Internet of vehicles vulnerability knowledge graph updating method based on cloud platform

Abstract

The invention provides an Internet of Vehicles vulnerability knowledge graph updating method based on a cloud platform, and the method comprises the steps: monitoring vulnerability updating information, carrying out the popularity analysis, screening out the information with high popularity based on a popularity threshold value, and extracting potential entities from the information; expanding the potential entity; and updating the knowledge graph based on the potential entities. According to the method, the dispersed vulnerability information is integrated in a manner of establishing the knowledge graph, so that the problem of information fragmentation is eliminated, network security managers can understand and utilize the vulnerability information more quickly and accurately, and the efficiency of coping with vulnerabilities is improved. On the basis, in order to ensure the real-time performance and accuracy of the Internet of Vehicles vulnerability information knowledge graph, a plurality of data sources are further monitored in real time through technologies such as machine learning and data mining, and potential entities needing to be updated are screened out for updating the knowledge graph in real time.

Description

Technical Field

[0001] The present invention belongs to the technical field of knowledge graph updating, and specifically relates to a method for updating a knowledge graph of Internet of Vehicles vulnerabilities based on a cloud platform. Background Art

[0002] The Internet of Vehicles system is highly complex. The system consists of smart vehicles, backend servers, and multiple supporting work units. Due to the diversity of components in the Internet of Vehicles system and the uneven distribution of vulnerabilities, different parts and levels of the system may become potential targets for vulnerability attacks. Attackers can exploit vulnerabilities to invade the system and threaten the safety of vehicles and systems. To ensure the network security of the Internet of Vehicles system, it is crucial to effectively manage and apply vulnerability information. However, the existing vulnerability databases and repositories are difficult to manage and apply, resulting in network security managers spending a lot of time and effort to integrate information. In addition, different vulnerability repositories use different classification methods and naming conventions, which increases the difficulty of information collection and filtering. At the same time, Internet of Vehicles vulnerabilities have the characteristics of continuous changes and periodic updates over time, which means that new Internet of Vehicles vulnerability information must be continuously obtained. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides a method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform to solve the problem of management and update of Internet of Vehicles vulnerability information.

[0004] The present invention achieves the above technical objectives through the following technical means.

[0005] A method for updating a knowledge graph of Internet of Vehicles vulnerabilities based on a cloud platform, comprising:

[0006] S1, monitors vulnerability update information and performs heat analysis, filters out high-heat information based on heat thresholds, and extracts potential entities from it;

[0007] S2, update the knowledge graph based on potential entities.

[0008] Furthermore, in S1, potential entities are extracted from the titles of the highly popular information by using regular expressions.

[0009] Furthermore, in S1, for unrecognized titles, an SVM model is used to perform entity recognition and the results are used as feedback to update the rule system, and then potential entities are re-extracted based on the updated rule system.

[0010] Furthermore, it also includes the expansion of potential entities after S1:

[0011] Based on the potential entities extracted in S1, search for relevant information in the recent days;

[0012] Use the SVM model to perform entity recognition on the relevant information and use the result as feedback to update the rule system;

[0013] Based on the updated rule system, potential entities are extracted from the titles of the relevant information.

[0014] Furthermore, before searching for relevant information, a correlation analysis is first performed on the potential entities extracted from S1, and one of the entities that are highly correlated with each other is retained, thereby eliminating the potential entities; and then the filtered potential entities are used to search for relevant information.

[0015] Furthermore, in S2, the Internet of Vehicles vulnerability knowledge graph is updated through knowledge fusion operations.

[0016] Furthermore, in S2, the potential entities are prioritized and several potential entities with higher priorities are selected to update the knowledge graph.

[0017] Furthermore, the priority sorting method is:

[0018] Potential entities belonging to new entities have the highest priority;

[0019] For potential entities belonging to old entities, the GBDT+LR fusion model is used to predict the update probability and they are arranged after the new entities in descending order of update probability.

[0020] Furthermore, an incremental update strategy is adopted to update the knowledge graph; updates are performed in batches based on the set maximum number of update nodes for each update.

