial sequences;

[0027] Step 3.3: Input the threat intelligence corpus and adversarial samples into the BiLSTM model for training, update the model parameters through the back-propagation algorithm, and output the hidden state sequence of the entire vector sequence. The specific input Input (BiLSTM) and output Output (BiLSTM) are as follows:

[0028]

[0029] Among them, Set(T SecSeq ) represents a sequence set of network threat intelligence, Set(AT SecSeq ) represents the set of adversarial sequences, Set(H SecSeq ) represents the hidden state sequence of the output;

[0030] Step 3.4: Decode the optimal label sequence through the CRF layer. The specific input (CRF) and output (CRF) of the model are as follows:

[0031]

[0032] Among them, Set(H SecSeq ) represents the hidden state sequence of the output, Set(T threat ) represents the optimal label sequence set.

[0033] Furthermore, the use of the SecBABC model to extract knowledge from threat attack intelligence in step 4 is specifically: using the SecBABC model to extract knowledge from semi-structured and unstructured threat intelligence, extracting entities and relationships related to threat attacks, specifically including:

[0034] Step 4.1, input the acquired network threat intelligence into the preprocessing layer to perform data processing and BIO annotation on the corpus;

[0035] Step 4.2, input the processed network threat intelligence into the SecBert pre-training model, and the SecBert pre-training model learns semantic information;

[0036] Step 4.3, using the PGD adversarial training method to generate adversarial samples by perturbing the original samples;

[0037] Step 4.4, input the adversarial sample and threat intelligence corpus into the BiLSTM model, use its bidirectional structure to capture long-distance and contextual semantic features, and output the hidden state sequence of the entire vector sequence, including the forward and reverse hidden states at each time step;

[0038] In step 4.5, the hidden state sequence output by the BiLSTM model is input to the CRF layer, the conditional probability of each label under a given sequence is calculated according to the labels generated by the BIO annotation method, the label sequence with the highest probability is decoded and found, and finally the optimal label sequence, i.e., the threat attack ontology and relationship, is output.

[0039] Furthermore, in step 5, the entity alignment algorithm EAABNA is constructed to perform knowledge fusion processing on the extracted knowledge from two aspects of entity name and entity attribute, specifically including:

[0040] Step 5.1, calculate the entity name similarity by using the edit distance and Jaccard algorithm;

[0041] Step 5.2, represent each attribute of the network threat ontology as a high-dimensional vector, merge the vectors of different attributes into a comprehensive attribute vector, and calculate the entity attribute similarity;

[0042] Step 5.3, combine entity name similarity and entity attribute similarity to calculate the final entity similarity.

[0043] Compared with the prior art, the present invention has the following significant advantages:

[0044] 1) This invention collects multi-source security intelligence such as public vulnerability databases and network threat intelligence, and combines it with existing network threat intelligence frameworks such as STIX to construct a network threat ontology, which greatly expands the coverage of the network threat knowledge graph.

[0045] 2) The present invention extracts knowledge through the SecBABC model, which integrates the pre-trained model SecBert. By utilizing the rich knowledge pre-learned by SecBert on large-scale data sets, the resource consumption in the training process is significantly reduced and the convergence speed of the model is accelerated. At the same time, the adversarial training module is innovatively introduced, which can effectively resist the interference of low-quality network intelligence, further enhance the robustness and adaptability of the model, and effectively improve the accuracy of knowledge extraction.

[0046] 3) The present invention utilizes the entity alignment algorithm EAABNA, which starts from two key dimensions: the semantic similarity of entity names and the multi-dimensional matching of entity attributes, accurately calculates the similarity between entities, effectively identifies and merges duplicate entities, and ensures the accuracy and uniqueness of entity information in the knowledge graph.

[0047] In summary, the present invention integrates multi-source security information, uses efficient knowledge extraction technology and precise entity alignment strategy, and not only builds a comprehensive and rigorous network threat knowledge graph. Through this knowledge graph, enterprises and organizations can gain a clear insight into the network threat situation and provide solid data support for the formulation of targeted prevention strategies. At the same time, the structured characteristics of the knowledge graph also facilitate the rapid retrieval and correlation analysis of threat information, and can quickly respond to and effectively deal with various network threats.

[0048] The present invention is further described in detail below in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Flowchart of the method for constructing the network threat knowledge graph based on SecBABC.

[0050] Figure 2 FIG. 4 is a schematic diagram of the specific structure of the SecBABC model in an embodiment.

[0051] Figure 3 A schematic diagram of a network threat domain ontology CTDOM constructed in one embodiment.

[0052] Figure 4This is a comparison chart of the experimental results of SecBABC and other methods in an embodiment.

[0053] Figure 5 A schematic diagram of windows_server_2012 vulnerability knowledge queried in building a network threat knowledge graph in an embodiment.

