Network data asset security identification method and system based on entity alignment

Abstract

The invention provides a network data asset security identification method and system based on entity alignment, and relates to the technical field of network security, and the method comprises the steps: obtaining network data assets, historical asset states of the network data assets and corresponding state marks; establishing an association relationship of network data assets; generating a first embedded representation of the concept entity, and generating a second embedded representation of the instance entity; integrating the first embedded representation and the second embedded representation to obtain a target entity; extracting entity features and entity tags of the target entities; constructing a random forest model; acquiring a real-time entity feature, namely a real-time asset state, about the to-be-identified target entity in the network data assets; inputting the real-time asset state into the random forest model, and outputting an identification result of the real-time asset state; and when the identification result is an abnormal state, outputting that the to-be-identified target entity is abnormal, otherwise, outputting that the to-be-identified target entity is normal. Cross-source rapid common defense can be completed, and the data security is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network data asset security identification method and system based on entity alignment. Background Art

[0002] Entity alignment refers to identifying and matching different entities representing the same object in different data sources, and integrating them into a unified representation. It is widely used in scenarios such as knowledge graphs and data integration to ensure that data from different sources can be analyzed and used in a unified manner. Network data assets refer to data resources that have value and meaning in the network environment, including device information (such as servers, routers, etc.), log information, user account information, etc. These assets provide key support for the daily operations and decision-making of enterprises.

[0003] In today's complex network environment, network data assets face a large number of potential security risks, such as data leakage, unauthorized access, malicious attacks, etc. Through network data asset security identification, abnormal data activities can be identified to protect the security of network data assets.

[0004] However, there are a large number of homogeneous and non-homogeneous heterogeneous data in network data. In cross-organizational collaboration, especially when sharing threat intelligence, different organizations may use different naming methods or formats to record threat sources and events. The existing asset security identification scheme does not consider the heterogeneity problem between different data sources, which hinders the sharing of data security issues and cross-organizational threat retrieval, reduces the common defense capabilities of network data assets, and also causes the same threat source or security incident to be regarded as multiple different events, resulting in false positives or negative positives, greatly increasing the security risks of network data assets. Summary of the invention

[0005] In order to solve the problem that there are a large number of homologous and non-homologous heterogeneous data in network data, in cross-organizational collaboration, especially when sharing threat intelligence, different organizations may use different naming methods or formats to record threat sources and events. The existing asset security identification scheme does not consider the heterogeneity problem between different data sources, which hinders the sharing of data security issues and cross-organizational threat retrieval, reduces the common defense capability of network data assets, and also causes the same threat source or security incident to be regarded as multiple different incidents, resulting in false positives or false negatives, greatly increasing the security risk of network data assets. The present invention provides a network data asset security identification method and system based on entity alignment.

[0006] The technical solution provided by the embodiment of the present invention is as follows:

[0007] First aspect:

[0008] An embodiment of the present invention provides a network data asset security identification method based on entity alignment, comprising:

[0009] S1: Acquire network data assets and historical asset states of network data assets and corresponding state marks, wherein the state marks include abnormal state marks and normal state marks;

[0010] S2: Establish the association relationship of network data assets, take network data assets as conceptual entities, and extract network data assets with objects as instance entities;

[0011] S3: Generate the first embedding representation of the concept entity using the BERT module, and generate the second embedding representation of the instance entity using the GAN module;

[0012] S4: Use the GCN module to integrate the first embedding representation and the second embedding representation to obtain the target entity;

[0013] S5: extracting entity features and entity labels of the target entity, and establishing a target entity training set, wherein the entity features are the historical asset states corresponding to the target entity, and the entity labels are the state labels corresponding to the historical asset states;

[0014] S6: Combine information entropy and build a random forest model based on the target entity training set;

[0015] S7: Acquire the real-time entity characteristics of the target entity to be identified in the network data asset, that is, the real-time asset status corresponding to the target entity to be identified;

[0016] S8: inputting the real-time asset status into the random forest model, and outputting the recognition result of the real-time asset status, wherein the recognition result includes a normal state and an abnormal state;

[0017] S9: When the identification result is abnormal, the target entity to be identified in the output network data asset is abnormal; otherwise, the target entity to be identified in the output network data asset is normal.

[0018] Second aspect:

[0019] An embodiment of the present invention provides a network data asset security identification system based on entity alignment, including:

[0020] processor;

[0021] A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the network data asset security identification method based on entity alignment as described in the first aspect is implemented.