[0021] Furthermore, the cloud server monitors vulnerability update information from multiple data sources, including on-board OBU, roadside base station RSU, and a professional database of vehicle network product security vulnerabilities.

[0022] The beneficial effects of the present invention are:

[0023] (1) The present invention provides a method for updating a knowledge graph of Internet of Vehicles vulnerabilities based on a cloud platform, wherein scattered vulnerability information is integrated by establishing a knowledge graph, thereby eliminating the problem of information fragmentation. By associating vulnerability information in different repositories and using a unified naming and classification standard, a comprehensive vulnerability information view is provided to achieve unified management and storage, making it easier for network security managers to understand and utilize vulnerability information more quickly and accurately, thereby improving the efficiency of responding to vulnerabilities. On this basis, in order to ensure the real-time and accuracy of the Internet of Vehicles vulnerability information knowledge graph, multiple data sources are further monitored in real time through machine learning and data mining technologies, and potential entities that need to be updated are screened out to update the knowledge graph in real time.

[0024] (2) The present invention adopts a heat algorithm to search for hot information to extract entities and update the knowledge graph, which has a high information retrieval efficiency.

[0025] (3) The present invention uses the SVM model to update the rule system for entity extraction in real time to meet the demand for new entity extraction.

[0026] (4) After the primary potential entities are initially collected and extracted, the present invention further performs certain expansion based on the primary potential entities to ensure the comprehensiveness of data update. Before the expansion, similarity analysis is performed to eliminate redundant data and improve the expansion efficiency.

[0027] (5) In the present invention, excessive potential entities are deleted in a targeted manner through priority sorting to avoid occupying excessive server computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a flow chart of the method for updating the Internet of Vehicles vulnerability knowledge graph of the present invention;

[0029] Figure 2 Extracting contextual graphs for cloud-based IoV vulnerability knowledge;

[0030] Figure 3 A schematic diagram of the ontology structure of a vehicle networking vulnerability knowledge graph provided in an embodiment of the present application;

[0031] FIG4( a ) is a visualization diagram of the Internet of Vehicles vulnerability knowledge graph provided in an embodiment of the present application;

[0032] FIG4( b ) is a partial enlarged view of FIG4( a );

[0033] Figure 4(c) is an example diagram of the CVE-2023-1234 Internet of Vehicles vulnerability knowledge graph in Figure 4(a). DETAILED DESCRIPTION

[0034] Embodiments of the present invention are described in detail below, examples of the illustrated embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0035] In response to the problems of uneven distribution of Internet of Vehicles vulnerability information, diverse presentation forms, and continuous changes, the embodiment of the present application first constructs a knowledge graph of relevant Internet of Vehicles vulnerability information to achieve unified management and storage of vulnerability information. Afterwards, a cloud platform-based update method is given for the constructed Internet of Vehicles vulnerability knowledge graph, which enables timely extraction of relationships between new entities from multiple data sources to update the knowledge graph. The above means make it easier for network security managers to understand and utilize vulnerability information more quickly and accurately, and to feed back the latest security protection recommendations to the on-board OBU (On board Unit) and roadside base station RSU (Road Side Unit), supporting dynamic security protection of the Internet of Vehicles system.

[0036] 1. Construction of the Internet of Vehicles Vulnerability Knowledge Graph

[0037] 1. Data Acquisition

[0038] like Figure 2 As shown, the cloud server collects Internet of Vehicles vulnerability information from multiple data sources and performs knowledge extraction (knowledge extraction). The multiple data sources include but are not limited to: vehicle-mounted OBU, roadside base station RSU, and vehicle network product security vulnerability professional database.

[0039] in:

[0040] 1) The on-board OBU monitors the status of the vehicle itself and transmits the detected vulnerability information to the nearby roadside base station RSU in real time. As an intermediate node, RSU is responsible for receiving the information sent by OBU, and aggregating and transmitting the information to the cloud server through V2I communication.