[0054] Figure 6 A schematic diagram of attack techniques and vulnerabilities related to CAPEC-467 queried in a network threat knowledge graph is constructed in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] It should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0057] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0058] In one embodiment, in combination Figure 1 , provides a method for constructing a network threat knowledge graph based on SecBABC, the method comprising the following steps:

[0059] Step 1: Obtain network threat intelligence, preprocess the intelligence data, and build a data set;

[0060] Here, semi-structured and unstructured intelligence text data are obtained from existing vulnerability databases, public network intelligence and other channels;

[0061] Existing public vulnerability libraries include the National Vulnerability Database (NVD), Common Vulnerabilities and Exposures Database (CVE), Common Weakness Enumeration (CWE), Common Attack Pattern Enumeration and Classification (CAPEC), and Common Platform Enumeration (CPE). Existing public network intelligence platforms include the Open Threat Exchange (OTX), github APT reports, etc. Network security blogs such as Talos blog, etc. For public vulnerability libraries, some have data download interfaces that can directly download the corresponding vulnerability data. For network intelligence and network blogs, crawler technology is used to crawl the text data of the corresponding website, and different crawler algorithms need to be designed for different websites.

[0062] Step 2, extract relevant features from the data set, and build a cyber threat domain ontology model CTDOM (Cyber ​​Threat Domain Ontology Model) based on the characteristics of the target network according to the STIX cyber threat intelligence standard;

[0063] Step 3, construct the network threat knowledge extraction model SecBABC (Cyber ​​Security Bidirectional Encoder Representations from Transformers-Bidirectional Adversarial training Bi-directional Long Short-Term Memory-Conditional Random Field);

[0064] Step 4: Use the SecBABC model to extract knowledge from threat attack intelligence;

[0065] Step 5: construct the entity alignment algorithm EAABNA (Entity Alignment Algorithm Based on entity Names and entity Attributes) to perform knowledge fusion processing on the extracted knowledge from the two aspects of entity names and entity attributes;

[0066] Step 6: Import the integrated knowledge into the neo4j graph database to store the network threat knowledge graph and realize graph visualization.

[0067] Furthermore, in one of the embodiments, data preprocessing mainly includes two stages: format conversion and data cleaning, to remove duplicate and invalid data and ensure data reliability.

[0068] This step specifically includes:

[0069] Step 1.1: Use crawler technology to collect network threat intelligence from existing vulnerability libraries, public network intelligence and other channels.

[0070] Step 1.2: Since the data formats provided by the public vulnerability library are not uniform, including json, csv and other formats, useful data resources are extracted and uniformly converted into csv format.

[0071] Step 1.3: Clean the crawled network intelligence and network security blogs. The collected data may contain duplicates and invalid data. It is necessary to remove these invalid data to enhance the reliability of the data source. First, remove the crawled empty information, and then remove the duplicate data from different sources based on vulnerability IDs, events and other information.

[0072] Step 1.4, classify the data obtained in the above steps into semi-structured data and unstructured data.

[0073] Further, in one embodiment, step 2 extracts relevant features from the data set, combines the ontology standards related to network security situation, and constructs a network threat domain ontology model CTDOM according to the characteristics of the target network. Figure 3 shown.

[0074] The constructed network threat domain ontology combines the currently popular network security frameworks ATT&CK and STIX, and refers to the ontology standards related to network security situation, defining entities and relationships in network threats from multiple dimensions such as assets, vulnerabilities, threats, and strategies. The ATT&CK framework describes the attacker's attack techniques and attack patterns from the attacker's perspective, and maps the network security attack process well. The STIX framework describes threat intelligence in detail, including information such as exploitation of vulnerabilities and impacts. Combining ATT&CK and STIX can better understand the network operation status and evaluate security threats.

[0075] The network threat domain ontology model CTDOM is defined as a four-tuple model as shown in the following formula:

[0076] CTDOM=<Entities,Properties,Relations,Axioms>

[0077] Among them, Entities represents the entity class set in the network threat domain ontology, Properties represents the attribute class set corresponding to the entity class, Relations represents the relationship set between entity classes, and Axioms represents the axiom set existing in the network threat domain ontology;

[0078] (1) The Entities entity class collection contains five dimensions, as shown in the following formula:

[0079] Entities={Assets,Networks,Vulnerabilities,Attacks,Strategies}

[0080] Among them, Assets represents the entity set of asset dimension, Networks represents the entity set of network dimension, Vulnerabilities represents the entity set of vulnerability dimension, Attacks represents the entity set of attack dimension, and Strategies represents the entity set of strategy dimension;

[0081] a) The entity set of the asset dimension is as follows:

[0082] Entities(Assets)={OS,Hardware,Software,Vender}

[0083] Among them, OS represents the operating system class, Hardware represents the hardware class, Software represents the software class, and Vender represents the vendor class;

[0084] b) The entity class set of the network dimension is as follows:

[0085] Entities(Networks)={IP,Port,DomainName}

[0086] Among them, IP represents the network IP address, Port represents the port, and DomainName represents the domain name;

[0087] c) The entity class set of the vulnerability dimension is as follows:

[0088] Entities(Vulnerabilities)={Vulnerability,Weakness}

[0089] Among them, Vulnerability represents vulnerability class, Weakness represents weakness class;

[0090] d) The entity class set of the attack dimension is shown as follows:

[0091] Entities(Attacks)={Group, Attacker, Attack}

[0092] Among them, Group represents the attack organization class, Attacker represents the attacker class, and Attack represents the attack class;

[0093] e) The entity class set of the strategy dimension is as follows:

[0094] Entities(Strategies)={Policy,Method}

[0095] Among them, Policy represents the security policy class, including access control policy, data protection policy, and network management policy; Method represents the defense method class, including identity authentication, authorization, security audit, data backup, intrusion detection, data encryption method and other security policies;

[0096] (2) The Properties attribute class collection represents the attributes of the entity, which specifically includes the following attribute collections:

[0097] a) In the asset dimension, the attribute set of the OS class is as follows:

[0098] Properties(OS)={name,type,version}

[0099] Where name indicates the name of the operating system, type indicates the type of the operating system, and version indicates the version of the operating system.