[0022] The third aspect:

[0023] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method for securely identifying network data assets based on entity alignment as described in the first aspect is implemented.

[0024] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0025] In the present invention, network data assets are divided into generalized concept entities and detailed instance entities with objects, and then the BERT module and the GAN module are used to generate embedded representations of concept entities and instance entities respectively. Then, based on the embedded representation, the graph structure is used to complete entity alignment to obtain the target entity. BERT captures the deep semantic relationship of concept entities and enhances the understanding of abstract data; while the instance embedding generated by GAN can effectively protect data privacy and cope with the interference caused by distribution differences; alignment is completed using a graph structure, which can integrate global relationships, ensure accurate matching of different entities, improve the accuracy and robustness of alignment, and achieve data privacy protection. After alignment, the random forest model established in combination with information entropy is used to identify the real-time asset status and output the data status. The introduction of information entropy can dynamically adjust the feature weights, enhance the model's sensitivity to abnormal data, and accurately separate normal and abnormal states, so that the model can capture the diversity and uncertainty of data, effectively reduce the misjudgment rate, and provide more accurate real-time monitoring and risk warning functions. Combined with entity alignment, abnormal data activities from different sources can be identified and associated in a timely manner, helping enterprises to effectively monitor network security situation, improve the accuracy and real-time performance of asset protection, thereby significantly reducing security risks of data assets. When security issues arise, unified cross-organizational and cross-source rapid security responses can be completed in a timely manner, thereby improving joint defense capabilities, avoiding false alarms and missed alarms, and improving the security of network data assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 A flowchart of a network data asset security identification method based on entity alignment provided by an embodiment of the present invention;

[0028] Figure 2 A schematic diagram of the structure of an entity alignment model provided by an embodiment of the present invention;

[0029] Figure 3A schematic diagram of the structure of a network data asset security identification system based on entity alignment provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0031] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0032] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0033] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0034] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0035] Reference Manual Attached Figure 1 , showing a flow chart of a network data asset security identification method based on entity alignment provided in an embodiment of the present invention.

[0036] Reference Manual Attached Figure 2 , showing a structural schematic diagram of an entity alignment model provided by an embodiment of the present invention.

[0037] The embodiment of the present invention provides a network data asset security identification method based on entity alignment, which can be implemented by a network data asset security identification device based on entity alignment, and the network data asset security identification device based on entity alignment can be a terminal or a server. The processing flow of the network data asset security identification method based on entity alignment can include the following steps:

[0038] S1: Obtain network data assets and historical asset states of network data assets and corresponding state tags.

[0039] The status mark includes an abnormal status mark and a normal status mark.

[0040] It should be noted that obtaining basic information about network data assets, including their historical status and status tags, provides a basis for subsequent security identification. By collecting the behavior data of each asset at different time points and its status tags (normal or abnormal), a behavioral baseline for network assets is constructed to ensure that the system can identify and evaluate abnormal situations of assets and achieve accurate risk warnings.

[0041] In one possible implementation, the network data assets include Web servers, database servers, file servers, routers, switches, firewalls, applications, employee accounts, administrator accounts, and customer accounts.

[0042] Historical asset status includes the number of requests, accesses, network connections, access devices, and active users within a preset time period.

[0043] S2: Establish the association relationship of network data assets, take network data assets as conceptual entities, and extract network data assets with objects as instance entities.

[0044] Among them, entity instance alignment refers to unifying different representations pointing to the same specific object in different sources in the knowledge graph. For example, the same server may be recorded as "Server A", "Server_A" or "DB_Server_A" in different data sources. Through instance alignment, these different representations can be identified and matched, and integrated into a unified entity node. Concept entities are abstract concepts, while instance entities are specific concepts. For example, applications are concept entities, and application A, application B, etc. are instance entities. The abstract asset type is used as a concept entity, and the specific asset instance is used as an instance entity, so as to realize the alignment and integration of data from different sources. For example, by identifying different names for the same asset in different sources, the system can unify them into one node to ensure data consistency and accuracy. This process lays the foundation for subsequent embedding generation and entity alignment, which helps to achieve more comprehensive asset monitoring and analysis in cross-source data.

[0045] In a possible implementation, the association relationship is a knowledge graph. S2 specifically includes:

[0046] S201: Establish a knowledge graph of network data assets through Neo4j software.