[0041] 2) The cloud server can directly obtain the latest vulnerability information from various data sources such as the professional database of security vulnerabilities of Internet of Vehicles products, security forums and reports of professional media through existing technical means such as subscription, API (Application Programming Interface) or automated scripts, and receive the vulnerability information transmitted by RSU at the same time.

[0042] 2. Ontology construction and triple definition of knowledge graph

[0043] Construct a knowledge graph ontology and define the entities and relationships therein; for example, including connection vulnerability related information, types, CVSS ratings, security tools, and affected vehicles.

[0044] For example, the ontology structure diagram of the Internet of Vehicles vulnerability knowledge graph constructed in the embodiment of the present application is as follows: Figure 3 shown.

[0045] in:

[0046] (1) Ontology construction:

[0047] Entity Definition 1 - IoV Vulnerability (IoV_Vulnerability): an entity representing an IoV vulnerability;

[0048] Entity Definition 2 - CWE Vulnerability Type (CWE_Vulnerability_Type): an entity representing a CWE vulnerability type;

[0049] Entity Definition 3 - CVSS Rating (CVSS_Rating): An entity representing the CVSS rating of a vulnerability.

[0050] Entity Definition 4 - Security_Tool: An entity representing a security tool related to an IoV vulnerability.

[0051] Entity Definition 5 - Vehicle: An entity representing a vehicle;

[0052] Relationship definition 1 - belongs_to_type: connects the IoV vulnerability and the CWE vulnerability type, indicating that an IoV vulnerability belongs to a certain CWE vulnerability type;

[0053] Relationship definition 2 — has_rating: connects an IoV vulnerability and a CVSS rating, indicating that an IoV vulnerability has a specific CVSS rating;

[0054] Relationship definition 3 — related_tool: connects an IoV vulnerability and a related security tool, indicating that the tool can be used to detect or defend against the vulnerability;

[0055] Relation Definition 4 — Affected Vehicle (affects_vehicle): connects the IoV vulnerability and the vehicle, indicating that the vulnerability affects a specific vehicle;

[0056] Attribute definition 1 - vulnerability name (vulnerability_name): indicates the name of the IoV vulnerability;

[0057] Attribute Definition 2 - Vulnerability Number (CVE): Indicates the CVE number of the IoV vulnerability;

[0058] Attribute definition 3 - vulnerability description (vulnerability_description): indicates the detailed description of the IoV vulnerability;

[0059] Attribute Definition 4 - Vulnerability Type Number (CWE): Indicates the CWE vulnerability type number to which the IoV vulnerability belongs;

[0060] Attribute Definition 5 - Vulnerability Type (vulnerability_type): Indicates the specific type of IoV vulnerability;

[0061] Property Definition 6 - CVSS Rating Score (cvss_score): indicates the CVSS rating score of the IoV vulnerability;

[0062] Attribute Definition 7 - CVSS Base Rating (base_score): indicates the CVSS base rating of the IoV vulnerability;

[0063] Property Definition 8 - CVSS Vector (vector): represents the CVSS vector of the IoV vulnerability;

[0064] Attribute Definition 9 - vulnerability_published_date: indicates the date when the IoV vulnerability was published.

[0065] Attribute Definition 10 - vulnerability_fixed_date: indicates the date when the IoV vulnerability was fixed.

[0066] Attribute definition 11 - affected_vehicle_count: indicates the number of vehicles affected by the vulnerability;

[0067] Attribute Definition 12 — vulnerability_source: indicates the source of the IoV vulnerability, such as public reports, security research, etc.

[0068] Attribute Definition 13 - vulnerability level (vulnerability_severity): indicates the severity level of the IoV vulnerability, such as low, medium, high, etc.