[0100] b) In the asset dimension, the attribute sets of the Hardware and Software classes are as follows:

[0101] Properties(Hardware|Software)={product,version,versionType}

[0102] Among them, product indicates the device name, version indicates the device version number, and versionType indicates the device version type;

[0103] c) In the asset dimension, the attribute set of the Vender class is as follows:

[0104] Properties(Vender)={venderName,abbreviation}

[0105] Where, venderName indicates the name of the vendor, and abbreviation indicates the abbreviation of the vendor name;

[0106] d) In the vulnerability dimension, the attribute set of the Vulnerability class is as follows:

[0107] Properties(Vulnerability)={cveId,cveDesc,severLevel,cvssScore,affectedConf}

[0108] Among them, cveId indicates the CVE-ID of the vulnerability, cveDesc indicates the vulnerability description, severLevel indicates the threat level of the vulnerability, cvssScore indicates the CVSS score of the vulnerability, and affectedConf indicates the device where the vulnerability exists;

[0109] Here, CVE-2018-12603 is used as an example to illustrate the properties of the Vulnerability class. The cveId is CVE-2018-12603, the cveDesc is "Cross-site request forgery vulnerability in admin.php", the severLevel is high risk, the affectedConf is "lfcms version 3.7.0", and the cvssScore is 8.8.

[0110] e) In the vulnerability dimension, the attribute set of the Weakness class is as follows:

[0111] Properties(Weakness)={cweId,cweName,cweDesc,cweConsequences,

[0112] detectionMethod,cweMitigation,possOfUse}

[0113] Where cweId indicates the CWE-ID of the weakness, cweName indicates the name of the weakness, cweDesc indicates the description of the weakness, cweConsequences indicates the consequences caused by the weakness, detectionMethod indicates the detection method of the weakness, cweMitigation indicates the mitigation method of the weakness, and possOfUse indicates the possibility of exploiting the weakness.

[0114] Here, CWE-352 is used as an example to illustrate the Weakness class properties. cweId is CWE-352, cweName is Cross-site Request Forgery, cweDesc is "the web program cannot fully verify whether the user intentionally provides a valid request", cweConsequences is "gain privileges, read application data, modify application data, DoS, etc.", detectionMethod is "code audit", cweMitigation is "double submission of cookies; state change requests do not use the GET method; use random number verification", and possOfUse is intermediate.

[0115] f) In the attack dimension, the attribute set of the Attack class is as follows:

[0116] Properties(Attack)={capecId,attackName,attackDesc,attackSeverity,attackLikelihood,

[0117] preRequisites,skillRequired,mitigationMethod}

[0118] Where capecId indicates the attack mode id, attackName indicates the attack name, attackDesc indicates the attack description, attackSeverity indicates the threat level of the attack, attackLikelihood indicates the possibility of the attack, preRequisites indicates the prerequisites for the attack, skillRequired indicates the technical requirement level of the attack, and mitigationMethod indicates the mitigation method;

[0119] Here, CAPEC-467 is used as an example to illustrate the Attack class properties. capecId is CAPEC-467, attackName is the cross-site identifier, attackDesc is "the attacker obtains the victim's identity information through the active session between the victim's browser and the social networking site", attackSeverity is low, preRequisites is "the victim frequently logs in to the social networking site", skillRequired is medium, and mitigationMethod is "the user needs to log out when exiting".

[0120] (3) The Relations class set represents the relationship between entities and is used to connect the entity classes defined above. The specific relationship is shown in the following formula:

[0121] Relations(CTDOM)={supplyProduct,hasOS,hasHardware,hasSoftware,

[0122] hasNetworkStatus,hasVulnerability,hasAttacker,exploit,hasStrategy,

[0123] relatedDefence,useWeakness}

[0124] Among them, supplyProduct indicates the relationship between the supplier and the products it supplies, hasOS indicates the operating system of the product, hasHardware indicates the hardware of the product, hasSoftware indicates the software of the product, hasNetworkStatus indicates the network attributes, hasVulnerability indicates the corresponding relationship between the product and the vulnerability, hasAttacker indicates the corresponding relationship between the attack organization and the attacker, exploit indicates the relationship between the attack and the exploitation of the vulnerability, hasStrategy indicates the corresponding relationship between the defense strategy of the vulnerability or attack, relatedDefence indicates the corresponding relationship between the defense strategy and the defense method, and useWeakness indicates the corresponding relationship between the vulnerability or attack and the weakness;

[0125] (4) Axioms represent some widely accepted and unquestionable security design principles, basic facts or guidelines.

[0126] Here, CAPEC-467 is used as an example to illustrate the relationship between attacks. CAPEC-467 exploits the CVE-2018-12603 vulnerability to attack, so CAPEC-467 and CVE-2018-12603 are in an exploit relationship; CVE-2018-12603 uses the CWE-352 weakness, so CVE-2018-12603 and CWE-352 are in a useWeakness relationship; CWE-352 can use the encryption verification strategy defense, CWE-352 and encryption verification are in a hasStrategy relationship; the defense method related to encryption verification is random number verification, so encryption verification and random number verification are in a relatedDefence relationship.

