Knowledge graph enhancement-based cyberspace asset dynamic fusion drawing method

Abstract

The invention relates to the technical field of cyberspace asset surveying and mapping, in particular to a cyberspace asset dynamic fusion drawing method based on knowledge graph enhancement, which constructs an asset attribute co-reference resolution mechanism based on asset information quality and defines asset information data quality measurement indexes based on real network environment asset information data. And the asset information data quality is comprehensively evaluated, and network semantic co-reference attribute resolution in the multi-source asset information data is guided. A network space asset mapping knowledge domain ontology structure of a six-tuple structure is designed, a network asset entity and asset relation is extracted through asset attribute representation and asset protocol analysis, and the network asset entity and relation are accurately represented in combination with the ontology structure. The extensive resolution domain name asset entity range in the asset information data is identified by using a misreported domain name asset entity alignment algorithm, and effective public main domain assets are extracted to align misreported asset entities, so that network asset fusion drawing noise can be eliminated, and the accuracy of network asset knowledge representation results is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace asset mapping, and in particular to a method for dynamically fusion mapping of cyberspace assets based on knowledge graph enhancement. Background Art

[0002] The trend of digital transformation has accelerated the pace of asset digitization and service informatization in various industries, bringing convenience to people while also giving rise to more extensive digital asset security issues. On the one hand, the number of assets exposed on the Internet has expanded rapidly, and the diversified asset forms and attributes and complex business relationship networks have led to an incomplete account of network assets and unclear asset correlation structures, which are important factors in the lack of threat perception capabilities of network assets in various industries. On the other hand, the heterogeneous and ubiquitous open source intelligence of assets exposed on the Internet, the inconsistent data quality, and the existence of false positives have brought challenges to sorting out discrete asset information and converging asset defense profiles.

[0003] Therefore, the need for comprehensive and accurate representation of network asset knowledge has been put on the agenda, which is required to solve the problems of asset intelligence data fusion, coreference attribute resolution, entity attribute and relationship representation, and false positive result alignment in open source asset intelligence data. Cyberspace assets and their relationships can be abstracted into a representation model with a graph structure, and asset information to which the target domain name belongs can be extracted from asset intelligence data. Standardized asset intelligence data can be used to construct an asset data set. Define quantitative evaluation indicators for asset intelligence data and asset type weights, comprehensively evaluate asset data quality, and resolve asset semantic coreference attributes. Furthermore, knowledge graph technology is used to model cyberspace asset entities and their relationships, and to construct a representation structure for entity relationships between asset data. A pan-resolution mechanism is introduced to construct pan-resolution domain name asset features, identify false positive domain name assets, and align them to the main domain of valid assets, eliminating noise data in asset drawing results.

[0004] The traditional network asset fusion mapping method has limitations. On the one hand, multi-source heterogeneous network asset intelligence data is distributed on the Internet, and the extraction of asset data and its relationships requires high professional knowledge. On the other hand, the lack of validity verification of asset data, conflict in fusion data, and widespread asset misreporting will bring data noise to the final asset knowledge representation results. In addition, the lack of a suitable cyberspace asset representation structure model has resulted in a high threshold for understanding network asset knowledge. Summary of the invention

[0005] The purpose of the present invention is to provide a method for dynamic fusion drawing of cyberspace assets based on knowledge graph enhancement, which combines knowledge graph with cyberspace asset fusion drawing to solve the problems of semantic co-reference conflicts of multi-source asset attributes, entity pan-resolution and asset misreporting in drawing results in cyberspace asset fusion drawing scenarios.