[0069] Attribute definition 14 - vehicle model (vehicle_model): represents the model information of the vehicle;

[0070] Attribute definition 15 - vehicle manufacturer (vehicle_manufacturer): represents the manufacturer information of the vehicle;

[0071] Attribute definition 16 - vehicle year (vehicle_year): indicates the year of manufacture of the vehicle;

[0072] Ontology constraint 1: IoV vulnerabilities must belong to a unique CWE vulnerability type, connected using the belongs_to_type relationship;

[0073] Ontology constraint 2 - IoV vulnerabilities can have multiple CVSS ratings, connected using the has_rating relationship;

[0074] Ontology constraint 3 — IoV vulnerabilities can be associated with multiple security tools, connected using the related_tool relationship;

[0075] Ontology constraint 4 — IoV vulnerabilities can affect multiple vehicles, connected using the affects_vehicle relationship;

[0076] Ontology constraint 5 - CVSS rating must have CVSS rating score, CVSS base rating and CVSS vector attributes;

[0077] (2) Triple definition

[0078] The relationship triplet definition between entities 1 - <IoV vulnerability, belongs_to_type, CWE vulnerability type>;

[0079] Relationship triplet definition 2 between entities - <IoV vulnerability, has_rating, CVSS rating>;

[0080] Relationship triplet definition between entities 3 - <IoV vulnerability, related_tool, security tool>;

[0081] Relationship triplet definition between entities 4 - <IoV vulnerability, affects_vehicle, vehicle>;

[0082] Entity attribute triplet definition 1 - <IoV vulnerability, vulnerability_name, vulnerability name>;

[0083] Entity attribute triplet definition 2 - <IoV vulnerability, CVE, vulnerability number>;

[0084] Entity attribute triplet definition 3 - <IoV vulnerability, vulnerability_description, vulnerability description>;

[0085] Entity attribute triple definition 4 - <IoV vulnerability, CWE, vulnerability type number>;

[0086] Entity attribute triplet definition 5 - <IoV vulnerability, vulnerability_type, vulnerability type>;

[0087] Entity attribute triplet definition 6 - <CVSS rating, cvss_score, CVSS rating score>;

[0088] Entity attribute triplet definition 7 - <CVSS rating, base_score, CVSS base rating>;

[0089] Attribute triplet definition 8 of entity - <CVSS rating, vector, CVSS vector>;

[0090] Entity attribute triple definition 9 - <IoV vulnerability, vulnerability_published_date, vulnerability release date>;

[0091] Entity attribute triplet definition 10 - <IoV vulnerability, vulnerability_fixed_date, vulnerability fix date>;

[0092] Entity attribute triple definition 11 - <IoV vulnerability, affected_vehicle_count, number of affected vehicles>;

[0093] Entity attribute triplet definition 12 - <IoV vulnerability, vulnerability_source, vulnerability source>;

[0094] Entity attribute triplet definition 13 - <IoV vulnerability, vulnerability_severity, vulnerability level>;

[0095] Entity attribute triple definition 14 - <vehicle, vehicle_model, vehicle model>;

[0096] Entity attribute triple definition 15 - <vehicle, vehicle_manufacturer, vehicle manufacturer>;

[0097] The attribute triplet definition of the entity 16 is 〈vehicle, vehicle_year, vehicle year〉.

[0098] 3. Knowledge Fusion

[0099] After the knowledge extraction of (1, data acquisition), knowledge fusion is performed on the Internet of Vehicles vulnerability data, including entity alignment, entity disambiguation, and attribute alignment; thereby integrating multi-source information.

[0100] 4. Knowledge Graph Embedding

[0101] The knowledge graph is constructed based on the fused data. Then, the knowledge graph is converted into a vector representation through the knowledge graph embedding operation; specifically, the graph embedding algorithm can be used to embed the knowledge graph. Finally, the embedding result is stored in the graph database to complete the construction of the entire knowledge graph and the graph visualization work.

[0102] Exemplarily, the Internet of Vehicles vulnerability knowledge graph constructed by the embodiment of the present application is shown in Figure 4, wherein Figure 4(a) is a global graph of the Internet of Vehicles vulnerability knowledge graph, Figure 4(b) is a captured partial enlarged graph, and Figure 4(c) is an example graph of the CVE-2023-1234 Internet of Vehicles vulnerability knowledge graph.