[0127] For example, users, processes, or system components should be granted the minimum permissions required to perform their necessary functions to reduce the potential attack surface, which is a security design principle; it is a basic fact that software and systems may have unauthorized vulnerabilities that hackers can exploit to invade the system; for the transmission and storage of sensitive data, end-to-end encryption should be used to prevent the data from being stolen or tampered with during transmission, which is a guideline.

[0128] Furthermore, in one embodiment, the network threat knowledge extraction model SecBABC in step 3 includes a pretrained model SecBer (pretrained BERT model for cyber security), a projected gradient descent adversarial training method PGD (Projected Gradient Descent), a bidirectional long short-term memory network model BiLSTM (Bidirectional Long Short-Term Memory) and a conditional random field model CRF (Conditional RandomField); the specific model structure is as follows: Figure 2 shown.

[0129] The steps of constructing the network threat knowledge extraction model SecBABC include:

[0130] Step 3.1, SecBABC uses the network security pre-training model SecBert to convert the input text into word embedding representation, paragraph embedding representation and position embedding representation, and finally outputs a threat intelligence representation sequence. The specific input Input (SecBert) and output Output (SecBert) are as follows:

[0131]

[0132] Among them, Set(threat) represents the network threat intelligence set, Set(T SecSeq ) represents a set of network threat intelligence representation sequences;

[0133] Step 3.2: In view of the possible semantic misunderstanding and inaccuracy of SecBert’s classification of network threat intelligence, a PGD adversarial training module is added to input the threat intelligence representation sequence into PGD to generate adversarial samples. The specific input Input (PGD) and output Output (PGD) are as follows:

[0134]

[0135] Among them, Set(T SecSeq ) represents a sequence set of network threat intelligence, Set(AT SecSeq ) represents the set of adversarial sequences;

[0136] Step 3.3: Input the threat intelligence corpus and adversarial samples into the BiLSTM model for training, update the model parameters through the back-propagation algorithm, and output the hidden state sequence of the entire vector sequence. The specific input Input (BiLSTM) and output Output (BiLSTM) are as follows:

[0137]

[0138] Among them, Set(T SecSeq ) represents a sequence set of network threat intelligence, Set(AT SecSeq ) represents the set of adversarial sequences, Set(H SecSeq ) represents the hidden state sequence of the output;

[0139] Step 3.4: Decode the optimal label sequence through the CRF layer. The specific input (CRF) and output (CRF) of the model are as follows:

[0140]

[0141] Among them, Set(H SecSeq ) represents the hidden state sequence of the output, Set(T threat ) represents the optimal label sequence set.

[0142] Further, in one of the embodiments, the use of the SecBABC model to extract knowledge from threat attack intelligence in step 4 is specifically: using the SecBABC model to extract knowledge from semi-structured and unstructured threat intelligence, extracting entities and relationships related to threat attacks, specifically including:

[0143] Step 4.1, input the acquired network threat intelligence into the preprocessing layer to perform data processing and BIO annotation on the corpus;

[0144] Step 4.2, input the processed network threat intelligence into the SecBert pre-training model, and the SecBert pre-training model learns semantic information;

[0145] In some embodiments, in step 4.2, SecBert specifically learns semantic information through the following steps:

[0146] Step 4.2.1, SecBert converts the input vector into word embedding representation, paragraph embedding representation and position embedding representation:

[0147] Step 4.2.2, randomly remove some words in the sentence and predict the removed words to learn the semantic relationship and context information between words;

[0148] Step 4.2.3: extract sentences from threat intelligence and use the context embedding model to predict whether they are related to each other, thus achieving a deeper language representation.

[0149] Step 4.3: Use the PGD adversarial training method to generate adversarial samples by perturbing the original samples to increase the robustness of the model.

[0150] In some embodiments, the PGD adversarial training method described in step 4.3 is used to generate adversarial samples by perturbing the original samples, specifically including:

[0151] Step 4.3.1: For the threat intelligence output by SecBert, the sequence T is represented SecSeq , initialize the adversarial sample AT SecSeq T SecSeq , that is, the following formula:

[0152] AT SecSeq =T SecSeq

[0153] Step 4.3.2, initialize the number of iterations N and the perturbation distance s, and calculate the constraint range P (AT SecSeq ), the calculation formula is:

[0154] P(AT SecSeq )={AT SecSeq |||T SecSeq -AT SecSeq || ∞ <s}

[0155] Step 4.3.3, in the i-th iteration, update the adversarial sample. The specific updating method is as follows:

[0156]

[0157] Wherein, v represents the projection function, which is used to project the adversarial sample into the constraint range, η represents the learning rate, θ is the model parameter, and y represents the true label. represents adversarial gradient, L represents loss function; AT i SecSeq , Respectively represent the adversarial samples AT corresponding to the i-th iteration and the i+1-th iteration SecSeq ;

[0158] Step 4.3.4, after completing N iterations, the final adversarial sample is obtained.

[0159] Step 4.4, input the adversarial sample and threat intelligence corpus into the BiLSTM model, use its bidirectional structure to capture long-distance and contextual semantic features, and output the hidden state sequence of the entire vector sequence, including the forward and reverse hidden states at each time step;

[0160] In step 4.5, the hidden state sequence output by the BiLSTM model is input to the CRF layer, the conditional probability of each label under a given sequence is calculated according to the labels generated by the BIO annotation method, the label sequence with the highest probability is decoded and found, and finally the optimal label sequence, i.e., the threat attack ontology and relationship, is output.