[0006] To achieve the above object, the present invention provides a method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement, comprising the following steps:

[0007] Step 1: Using the target domain name as the initial asset seed, crawl the multi-source network asset open source intelligence data exposed on the Internet, extract valid asset data through asset data preprocessing, and construct a standardized asset intelligence data set;

[0008] Step 2: Define the core asset accuracy and asset attribute completeness indicators combined with asset type weights, design an asset intelligence data quality quantitative assessment mechanism based on semantic coreference attribute resolution, and resolve asset semantic coreference attributes based on the quantitative results;

[0009] Step 3: Establish an external asset knowledge base to complete the missing asset information in the standardized asset intelligence data set, build a complete asset data set, design a six-tuple structured cyberspace asset knowledge graph ontology, build a network asset entity representation structure and relationship extraction rules based on asset entity attributes and asset protocol analysis, and form a network asset entity and relationship fusion result set;

[0010] Step 4: Design a false positive domain name asset entity alignment algorithm based on the similarity of pan-resolution features, identify the pan-resolution false positive domain name asset range in the network asset entity fusion result set, and align the pan-resolution domain name asset entity set to the valid main domain asset entity.

[0011] Optionally, in step 1, crawl the open source asset intelligence related to the target asset to build the original asset intelligence dataset DS, design the wrapper rules to annotate and extract the network assets and named attributes, use regular validation to filter out invalid asset samples in the extraction results, and form a multi-source standardized asset dataset DS standardized , network asset type AssetType, original asset intelligence dataset DS and standardized asset dataset DS standardized The definition is as follows:

[0012] AssetType={Subdomain,Host,Service,Certs,Registration,Department,Location,AS}

[0013] DS={(e,k,v)|e∈E assetT ,k∈K assetT ,v∈V assetT ,assetT∈AssetType}

[0014] In the original multi-source asset dataset DS result, the network asset object set is E Asset , the key set is K Asset , the value set is V Asset , where EassetT , K assetT 、V assetT The asset object set, key set and value set corresponding to the asset type;

[0015] The standardized asset dataset DS standardized By |DS standardized | tuples and m attributes, A={A[1],A[2],...,A[m]} is DS standardized The attribute set of each tuple t∈DS standardized By asset token e∈E asset It is composed of an attribute value set V, denoted as V = {tA[1], tA[2], ..., tA[m]}, where tA[m] is the attribute value of tuple t at the mth attribute.

[0016] Optional, the core asset accuracy Acc in step 2 CoreAsset , Asset attribute completeness AttrInt assetT and asset intelligence data quality assessment results QE DS The definition is as follows:

[0017]

[0018] Among them, core type assets E CoreAsset Weight ω1 = 0.6, quantity W = |E CoreAsset |, other types of assets Weight ω2 = 0.4, quantity

[0019] Optionally, the cyberspace asset knowledge graph ontology of the six-tuple structure in step 3 is used to characterize the cyberspace asset model structure, wherein the six-tuple structure is T = {E, R, A, V, T r , T a}, E represents each type of asset entity, R is the entity relationship, A is the asset concept attribute, and V is the asset attribute value. r ={(h,r,t)|h,t∈E,r∈R} is a triplet relationship set representing the relationship between network asset entities, expressed as (entity1,relation,entity2); T a ={(e,a,v)|e∈E,a∈A,v∈V} is a triple attribute set referring to the entity attributes of network assets, expressed as (entity,attribute,value).

[0020] Optionally, to solve each standardized asset dataset DS standardizedThe problem of missing network asset attribute information in the network asset dataset is solved by building a network asset knowledge base based on external data sources to complete the missing attribute knowledge of network assets and build a complete network asset dataset DS. complete , defined as follows:

[0021] DS complete ={(E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl )|

[0022] E cpl ∈E,R cpl ∈R,A cpl ∈A,V cpl ∈V,T r_cpl ∈T r ,T a_cpl ∈T a}

[0023] Where E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl The complete network asset dataset DS complete asset entities, relationships, entity attributes, entity attribute values, entity relationship sets, and entity attribute relationship sets.