[0047] Among them, Neo4j is a graph database management system that is specifically used to store and process graph-structured data and can efficiently manage the relationships between nodes. Neo4j uses the query language Cypher to support fast search for relationships and patterns in complex networks, which is very suitable for the construction and analysis of knowledge graphs. Knowledge graphs are a structured information representation method that intuitively displays the relationship network in the data through a graph composed of nodes (entities) and edges (relationships). Knowledge graphs are widely used in search, recommendation, data integration and other fields to help reveal the structural relationships hidden in the data. The knowledge graph of network data assets is constructed through Neo4j software, with various network assets (such as servers, routers, user accounts, etc.) as nodes and the relationship between assets as edges to form an association graph. This method intuitively displays the relationship network of network data assets, provides a structured basis for subsequent data analysis and alignment operations, and enables the system to more efficiently discover and identify the relationship between network assets.

[0048] S202: clustering the knowledge graph nodes based on the graph Laplacian matrix to obtain multiple node clusters;

[0049] In a possible implementation, S202 specifically includes:

[0050] S2021: Calculate the adjacency matrix and degree matrix of the knowledge graph nodes, where the elements of the adjacency matrix represent the connection relationship between each knowledge graph node. If there is a connection relationship, the corresponding element value is one, otherwise the value is zero. The elements of the degree matrix represent the number of connections between the knowledge graph node and other knowledge graph nodes.

[0051] S2022: Determine the graph Laplacian matrix of the knowledge graph node based on the adjacency matrix and degree matrix:

[0052] L=DA

[0053] Where L represents the graph Laplacian matrix obtained based on the adjacency matrix A and the degree matrix D.

[0054] S2023: Compute the normalized graph Laplacian matrix of the graph Laplacian matrix:

[0055]

[0056] Among them, L norm Represents the normalized graph Laplacian matrix.

[0057] S2024: Perform eigenvalue decomposition on the normalized graph Laplacian matrix, retain a preset number of eigenvalues ​​that is less than a preset eigenvalue, and calculate an eigenvector of each retained eigenvalue.

[0058] It should be noted that those skilled in the art can set the preset characteristic value and the preset number according to actual needs, and the present invention is not limited thereto.

[0059] S2025: Use the feature vector as the embedding representation of the corresponding knowledge graph node.

[0060] S2026: Cluster the embedded representation using a k-means algorithm to obtain multiple node clusters.

[0061] Among them, the graph Laplacian matrix is ​​a matrix used to describe the structure of a graph. It is widely used in graph theory, especially in graph segmentation and clustering tasks. Cluster the nodes of the knowledge graph based on the graph Laplacian matrix. First, the adjacency matrix and degree matrix of the node are calculated to generate the graph Laplacian matrix. Then, through normalization and eigenvalue decomposition, the important eigenvectors are used as node embedding representations, and the embeddings are clustered using the k-means algorithm to generate multiple node clusters. This process effectively separates different types of nodes in the knowledge graph, laying the foundation for accurately defining concepts and instance entities.

[0062] S203: Calculate the comprehensive centrality of each node cluster by combining degree centrality, closeness centrality and betweenness centrality:

[0063]

[0064] C composite (v) = αC d (v)+βC c (v)+γC b (v)

[0065] α+β+γ=1

[0066]

[0067] Among them, C composite cluster represents the comprehensive centrality of the node cluster S, C composite (v) represents the comprehensive centrality of the knowledge graph node v in the node cluster S, α, β and γ represent the degree centrality C of the knowledge graph node v in the node cluster respectively. d (v) Closeness centrality C c (v) and betweenness centrality C b deg(v) represents the degree of knowledge graph node v, i.e., the number of connections with other knowledge graph nodes. d(v,u) represents the shortest path distance between knowledge graph node v and knowledge graph node u. st represents the total number of shortest paths from knowledge graph node s to knowledge graph node t, σ st(v) represents the number of shortest paths passing through node v, N represents the total number of knowledge graph nodes, and V represents the set of knowledge graph nodes.

[0068] S204: Output the knowledge graph nodes in the node cluster whose comprehensive centrality is greater than the preset comprehensive centrality as concept entities, and output the knowledge graph nodes in the node cluster whose comprehensive centrality is less than or equal to the preset comprehensive centrality as instance entities.

[0069] Specifically, the association relationship of network data assets is represented by a knowledge graph. The specific steps include: first, using Neo4j software to build a knowledge graph of network data assets to intuitively represent the relationship between different assets. Then, based on the graph Laplace matrix, the knowledge graph nodes are clustered to obtain node clusters to clarify the aggregation characteristics of various types of assets. In each node cluster, the comprehensive centrality of the node is calculated by combining degree centrality, closeness centrality, and betweenness centrality. Finally, nodes with a comprehensive centrality greater than a preset value are defined as conceptual entities, and nodes less than or equal to this value are defined as instance entities, so as to accurately distinguish asset representations at different levels. This process ensures the accuracy of asset classification and lays the foundation for subsequent data analysis and identification.