[0161] Figure 4 The figure shows the comparison between the SecBABC model and other models, including the Bert-BiLSTM-CRF model, the SecBert-softmax model, and the SecBert-BiLSTM-CRF model. The model is evaluated from the three aspects of accuracy, recall rate, and F1 value. It can be clearly seen that the SecBABC model demonstrates the effectiveness of the model in all three indicators.

[0162] Further, in one of the embodiments, the entity alignment algorithm EAABNA is constructed in step 5, and the extracted knowledge is fused from two aspects of entity name and entity attribute, specifically including:

[0163] Step 5.1, calculate the entity name similarity by using the edit distance and Jaccard algorithm;

[0164] Here, in some embodiments, step 5.1 specifically includes:

[0165] Step 5.1.1, calculate the edit distance similarity score using the following formula:

[0166]

[0167] Among them, Sec x and Sec. y Represents two network threat entities, with lengths of and represents the edit distance between entities, Indicates the longest entity name length of the two network threat entities, EDScore (Sec x ,Sec y ) represents the similarity score based on edit distance. The smaller the edit distance between two entities is, the higher the edit distance similarity score of the two strings is, and the more similar the two entities are.

[0168] Step 5.1.2, the Jaccard similarity score is obtained by calculating the ratio of the intersection and union of the network threat entities. The calculation formula is:

[0169]

[0170] Among them, JaccardScore (Sec x,Sec y ) represents two network threat entities Sec x and Sec. y Jaccard similarity score;

[0171] Step 5.1.3, the final entity name similarity is calculated by combining the edit distance similarity score and the Jaccard similarity score:

[0172]

[0173] Among them, NameScore(Sec x ,Sec y ) represents two network threat entities Sec x and Sec. y Entity name similarity.

[0174] Step 5.2, represent each attribute of the network threat ontology as a high-dimensional vector, merge the vectors of different attributes into a comprehensive attribute vector, and calculate the entity attribute similarity;

[0175] Here, in some embodiments, it specifically includes:

[0176] Step 5.2.1, according to the definition of the network threat domain ontology model CTDOM, the attribute value of the network threat entity is represented as a word set, and the representation method is as follows:

[0177]

[0178] in, Represents network threat entity Sec x Sec y The attribute collection, Attr i x 、Attr i y Represents network threat entity Sec x Sec y The i-th attribute value of , n represents the number of attributes;

[0179] Step 5.2.2, input the attribute value into the vector conversion module, segment and encode the network entity attributes, and then output the vector matrix of the attribute value;

[0180] Step 5.2.3, merge all attribute vectors of the network threat entity to obtain the comprehensive attribute vector of the network threat entity. The calculation method is as follows:

[0181]

[0182] in, Respectively The comprehensive attribute vector, E(Attr i x )、E(Attr i y ) represent the network threat entity Sec x Sec y The vector representation of the i-th attribute value;

[0183] Step 5.2.4, use cosine similarity to calculate the comprehensive attribute vector to obtain the attribute similarity score. The calculation formula is:

[0184]

[0185] in, express The attribute similarity score of .

[0186] Step 5.3, combine entity name similarity and entity attribute similarity to calculate the final entity similarity.

[0187] Further, in one embodiment, step 6 specifically includes:

[0188] In step 6.1, the entities in the fused data are taken as node sets and the relationships are taken as edge sets. The data are imported into the neo4j database through the Py2neo library in Python to visualize the network threat knowledge graph.

[0189] Step 6.2: Use neo4j to query relevant network security intelligence. Use the constructed network threat knowledge graph to query the vulnerability set of the relevant operating system. Figure 5 It shows the vulnerability knowledge of windows_server_2012.

[0190] Step 6.3, use the constructed network threat knowledge graph to query the information of attack technology, Figure 6 The attack techniques and vulnerabilities related to CAPEC-467 are displayed.

[0191] In one embodiment, a network threat knowledge graph construction system based on SecBABC is provided, the system comprising:

[0192] The first module is to obtain network threat intelligence, obtain semi-structured and unstructured intelligence text data from existing vulnerability libraries, public network intelligence and other channels, and pre-process the data to build a data set;

[0193] The second module extracts relevant features from the data set and builds a network threat domain ontology model CTDOM based on the characteristics of the target network according to the STIX network threat intelligence standard;

[0194] The third module builds the SecBABC knowledge extraction model to extract knowledge from threat attack intelligence;

[0195] The fourth module designs the entity alignment algorithm EAABNA to fuse the extracted knowledge from the aspects of entity name and entity attribute;

[0196] In the fifth module, the integrated knowledge is imported into the neo4j graph database to construct a network threat knowledge graph and graphic visualization.