[0024] Optionally, during the execution of step 3, similar network assets are extracted from the standardized asset dataset to construct a fused set of similar network assets, a single complete network asset dataset DS complete The asset entity extraction results and the fusion asset entity set results are defined as follows, where i is DS complete Number, n is DS complete quantity:

[0025] T a_assetT ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT∈AssetType}

[0026] T a_assetT_fusion ={{T[1] a_assetT ,...,T[i] a_assetT}|assetT∈AssetType,1≤i≤n}.

[0027] Optionally, according to the network asset ontology structure and asset relationship characteristics, a network asset entity relationship extraction rule based on protocol analysis is designed, and each standardized asset entity association relationship is constructed in combination with the asset entity attributes to form various network asset entity relationship sets, where the relationship set type is defined as:

[0028] AssetRelation={RESOLVED_TO,DEPLOYED_AS,REGISTERED_IN,BELONGS_TO,BOUND_TO,DEVIDED_INTO,LOCATED_AT}

[0029] Single complete network asset dataset DS complete The asset entity relationship extraction results and the fusion asset relationship set results are defined as follows, where i is DS complete Number, n is DS complete quantity:

[0030] T r_assetR ={(h assetT ,r assetR ,t assetT )|h assetT ,t assetT ∈E cpl ,r assetR ∈R cpl}

[0031] T r_assetR_fusion ={{T[1] r_assetR ,...,T[i] r_assetR}|assetR∈AssetRelation,1≤i≤n}.

[0032] Optionally, the false positive domain name asset entity alignment algorithm based on pan-resolution feature similarity extracts a relationship set T with the same TTL and the same response host IP from the asset relationship results according to the pan-resolution domain name asset features. r_RESOLVED_TO_fusion , obtain the domain name asset entity mapped by the asset relationship, and obtain the initial potential pan-resolution domain name asset entity set T′ a_subdomain_sh , and then the initial potential pan-resolved domain name asset entity set T′ a_subdomain_sh Deploy the relationship set T through the service r_DEPLOYED_AS_fusion Get the mapped service asset entity set T' a_service_sw , where T r_RESOLVED_TO_fusion , T′ a_subdomain_sh , T′ a_service_sw The detailed definitions are as follows:

[0033] Tr_RESOLVED_TO_fusion ={{T[1] r_assetR ,...,T[i] r_assetR}|assetR=RESOLVED_TO,1≤i≤n}

[0034] T′ a_subdomain_sh ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT=Subdomain}

[0035] T′ a_service_sw ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT=Service}.

[0036] The present invention provides a method for dynamic fusion drawing of cyberspace assets based on knowledge graph enhancement. Based on the asset intelligence data of the real network environment, an asset attribute co-reference resolution mechanism based on the asset intelligence quality is constructed, the asset intelligence data quality measurement index is defined, the asset intelligence data quality is comprehensively evaluated, and the network semantic co-reference attribute resolution in multi-source asset intelligence data is guided. A cyberspace asset knowledge graph ontology structure with a six-tuple structure is designed, and the network asset entities and asset relationships are extracted through asset attribute representation and asset protocol analysis, and the network asset entities and relationships are accurately characterized in combination with the ontology structure. The false positive domain name asset entity alignment algorithm based on the similarity of the universal resolution feature is used to identify the scope of the universal resolution domain name asset entity in the asset intelligence data, extract the effective public primary domain assets to align the false positive asset entities, which is helpful to eliminate the network asset fusion drawing noise and improve the accuracy of the network asset knowledge characterization results. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1It is a schematic diagram of the steps of a method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement of the present invention.

[0039] Figure 2 It is a structural diagram of the cyberspace asset knowledge graph ontology in a specific embodiment of the present invention.