[0103] The method for constructing the Internet of Vehicles vulnerability knowledge graph shown in the above embodiment is only exemplary and is not a prerequisite or limitation for implementing the method for updating the Internet of Vehicles vulnerability knowledge graph of the present invention. Those skilled in the art may also adopt other means to construct the Internet of Vehicles vulnerability knowledge graph.

[0104] 2. Update of the knowledge graph of vehicle network vulnerabilities

[0105] Reference Figure 1 As shown, the method for updating the Internet of Vehicles vulnerability knowledge graph in the embodiment of the present application includes the following steps:

[0106] Step 1: Collect vulnerability update information

[0107] The cloud server monitors multiple data sources in real time and collects potential entities. The potential entities are defined as entities that can potentially be used to update the knowledge graph. Step 1 specifically includes:

[0108] Step 1.1, adopt the heat algorithm to perform heat analysis on each monitored information, and filter out high-heat information based on the pre-set heat threshold.

[0109] Step 1.2, perform entity recognition and extraction on the titles of the filtered high-profile information. Since the entities in the titles have certain rules, the required entities can be quickly matched and extracted by writing regular expressions; the extracted entities are regarded as first-level potential entities.

[0110] Exemplarily, taking Python language as an example, the regular expression of this embodiment is written as follows:

[0111] 1) Professional terms: Titles related to Internet of Vehicles security may contain some professional terms or keywords, such as "vulnerability, hacker, encryption, security protocol, Internet of Vehicles, OTA (Over-The-Air update), CAN (Controller Area Network)", etc.; therefore, the relevant regular expression is:

[0112] pattern1=r"(vulnerability|hacker|encryption|security protocol|Internet of Vehicles|OTA|CAN)"

[0113] 2) Entity type: In the context of the Internet of Vehicles, entities may include vehicle models, software names, security vulnerability numbers (such as CVE numbers), specific security events or attack types, etc. The corresponding regular expression is:

[0114] pattern2=r"(CVE-d+|Vehicle model|Software name|Security incident|Attack type)"

[0115] 3) Structural pattern: The title may follow some structured pattern, such as "[Vehicle model] security vulnerability fix", "[Software name] update to prevent [attack type]", etc.; the corresponding regular expression is:

[0116] pattern3=r"[(.*?)]"

[0117] 4) Urgency words: Security-related titles may use words that express urgency, such as "warning", "urgent", "immediate", etc., to emphasize the importance of security updates or warnings; the corresponding regular expression is:

[0118] pattern4=r"(warning|urgent|immediate)"

[0119] 5) Version information: The title of a software or firmware update may contain version information, such as "v1.2.3"; the corresponding regular expression is:

[0120] pattern5=r"v\d+\.\d+.\d+"

[0121] 6) Date and time: The title of a news or report may contain information about the date and time of the event or report release; the corresponding regular expression is:

[0122] pattern6=r"\d{4}year\d+month\d+day"

[0123] 7) Emotional color: The title may contain emotional words, such as "crisis", "threat", "safety", "protection", etc., to attract readers' attention; the corresponding regular expression is:

[0124] pattern7=r"(crisis|protection)"

[0125] 8) Abbreviations and acronyms: Due to the professional nature, abbreviations and acronyms may appear in the title, such as "IoT" (Internet of Things), "DDoS" (Distributed Denial of Service), etc.; the corresponding regular expression is:

[0126] pattern8=r"(IoT|DDoS)"

[0127] The first-level potential entities are quickly extracted through the above method.

[0128] Step 1.3, Update the rule system

[0129] At present, available knowledge units are generally extracted from information through automated or semi-automated technologies, including the extraction of entities, attributes, and relationships. For the extraction of entities, this embodiment adopts a rule-based approach; by using defined rules, entities such as vehicle names and vulnerability names in the text are extracted (such as the regular expressions written in the previous article). Since the rules are constructed based on existing knowledge, when faced with constantly updated knowledge, the rules need to be continuously updated to meet the needs of detecting new entities.