[0197] For the specific limitations of the network threat knowledge graph construction system based on SecBABC, please refer to the limitations of the network threat knowledge graph construction method based on SecBABC above, which will not be repeated here. Each module in the above-mentioned network threat knowledge graph construction system based on SecBABC can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0198] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following is achieved:

[0199] Step 1: Obtain network threat intelligence, preprocess the intelligence data, and build a data set;

[0200] Step 2, extract relevant features from the data set, and build a network threat domain ontology model CTDOM based on the characteristics of the target network according to the STIX network threat intelligence standard;

[0201] Step 3, construct the network threat knowledge extraction model SecBABC;

[0202] Step 4: Use the SecBABC model to extract knowledge from threat attack intelligence;

[0203] Step 5: construct the entity alignment algorithm EAABNA to perform knowledge fusion processing on the extracted knowledge from the aspects of entity name and entity attribute;

[0204] Step 6: Import the integrated knowledge into the neo4j graph database to store the network threat knowledge graph and realize graph visualization.

[0205] For the specific limitations of each step, please refer to the limitations of the network threat knowledge graph construction method based on SecBABC mentioned above, which will not be repeated here.

[0206] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the computer program implements:

[0207] Step 1: Obtain network threat intelligence, preprocess the intelligence data, and build a data set;

[0208] Step 2, extract relevant features from the data set, and build a network threat domain ontology model CTDOM based on the characteristics of the target network according to the STIX network threat intelligence standard;

[0209] Step 3, construct the network threat knowledge extraction model SecBABC;

[0210] Step 4: Use the SecBABC model to extract knowledge from threat attack intelligence;

[0211] Step 5: construct the entity alignment algorithm EAABNA to perform knowledge fusion processing on the extracted knowledge from the aspects of entity name and entity attribute;

[0212] Step 6: Import the integrated knowledge into the neo4j graph database to store the network threat knowledge graph and realize graph visualization.

[0213] For the specific limitations of each step, please refer to the limitations of the network threat knowledge graph construction method based on SecBABC mentioned above, which will not be repeated here.

[0214] The method of the present invention utilizes the pre-trained SecBert model, the PGD adversarial training algorithm, and combines the BiLSTM and CRF models to improve the efficiency of entity recognition and relationship extraction in network threat knowledge. Compared with other methods for constructing network threat knowledge graphs, this method has efficient extraction and high recognition accuracy.

[0215] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for constructing a network threat knowledge graph based on SecBABC, characterized in that: The method comprises the following steps: Step 1: Obtain network threat intelligence, pre-process the intelligence data, and construct a data set; the acquisition of network threat intelligence specifically includes: obtaining semi-structured and unstructured intelligence text data from various channels, and the various channels include existing vulnerability libraries and public network intelligence; Step 2, extract relevant features from the data set, and build a network threat domain ontology model CTDOM based on the characteristics of the target network according to the STIX network threat intelligence standard; Step 3, construct the network threat knowledge extraction model SecBABC; Step 4: Use the SecBABC model to extract knowledge from threat attack intelligence; Step 5: construct the entity alignment algorithm EAABNA to perform knowledge fusion processing on the extracted knowledge from the aspects of entity name and entity attribute; Step 6: Import the integrated knowledge into the neo4j graph database to store the network threat knowledge graph and realize graph visualization.