[0040] Figure 3 It is a schematic diagram of a knowledge graph-based cyberspace asset fusion drawing framework according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0041] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0042] See also Figure 1 The present invention provides a method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement, comprising the following steps:

[0043] S1: Using the target domain name as the initial asset seed, crawl the multi-source network asset open source intelligence data exposed on the Internet, extract valid asset data through asset data preprocessing, and construct a standardized asset intelligence data set;

[0044] S2: Define the core asset accuracy and asset attribute completeness indicators combined with asset type weights, design a quantitative assessment mechanism for asset intelligence data quality based on semantic co-referential attribute resolution, and resolve asset semantic co-referential attributes based on the quantitative results;

[0045] S3: Establish an external asset knowledge base to supplement the missing asset information in the standardized asset intelligence data set, build a complete asset data set, design a six-tuple structured cyberspace asset knowledge graph ontology, build a network asset entity representation structure and relationship extraction rules based on asset entity attributes and asset protocol analysis, and form a network asset entity and relationship fusion result set;

[0046] S4: Design a false positive domain name asset entity alignment algorithm based on the similarity of pan-resolution features, identify the pan-resolution false positive domain name asset range in the network asset entity fusion result set, and align the pan-resolution domain name asset entity set to the valid main domain asset entity.

[0047] The following is further described in conjunction with specific embodiments and execution steps. Figure 2 and Figure 3 As shown:

[0048] In step S1, the target primary domain name is used as the initial asset seed to crawl multi-source network asset intelligence data exposed on the Internet to construct an original network asset intelligence data set belonging to the target primary domain name. Specifically, the initial network asset intelligence data set includes:

[0049] DS={(e,k,v)|e∈E assetT ,k∈K assetT ,v∈V assetT ,assetT∈AssetType}

[0050] AssetType={Subdomain,Host,Service,Certs,Registration,Department,Location,AS}

[0051] Among them, the network asset object set is E Asset , the key set is K Asset , the value set is V Asset , where E assetT , K assetT 、V assetT It is a set of asset objects, key sets, and value sets corresponding to the asset type.

[0052] Based on the original network asset intelligence data set, the asset type data related to the primary domain assets is extracted from the semi-structured asset intelligence data, and a standardized network asset intelligence data set is formed through data preprocessing. Figure 3 Step (1) is to design wrapper rules to annotate semi-structured asset intelligence data. <title>、< / title> The label elements containing network asset data are used to extract network assets and naming attributes by annotation, and regular check is used to filter invalid asset samples in the extraction results (such as domain name assets represented by pan-resolution containing "*", host assets in intranet format of Class C address, etc.), to build a standardized multi-source asset dataset. The result definition can be expressed as: Standardized asset dataset DS standardized By |DS standardized | tuples and m attributes, A = {A[1], A[2], ..., A[m]} is DS standardized The attribute set of each tuple t∈DS standardized By asset token e∈E asset It is composed of an attribute value set V, denoted as V = {tA[1], tA[2], ..., tA[m]}, where tA[m] is the attribute value of tuple t at the mth attribute.

[0053] Step S2, based on the standardized multi-source asset data set, defines the core asset accuracy, asset attribute completeness and asset type weight, and constructs an asset intelligence data quality quantitative assessment mechanism based on semantic coreference attribute resolution to resolve asset semantic coreference attributes. Specifically, Figure 3 In step (2) of the framework diagram, asset types are used as the division, and network assets and their attributes under the same type are taken as objects. The same attributes of the same asset objects in each data set are aggregated, and the cosine similarity is used to calculate the aggregated attribute text similarity. The part with a threshold higher than 95% is selected as the co-reference attribute recognition result. The mechanism defines the core asset accuracy Acc CoreAsset ,CoreAsset={Subdomain,Host,Service},CoreAsset∈AssetType indicates DS standardized There are three types of network assets: domain name assets, host assets and service assets. CoreAsset The proportion of surviving samples, the completeness of asset type attributes AttrInt assetT ,assetT∈AssetType represents DS standardized The completeness of information on various types of network asset attributes in the network is measured by the following indicators:

[0054]