[0130] In this regard, this embodiment uses the SVM model to update the rule system (in the knowledge extraction operation), and uses the machine learning support vector machine SVM model to identify unknown entities and update the rules. This includes:

[0131] 1) Training SVM: Perform rule-based entity annotation on the title and use the annotated data to train the SVM model.

[0132] 2) When a title that the rule system cannot recognize appears, the SVM model is used to perform entity recognition on the corresponding title, and the result is used as feedback to update the rule system.

[0133] Note: If other technical means such as statistical machine learning-based methods are used to extract entities, it is not necessary to perform step 1.3.

[0134] Finally, the updated rule system is used to extract entities from the titles that were not recognized before, and the extracted entities are also used as first-level potential entities.

[0135] Step 2: Expand potential entities

[0136] Step 2.1, perform correlation analysis on the first-level potential entities and calculate the correlation between each entity; then, based on the pre-set correlation threshold, filter out entities that are highly correlated with each other (correlation is higher than the threshold). These highly correlated entities may be different representations of the same vulnerability, or related vulnerabilities, etc. Therefore, in order to improve the expansion efficiency, it is necessary to filter highly correlated entities to avoid repeated expansion; that is, for multiple highly correlated entities, only one entity is retained and the rest of the related entities are deleted.

[0137] Step 2.2, based on the first-level potential entities screened in step 2.1, search the data source for relevant information in the last few days (in this embodiment, the last 7 days) (such as searching the first-level potential entities as keywords in Internet search tools). Afterwards, the searched related information is also used to identify unknown entities using the SVM model, and the rule system is updated accordingly. Finally, the updated rule system is used to extract entities from the titles of the related information. The extracted entities are used as second-level potential entities, thereby achieving the expansion of potential entities in this way.

[0138] Step 3: Update the knowledge graph based on potential entities

[0139] Based on the searched first-level potential entities and second-level potential entities, the knowledge graph of Internet of Vehicles vulnerabilities is updated through knowledge fusion operations. However, usually, the amount of potential entity data prepared for each round of update is large; therefore, in order to ensure the update efficiency and avoid excessive update tasks, the potential entities are prioritized and the potential entities with lower priorities are deleted, thereby reducing the amount of knowledge graph update tasks in each round.

[0140] Step 3.1: Prioritization of potential entities

[0141] 1) Check whether the potential entity (including first-level potential entity and second-level potential entity) is a new entity (relative to the current Internet of Vehicles vulnerability knowledge graph). If it is a new entity, the priority of the potential entity is set to the highest. When there are multiple new entities, the priorities of the new entities can be unsorted or randomly sorted.

[0142] 2) For the remaining potential entities that are old entities, the GBDT+LR fusion model is used to predict their update probability. The processing process of the GBDT+LR fusion model is as follows:

[0143] a. Collect data related to entity update frequency: collect information such as historical update frequency, vulnerability characteristics, vulnerability type, start time of popularity increase, impact scope, historical repair frequency, average length of main content, number of linked entities, etc. for searching old entities;

[0144] b. Data preprocessing and feature engineering: To handle missing values, the mode can be used to fill in missing values; for numerical features, normalization is performed to speed up the convergence of the model and improve the model performance; for categorical features, one-hot encoding is used to convert discrete values ​​into continuous binary variables;

[0145] c. Use GBDT algorithm for feature screening and combination: GBDT is an ensemble learning algorithm that iteratively trains a series of decision trees, with each tree trying to correct the prediction error of the previous tree. GBDT can output the feature importance score of each sample, based on which important features can be screened out and combined to generate new feature vectors.

[0146] d. Generate discrete feature vectors: Based on the output of the GBDT model, a discrete feature vector for each sample can be obtained, which represents the selected features and their combination forms;

[0147] e. One-hot encoding of discrete feature vectors: For each feature, convert its discrete value into a binary vector whose length is equal to the number of feature values. Set the corresponding value position to 1 and the remaining positions to 0.