2. The method for constructing a network threat knowledge graph based on SecBABC according to claim 1 is characterized in that: In step 2, the network threat domain ontology model CTDOM is defined as the four-tuple model shown in the following formula: CTDOM=<Entities,Properties,Relations,Axioms> Among them, Entities represents the entity class set in the network threat domain ontology, Properties represents the attribute class set corresponding to the entity class, Relations represents the relationship set between entity classes, and Axioms represents the axiom set existing in the network threat domain ontology; (1) The Entities entity class collection contains five dimensions, as shown in the following formula: Entities={Assets,Networks,Vulnerabilities,Attacks,Strategies} Among them, Assets represents the entity set of asset dimension, Networks represents the entity set of network dimension, Vulnerabilities represents the entity set of vulnerability dimension, Attacks represents the entity set of attack dimension, and Strategies represents the entity set of strategy dimension; a) The entity set of the asset dimension is as follows: Entities(Assets)={OS,Hardware,Software,Vender} Among them, OS represents the operating system class, Hardware represents the hardware class, Software represents the software class, and Vender represents the vendor class; b) The entity class set of the network dimension is as follows: Entities(Networks)={IP,Port,DomainName} Among them, IP represents the network IP address, Port represents the port, and DomainName represents the domain name; c) The entity class set of the vulnerability dimension is as follows: Entities(Vulnerabilities)={Vulnerability,Weakness} Among them, Vulnerability represents vulnerability class, Weakness represents weakness class; d) The entity class set of the attack dimension is shown as follows: Entities(Attacks)={Group, Attacker, Attack} Among them, Group represents the attack organization class, Attacker represents the attacker class, and Attack represents the attack class; e) The entity class set of the strategy dimension is as follows: Entities(Strategies)={Policy,Method} Among them, Policy represents the security policy class, including access control policy, data protection policy, and network management policy; Method represents the defense method class, including identity authentication, authorization, security audit, data backup, intrusion detection, and data encryption methods. (2) The Properties attribute class collection represents the attributes of the entity, which specifically includes the following attribute collections: a) In the asset dimension, the attribute set of the OS class is as follows: Properties(OS)={name,type,version} Where name indicates the name of the operating system, type indicates the type of the operating system, and version indicates the version of the operating system. b) In the asset dimension, the attribute sets of the Hardware and Software classes are as follows: Properties(Hardware|Software)={product,version,versionType} Among them, product indicates the device name, version indicates the device version number, and versionType indicates the device version type; c) In the asset dimension, the attribute set of the Vender class is as follows: Properties(Vender)={venderName,abbreviation} Where, venderName indicates the name of the vendor, and abbreviation indicates the abbreviation of the vendor name; d) In the vulnerability dimension, the attribute set of the Vulnerability class is as follows: Properties(Vulnerability)={cveId,cveDesc,severLevel,cvssScore,affectedConf} Among them, cveId indicates the CVE-ID of the vulnerability, cveDesc indicates the vulnerability description, severLevel indicates the threat level of the vulnerability, cvssScore indicates the CVSS score of the vulnerability, and affectedConf indicates the device where the vulnerability exists; e) In the vulnerability dimension, the attribute set of the Weakness class is as follows: Properties(Weakness)={cweId,cweName,cweDesc,cweConsequences, detectionMethod,cweMitigation,possOfUse} Where cweId indicates the CWE-ID of the weakness, cweName indicates the name of the weakness, cweDesc indicates the description of the weakness, cweConsequences indicates the consequences caused by the weakness, detectionMethod indicates the detection method of the weakness, cweMitigation indicates the mitigation method of the weakness, and possOfUse indicates the possibility of exploiting the weakness. f) In the attack dimension, the attribute set of the Attack class is as follows: Properties(Attack)={capecId,attackName,attackDesc,attackSeverity,attackLikelihood, preRequisites,skillRequired,mitigationMethod} Where capecId indicates the attack mode id, attackName indicates the attack name, attackDesc indicates the attack description, attackSeverity indicates the threat level of the attack, attackLikelihood indicates the possibility of the attack, preRequisites indicates the prerequisites for the attack, skillRequired indicates the technical requirement level of the attack, and mitigationMethod indicates the mitigation method; (3) The Relations class set represents the relationship between entities and is used to connect the entity classes defined above. The specific relationship is shown in the following formula: Relations(CTDOM)={supplyProduct,hasOS,hasHardware,hasSoftware, hasNetworkStatus,hasVulnerability,hasAttacker,exploit,hasStrategy, relatedDefence,useWeakness} Among them, supplyProduct indicates the relationship between the supplier and the products it supplies, hasOS indicates the operating system of the product, hasHardware indicates the hardware of the product, hasSoftware indicates the software of the product, hasNetworkStatus indicates the network attributes, hasVulnerability indicates the corresponding relationship between the product and the vulnerability, hasAttacker indicates the corresponding relationship between the attack organization and the attacker, exploit indicates the relationship between the attack and the exploitation of the vulnerability, hasStrategy indicates the corresponding relationship between the defense strategy of the vulnerability or attack, relatedDefence indicates the corresponding relationship between the defense strategy and the defense method, and useWeakness indicates the corresponding relationship between the vulnerability or attack and the weakness; (4) Axioms represent some widely accepted and unquestionable security design principles, basic facts or guidelines.

3. The method for constructing a network threat knowledge graph based on SecBABC according to claim 1 is characterized in that: The network threat knowledge extraction model SecBABC described in step 3 includes a pre-training model SecBer, a projected gradient descent adversarial training method PGD, a bidirectional long short-term memory network model BiLSTM and a conditional random field model CRF; The steps of constructing the network threat knowledge extraction model SecBABC include: Step 3.1, SecBABC uses the network security pre-training model SecBert to convert the input text into word embedding representation, paragraph embedding representation and position embedding representation, and finally outputs a threat intelligence representation sequence. The specific input Input (SecBert) and output Output (SecBert) are as follows: Among them, Set(threat) represents the network threat intelligence set, Set(T SecSeq ) represents a set of network threat intelligence representation sequences; Step 3.2, add the PGD adversarial training module, input the threat intelligence representation sequence into PGD, and generate adversarial samples. The specific input Input(PGD) and output Output(PGD) are as follows: Among them, Set(T SecSeq ) represents a sequence set of network threat intelligence, Set(AT SecSeq ) represents the set of adversarial sequences; Step 3.3: Input the threat intelligence corpus and adversarial samples into the BiLSTM model for training, update the model parameters through the back-propagation algorithm, and output the hidden state sequence of the entire vector sequence. The specific input Input (BiLSTM) and output Output (BiLSTM) are as follows: Among them, Set(T SecSeq ) represents a sequence set of network threat intelligence, Set(AT SecSeq ) represents the set of adversarial sequences, Set(H SecSeq ) represents the hidden state sequence of the output; Step 3.4: Decode the optimal label sequence through the CRF layer. The specific input (CRF) and output (CRF) of the model are as follows: Among them, Set(H SecSeq ) represents the hidden state sequence of the output, Set(T threat ) represents the optimal label sequence set.

4. The method for constructing a network threat knowledge graph based on SecBABC according to claim 1 or 2, characterized in that: The SecBABC model is used in step 4 to extract knowledge from threat attack intelligence. Specifically, the SecBABC model is used to extract knowledge from semi-structured and unstructured threat intelligence, and entities and relationships related to threat attacks are extracted, including: Step 4.1, input the acquired network threat intelligence into the preprocessing layer to perform data processing and BIO annotation on the corpus; Step 4.2, input the processed network threat intelligence into the SecBert pre-training model, and the SecBert pre-training model learns semantic information; Step 4.3, using the PGD adversarial training method to generate adversarial samples by perturbing the original samples; Step 4.4, input the adversarial sample and threat intelligence corpus into the BiLSTM model, use its bidirectional structure to capture long-distance and contextual semantic features, and output the hidden state sequence of the entire vector sequence, including the forward and reverse hidden states at each time step; In step 4.5, the hidden state sequence output by the BiLSTM model is input to the CRF layer, the conditional probability of each label under a given sequence is calculated according to the labels generated by the BIO annotation method, the label sequence with the highest probability is decoded and found, and finally the optimal label sequence, i.e., the threat attack ontology and relationship, is output.