[0055] Further, such as Figure 3 Step (3) of AssetType, considering that domain name assets, host assets, and service assets in the overall asset mapping results are high priority, in the core asset accuracy Acc CoreAsset and asset attribute integrity AttrInt assetT Based on this, weights are assigned to different types of network assets to comprehensively quantify the data quality of each data set. CoreAsset Weight ω1 = 0.6, quantity W = |E CoreAsset |, other types of assets Weight ω2 = 0.4, quantity Dataset asset data quality assessment results QE DS have:

[0056]

[0057] like Figure 3 As shown in the semantic coreference attribute resolution part (step (6)), the core asset accuracy Acc CoreAsset , Attribute completeness AttrInt assetT ,assetT∈AssetType combines asset type weights ω1 and ω2 to calculate each DS standardized Asset data quality evaluation results QE DS , with QE DS The asset attribute with the higher result is used as the basis to eliminate the co-reference attribute of the asset.

[0058] After obtaining the quantitative evaluation results of the quality of multi-source standardized network asset intelligence data sets, in order to deal with the problem of missing asset attribute information in each data set, Figure 3 Step (4) constructs a network asset knowledge base based on external data sources to complete the missing attribute knowledge of network assets to build a complete network asset data set. For example, the Whois knowledge base is used to complete the domain name asset registration attributes, and the SSL certificate knowledge base is used to complete the service asset authentication attributes. The external data sources are shown in Table 1. After knowledge completion, each DS standardized Corresponding complete asset dataset DS complete have:

[0059] DS complete ={(E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl )|

[0060] E cpl ∈E,R cpl ∈R,A cpl ∈A,V cpl ∈V,T r_cpl ∈T r ,T a_cpl ∈T a }

[0061] Where E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl DS complete asset entities, relationships, entity attributes, entity attribute values, entity relationship sets, and entity attribute relationship sets.

[0062] Table 1 Network asset knowledge base data sources

[0063]

[0064] In step S3, based on the complete asset data set, Figure 3 Step (5) Design a six-tuple-based cyberspace asset knowledge graph ontology structure to characterize network assets and their relationships. Use asset type objects and asset attribute features to extract asset entities from the complete asset data set, represent them as asset entity triple structures, and fuse asset entities of the same type to construct an asset entity fusion result set. Design asset relationship extraction rules through asset protocol analysis, extract asset relationships from the complete asset data set, and fuse asset relationships of the same type to construct an asset relationship fusion result set. Specifically, combined with Figure 2 , the ontology structure of cyberspace asset knowledge graph can be expressed as a six-tuple T = {E, R, A, V, T r , T a }, E represents each type of asset entity, R is the entity relationship, A is the asset concept attribute, and V is the asset attribute value. r ={(h,r,t)|h,t∈E,r∈R} is a triplet relationship set representing the relationship between network asset entities, expressed as (entity1,relation,entity2); T a ={(e,a,v)|e∈E,a∈A,v∈V} is a triple attribute set referring to the entity attributes of network assets, expressed as (entity,attribute,value).

[0065] Cyberspace asset knowledge graph ontology, such as Figure 3 As shown in step (6), a triple structure consisting of entity, attribute and attribute value is designed to characterize different types of asset entities. complete The extraction results of triples of various network asset entities are:

[0066] T a_assetT ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT∈AssetType}

[0067] By a single DS complete The entity extraction result set T a_assetT There are: The fusion entity sets of the same asset type are:

[0068] Where i is DS complete Number, n is DS complete The extraction of various network asset entities and their attribute definitions are shown in Table 2.