[0148] f. Build the LR model: The LR model is a classic classification algorithm. By learning the weights of features, the contribution of each feature to the prediction result can be estimated. The discrete feature vector encoded by one-hot is used as the input of the LR model, and the model is trained to predict the update probability of the entity.

[0149] g. Sigmoid operation mapping: The output of the LR model is a continuous value, which represents the probability of the prediction result. In order to map it to between 0 and 1, the Sigmoid function can be used for conversion.

[0150] 3) Potential entities of the old entity are placed after the new entity and sorted according to their respective update probabilities; the higher the update probability, the higher the corresponding priority.

[0151] Step 3.2: Based on the sorting results, select a number of potential entities with high priority (for example, the top 500) as entities to be finally updated.

[0152] Step 3.3: Update the knowledge graph by grouping and incrementing

[0153] Use the potential entities selected in step 3.2 to update the IoV vulnerability knowledge graph, where:

[0154] 1) For new entities, identify their attributes and relationships;

[0155] 2) For old entities, derive their new relationships through knowledge reasoning operations;

[0156] Then, through the knowledge fusion operation, the knowledge from different sources is integrated to represent the entities, relationships, and attributes as triples in a standardized form; the knowledge fusion operation is consistent with that during the construction of the knowledge graph.

[0157] Finally, an incremental update strategy is adopted to update the knowledge graph; that is, compared with the original knowledge graph, only new triples are added; if a new entity appears, the entity and its attributes are created, and its association with other entities is set. If the relationship between the old entities has changed, the corresponding association is modified. In the process of updating the knowledge graph, the maximum number of update nodes for one update can be set according to the server performance, so that the entities that need to be updated can be grouped, and the entities can be updated in batches to relieve the pressure during system updates. After all group data are updated, version control is performed to record update details (updates of entities, relationships, attributes), update time, and other information.

[0158] The present invention is not limited to the above-mentioned embodiments. Any obvious improvement, substitution or deformation that can be made by those skilled in the art without departing from the essential content of the present invention belongs to the protection scope of the present invention.

Claims

1. A method for updating a knowledge graph of Internet of Vehicles vulnerabilities based on a cloud platform, characterized in that: include: S1, monitors vulnerability update information and performs heat analysis, filters out high-heat information based on heat thresholds, and extracts potential entities from it; S2, update the knowledge graph based on potential entities.

2. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 1, characterized in that: In S1, potential entities are extracted from the titles of the highly popular information by using regular expressions.

3. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 2 is characterized in that: In S1, for unrecognized titles, the SVM model is used for entity recognition and the results are used as feedback to update the rule system, and then the potential entities are re-extracted based on the updated rule system.

4. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 1 is characterized in that: It also includes the expansion of potential entities after S1: Based on the potential entities extracted in S1, search for relevant information in the recent days; Use the SVM model to perform entity recognition on the relevant information and use the result as feedback to update the rule system; Based on the updated rule system, potential entities are extracted from the titles of the relevant information.

5. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 4 is characterized in that: Before searching for relevant information, a correlation analysis is first performed on the potential entities extracted from S1, and one of the entities that are highly correlated with each other is retained, thereby eliminating the potential entities; the filtered potential entities are then used to search for relevant information.

6. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 1, characterized in that: In S2, the IoV vulnerability knowledge graph is updated through knowledge fusion operations.

7. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 1 is characterized in that: In S2, the potential entities are prioritized and several potential entities with higher priorities are selected to update the knowledge graph.

8. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 7 is characterized in that: The priority sorting method is: Potential entities belonging to new entities have the highest priority; For potential entities belonging to old entities, the GBDT+LR fusion model is used to predict the update probability and they are arranged after the new entities in descending order of update probability.

9. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 1, characterized in that: An incremental update strategy is used to update the knowledge graph; updates are performed in batches based on the set maximum number of update nodes for each update.

10. The method for updating the Internet of Vehicles vulnerability knowledge graph based on a cloud platform according to claim 1, characterized in that: The cloud server monitors vulnerability update information from multiple data sources, including on-board OBU, roadside base station RSU, and a professional database of vehicle network product security vulnerabilities.

Images