5. The method for constructing a network threat knowledge graph based on SecBABC according to claim 4 is characterized in that: In step 4.2, SecBert learns semantic information through the following steps: Step 4.2.1, SecBert converts the input vector into word embedding representation, paragraph embedding representation and position embedding representation: Step 4.2.2, randomly remove some words in the sentence and predict the removed words to learn the semantic relationship and context information between words; In step 4.2.3, extract sentences from threat intelligence and use the context embedding model to predict whether they are related to each other, so as to achieve a deeper language representation.

6. The method for constructing a network threat knowledge graph based on SecBABC according to claim 4 is characterized in that: Step 4.3 uses the PGD adversarial training method to generate adversarial samples by perturbing the original samples, specifically including: Step 4.3.1: For the threat intelligence output by SecBert, the sequence T is represented SecSeq , initialize the adversarial sample AT SecSeq T SecSeq , that is, the following formula: AT SecSeq =T SecSeq Step 4.3.2, initialize the number of iterations N and the perturbation distance s, and calculate the constraint range P (AT SecSeq ), the calculation formula is: P(AT SecSeq )={AT SecSeq |||T SecSeq -AT SecSeq || ∞ <s} Step 4.3.3, in the i-th iteration, update the adversarial sample. The specific updating method is as follows: Wherein, Π represents a projection function, which is used to project the adversarial sample into the constraint range, η represents the learning rate, θ is the model parameter, and y represents the true label. represents adversarial gradient, L represents loss function; AT i SecSeq , Respectively represent the adversarial samples AT corresponding to the i-th iteration and the i+1-th iteration SecSeq ; Step 4.3.4, after completing N iterations, the final adversarial sample is obtained.

7. The method for constructing a network threat knowledge graph based on SecBABC according to claim 1 is characterized in that: In step 5, the entity alignment algorithm EAABNA is constructed to perform knowledge fusion processing on the extracted knowledge from two aspects: entity name and entity attribute, specifically including: Step 5.1, calculate the entity name similarity by using the edit distance and Jaccard algorithm; Step 5.2, represent each attribute of the network threat ontology as a high-dimensional vector, merge the vectors of different attributes into a comprehensive attribute vector, and calculate the entity attribute similarity; Step 5.3, combine entity name similarity and entity attribute similarity to calculate the final entity similarity.

8. The method for constructing a network threat knowledge graph based on SecBABC according to claim 7 is characterized in that: Step 5.1 calculates the entity name similarity by using the edit distance and Jaccard algorithm, specifically including: Step 5.1.1, calculate the edit distance similarity score using the following formula: Among them, Sec x and Sec. y Represents two network threat entities, with lengths of and represents the edit distance between entities, Indicates the longest entity name length of the two network threat entities, EDScore (Sec x ,Sec y ) represents the similarity score based on edit distance; Step 5.1.2, the Jaccard similarity score is obtained by calculating the ratio of the intersection and union of the network threat entities. The calculation formula is: Among them, JaccardScore (Sec x ,Sec y ) represents two network threat entities Sec x and Sec. y Jaccard similarity score; Step 5.1.3, the final entity name similarity is calculated by combining the edit distance similarity score and the Jaccard similarity score: Among them, NameScore(Sec x ,Sec y ) represents two network threat entities Sec x and Sec. y Entity name similarity.

9. The method for constructing a network threat knowledge graph based on SecBABC according to claim 8, characterized in that: Step 5.2 specifically includes: Step 5.2.1, according to the definition of the network threat domain ontology model CTDOM, the attribute value of the network threat entity is represented as a word set, and the representation method is as follows: in, Represents network threat entity Sec x Sec y The attribute set of Represents network threat entity Sec x Sec y The i-th attribute value of , n represents the number of attributes; Step 5.2.2, input the attribute value into the vector conversion module, segment and encode the network entity attributes, and then output the vector matrix of the attribute value; Step 5.2.3, merge all attribute vectors of the network threat entity to obtain the comprehensive attribute vector of the network threat entity. The calculation method is as follows: in, Respectively The comprehensive attribute vector of Represents network threat entity Sec x Sec y The vector representation of the i-th attribute value; Step 5.2.4, use cosine similarity to calculate the comprehensive attribute vector to obtain the attribute similarity score. The calculation formula is: in, express The attribute similarity score of .

10. The method for constructing a network threat knowledge graph based on SecBABC according to claim 9, characterized in that: In step 5.3, the entity name similarity and entity attribute similarity are combined to calculate the final entity similarity: SimScore(Sec x ,Sec y )=W name ×NameScore(Sec x ,Sec y )+W attr ×AttrScore(Sec x ,Sec y ) Among them, W name and W attr Respectively represent the calculation weights of entity name and entity attributes, SimScore (Sec x ,Sec y ) represents the final entity similarity between two network threat entities.

Images