[0069] Table 2 Asset entity representation of cyberspace asset knowledge graph ontology

[0070]

[0071]

[0072] Further, such as Figure 3 As shown in step (6), the relationship between asset entities is analyzed from the perspective of protocol relationship, such as the domain name asset entity is mapped to the host asset entity by DNS resolution, the domain name asset entity is mapped to the service asset entity by HTTP protocol, etc. Specifically, the relationship type between network asset entities can be abstracted as AssetRelat ion = {RESOLVED_TO, DEPLOYED_AS, REGISTERED_IN, BELONGS_TO, BOUND_TO, DEVIDED_INTO, LOCATED_AT}. Establish asset relationship extraction rules based on protocol analysis to construct each DS complete The relationship between different network assets in each DS complete The relationship triples of different asset entities are constructed as follows:

[0073] T r_assetR ={(h assetT ,r assetR ,t assetT )|h assetT ,t assetT ∈E cpl ,r assetR ∈R cpl }

[0074] By a single DS complete The following relation extraction result set T r_assetR There are: The fusion relationship set of the same relationship type is:

[0075] T r_assetR_fusion ={{T[1] r_assetR ,...,T[i] r_assetR }|assetR∈AssetRelation,1≤i≤n}

[0076] Where i is DS complete Number, n is DS complete The relationship triples of various network asset entities are constructed as shown in Table 3.

[0077] Table 3. Asset relationship representation of cyberspace asset knowledge graph ontology

[0078]

[0079] Furthermore, during the fusion process of multi-source asset data, the pan-resolution domain name asset entity will lead to asset misreporting in the fusion drawing results. Figure 1 , Figure 3 Step S4 aims to eliminate the pan-resolution domain name assets in the domain name asset entity set, and designs the false positive domain name asset entity alignment algorithm based on the pan-resolution feature similarity. By thinking that the same asset entities have similar attributes, the false positive entity attribute similarity is calculated to identify the scope of the false positive domain name assets, and solve the entity alignment problem of the pan-resolution domain name assets. Specifically, Figure 3 The false positive asset entity alignment part of the framework diagram shows that: in the domain name resolution process, the pan-resolution DNS records have the same TTL (Timetolive) in the authoritative domain name server cache, the resolution records all point to the same host IP, and the application layer domain name service access all points to the same service asset entity. Based on the pan-resolution feature analysis, firstly, according to the address resolution relationship set T r_RESOLVED_TO_fusion From T a_subdomain_fusion Extract the domain name asset entities with the same DNS resolution response host and record survival time TTL, and obtain the preliminary potential pan-resolution domain name asset entity set T′ a_subdomain_sh Secondly, through T′ a_subdomain_sh Deployment relationship set T for the service r_DEPLOYED_AS_fusion Extract service asset entity set T′ a_service_sw , the service asset entity pair uses the term frequency inverse document frequency TF-IDF to convert the three types of attributes of service title, response content, and response header into the corresponding text vector set Set vectorT1 = {V title1 ,V text1 ,V headers1 }、Set vectorT2 = {V title2 ,V text2 ,V headers2 }, and then use cosine similarity to calculate the service asset entity pair Set vectorT1 、Set vectorT2 After filtering out the service asset entities whose entity attribute cosine similarity is higher than 95%, we get the service asset entity set T′ with similar response attributes. a_service_sim , by the set T′ a_service_sim Map to the set T using the domain name attribute as the connection a_subdomain_fusion , get the potential pan-resolvable domain name asset entity set T′ a_subdomain_sw .

[0080] According to the definition of domain name pan-resolution, the pan-resolution domain name asset entity is a copy of the pan-resolution primary domain, so its pan-resolution primary domain is a valid asset. Therefore, it is necessary to extract the primary domain of the pan-resolution domain name asset set as the alignment target of the false positive domain name assets. Specifically, to extract the pan-resolution primary domain, in the set T′ a_subdomain_sw Based on this, the longest common substring of its domain name structure is calculated to obtain the potential pan-resolution domain name asset entity D with the same upper-level domain name structure. suspect_wildcard To further confirm D suspect_wildcard is the main domain of pan-analysis, which is used as the input of Algorithm 1. If the result is True, then T′ a_subdomain_sw Align to D suspect_wildcard , complete the entity alignment of the pan-resolution domain name assets; if the result is False, then D suspect_wildcard is the non-universal resolution primary domain, T′ a_subdomain_sw The aggregate domain name asset entity is confirmed as a non-generic domain name entity. The pseudo code of the generic domain name entity identification algorithm is shown in the execution steps of Algorithm 1:

[0081] Step 1: Enter the domain name to be identified.

[0082] Step 2: Randomly generate N non-existent subdomains based on the input domain name.

[0083] Step 3: Perform DNS resolution on the generated random subdomain to the authoritative DNS server to obtain the response survival time TTL (Timetolive) and the response host IP.

[0084] Step 4: If the TTL values ​​in the randomly generated N subdomains are the same as the response host IP values, proceed to step 5; otherwise, proceed to step 6.

[0085] Step 5: Use the generated N subdomains to construct HTTP requests to obtain the response text and response header of the subdomains, and use cosine similarity to calculate the similarity between the response text and the response header of each subdomain. If the text similarity between the response text and the response header is higher than the threshold, the input domain name is determined to be a wildcard domain name, and the output result is true, otherwise execute step 6.

[0086] Step 6: If the input domain name is not a wildcard domain name, the output result is false.

[0087] What is disclosed above is only a preferred embodiment of the present invention, and it certainly cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made according to the claims of the present invention still fall within the scope of the invention. 、

Claims

1. A method for dynamic fusion drawing of cyberspace assets based on knowledge graph enhancement, characterized in that: The following steps are involved: Step 1: Using the target domain name as the initial asset seed, crawl the multi-source network asset open source intelligence data exposed on the Internet, extract valid asset data through asset data preprocessing, and construct a standardized asset intelligence data set; Step 2: Define the core asset accuracy and asset attribute completeness indicators combined with asset type weights, design an asset intelligence data quality quantitative assessment mechanism based on semantic coreference attribute resolution, and resolve asset semantic coreference attributes based on the quantitative results; Step 3: Establish an external asset knowledge base to complete the missing asset information in the standardized asset intelligence data set, build a complete asset data set, design a six-tuple structured cyberspace asset knowledge graph ontology, build a network asset entity representation structure and relationship extraction rules based on asset entity attributes and asset protocol analysis, and form a network asset entity and relationship fusion result set; Step 4: Design a false positive domain name asset entity alignment algorithm based on the similarity of pan-resolution features, identify the pan-resolution false positive domain name asset range in the network asset entity fusion result set, and align the pan-resolution domain name asset entity set to the valid main domain asset entity.

2. The method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement according to claim 1 is characterized in that: In step 1, we crawl the open source asset intelligence related to the target asset to build the original asset intelligence dataset DS, design the wrapper rules to annotate and extract the network assets and named attributes, use regular validation to filter out invalid asset samples in the extraction results, and form a multi-source standardized asset dataset DS standardized , network asset type AssetType, original asset intelligence dataset DS and standardized asset dataset DS standardized The definition is as follows: AssetType={Subdomain,Host,Service,Certs,Registration,Department,Location,AS} DS={(e,k,v)|e∈E assetT ,k∈K assetT ,v∈V assetT ,assetT∈AssetType} In the original multi-source asset dataset DS result, the network asset object set is E Asset , the key set is K Asset , the value set is V Asset , where E assetT , K assetT 、V assetT The asset object set, key set and value set corresponding to the asset type; The standardized asset dataset DS standardized By |DS standardized | tuples and m attributes, A = {A[1], A[2], ..., A[m]} is DS standardized The attribute set of each tuple t∈DS standardized By asset token e∈E asset It is composed of an attribute value set V, denoted as V = {tA[1], tA[2], ..., tA[m]}, where tA[m] is the attribute value of tuple t at the mth attribute.

3. The method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement according to claim 1 is characterized in that: Core asset accuracy Acc in step 2 CoreAsset , Asset attribute completeness AttrInt assetT and asset intelligence data quality assessment results QE DS The definition is as follows: Among them, core type assets E CoreAsset Weight ω1 = 0.6, quantity W = |E CoreAsset |, other types of assets Weight ω2 = 0.4, quantity 4. The method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement according to claim 1 is characterized in that: The cyberspace asset knowledge graph ontology of the six-tuple structure in step 3 is used to characterize the cyberspace asset model structure, wherein the six-tuple structure is T = {E, R, A, V, T r , T a }, E represents each type of asset entity, R represents the entity relationship, A represents the asset concept attribute, and V represents the asset attribute value; where T r ={(h,r,t)|h,t∈E,r∈R} is a triplet relationship set representing the relationship between network asset entities, expressed as (entity1,relation,entity2); T a ={(e,a,v)|e∈E,a∈A,v∈V} is a triple attribute set referring to the entity attributes of network assets, expressed as (entity,attribute,value).

5. The method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement according to claim 2 is characterized in that: To solve the problem of each standardized asset data set DS standardized The problem of missing network asset attribute information in the network asset dataset is solved by building a network asset knowledge base based on external data sources to complete the missing attribute knowledge of network assets and build a complete network asset dataset DS. complete , defined as follows: DS complete ={(E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl )| E cpl ∈E,R cpl ∈R,A cpl ∈A,V cpl ∈V,T r_cpl ∈T r ,T a_cpl ∈T a } Where E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl The complete network asset dataset DS complete asset entities, relationships, entity attributes, entity attribute values, entity relationship sets, and entity attribute relationship sets.

6. The method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement according to claim 5 is characterized in that: During the execution of step 3, similar network assets are extracted from the standardized asset dataset to construct a fused set of similar network assets, a single complete network asset dataset DS complete The asset entity extraction results and the fusion asset entity set results are defined as follows, where i is DS complete Number, n is DS complete quantity: T a_assetT ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT∈AssetType} T a_assetT_fusion ={{T[1] a_assetT ,...,T[i] a_assetT }|assetT∈AssetType,1≤i≤n}。 7. The method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement according to claim 6 is characterized in that: According to the network asset ontology structure and asset relationship characteristics, the network asset entity relationship extraction rules based on protocol analysis are designed. Combined with the asset entity attributes, the standardized asset entity association relationships are constructed to form various network asset entity relationship sets, where the relationship set type is defined as: AssetRelation={RESOLVED_TO,DEPLOYED_AS,REGISTERED_IN,BELONGS_TO,BOUND_TO,DEVIDED_INTO,LOCATED_AT} Single complete network asset dataset DS complete The asset entity relationship extraction results and the fusion asset relationship set results are defined as follows, where i is DS complete Number, n is DS complete quantity: T r_assetR ={(h assetT ,r assetR ,t assetT )|h assetT ,t assetT ∈E cpl ,r assetR ∈R cpl } T r_assetR_fusion ={{T[1] r_assetR ,...,T[i] r_assetR }|assetR∈AssetRelation,1≤i≤n}。 8. The method for dynamically fusion drawing of cyberspace assets based on knowledge graph enhancement according to claim 1 is characterized in that: The false positive domain name asset entity alignment algorithm based on the pan-resolution feature similarity extracts the relationship set T with the same TTL and the same response host IP from the asset relationship results according to the pan-resolution domain name asset features. r_RESOLVED_TO_fusion , obtain the domain name asset entity mapped by the asset relationship, and obtain the initial potential pan-resolution domain name asset entity set T′ a_subdomain_sh , and then the initial potential pan-resolved domain name asset entity set T′ a_subdomain_sh Deploy the relationship set T through the service r_DEPLOYED_AS_fusion Get the mapped service asset entity set T' a_service_sw , where T r_RESOLVED_TO_fusion , T′ a_subdomain_sh 、T a ' _service_sw The detailed definitions are as follows: T r_RESOLVED_TO_fusion ={{T[1] r_assetR ,...,T[i] r_assetR }|assetR=RESOLVED_TO,1≤i≤n} T′ a_subdomain_sh ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT=Subdomain} T′ a_service_sw ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT=Service}。

Images