[0070] It should be noted that those skilled in the art can set the size of the preset comprehensive centrality according to actual needs, and the present invention is not limited here.

[0071] S3: Use the BERT module to generate the first embedding representation of the concept entity, and use the GAN module to generate the second embedding representation of the instance entity.

[0072] Among them, the BERT (Bidirectional Encoder Representations from Transformers) module is a pre-trained language model based on deep learning, which can capture the deep semantics of words by understanding the context. It is good at extracting abstract concepts from text and generating high-quality embedded representations for the semantic expression of conceptual entities. The Generative Adversarial Network (GAN module) is a model for data generation, which consists of a generator and a discriminator. The generator is responsible for generating fake data that is close to the real data, while the discriminator is used to judge whether the data is true or false. Here, GAN is used to generate embedded representations of instance entities, which can generate diversified data expressions while protecting data privacy. Embedded representation is a representation method that maps high-dimensional data such as text and images into a low-dimensional space, so that similar concepts are closer in space, which is convenient for subsequent analysis or calculation.

[0073] It should be noted that the BERT module generates the embedding representation of the conceptual entity, and the GAN module generates the embedding representation of the instance entity, so as to achieve deep semantic understanding and privacy protection of the entity. This dual embedding method makes up for the problem of insufficient data and ensures that the original data does not need to be exposed during entity alignment, thereby protecting data privacy while accurately aligning, and enhancing the security and flexibility of the system. It makes up for the problem that it is difficult to accurately align dependent relational structures due to insufficient data, and also protects data privacy by not directly exposing the original data during the alignment process.

[0074] In a possible implementation, generating a first embedding representation of a concept entity using a BERT module specifically includes:

[0075] S301: Acquire external data about conceptual entities, wherein the external data includes general knowledge graphs and web documents.

[0076] Optionally, the general knowledge graph may select the DBpedia general knowledge graph.

[0077] S302: Extract descriptive text about the concept entity from external data.

[0078] S303: Generate topic distribution of descriptive text by combining LDA topic model:

[0079]

[0080] K opt =argmin K Perplexity(D,K)

[0081]

[0082] Among them, P(w|d,K opt ) represents the probability of word w in descriptive text d under the number of topics Kopt, P(w|d,K) represents the probability of word w in descriptive text d under the number of topics K, K opt represents the total number of topics about the descriptive text set D generated by the LDA topic model based on the perplexity Perplexity(D,K). Perplexity(D,K) represents the perplexity of D when the number of topics is K. argmin K Perplexity(D,K) means taking the number of topics K that minimizes Perplexity(D,K) as the optimal number of topics K opt , P(w|z=k) represents the probability distribution of word w in the current topic z, i.e., the kth topic, P(z=k|d) represents the topic distribution of d, log represents the logarithmic function, exp represents the natural exponential function, N dIt represents the number of words in d, that is, the length of the descriptive text d.

[0083] Among them, LDA (Latent Dirichlet Allocation) is a generative statistical model for topic modeling.

[0084] Among them, P(z=k|d) describes the probability of a word being assigned to a topic in the descriptive text d. This distribution represents the topic distribution of the document, that is, the proportion of topics in the document.

[0085] S304: Generate low-dimensional semantic embedding of topic distribution about concept entities through principal component analysis algorithm:

[0086] θ' d = PCA(θ d )

[0087] θ d =P(z=k|d)

[0088] Among them, θ' d Represents the intermediate variable θ obtained using the principal component analysis algorithm PCA d Low-dimensional semantic embedding of

[0089] S305: Generate BERT semantic embedding of low-dimensional semantic embedding using BERT module:

[0090] h(e i )=BERT(e i )

[0091] Among them, h(e i ) represents the i-th concept entity e i BERT semantic embedding, BERT represents the BERT module.

[0092] S306: Fuse low-dimensional semantic embedding and BERT semantic embedding to obtain the first embedding representation of the concept entity:

[0093] h final (e i )=ηh(e i )+(1-η)θ' d

[0094] Among them, h final (e i ) means e i The first embedding representation of is, and η represents the fusion weight coefficient.

[0095] Optionally, η=0.5.

[0096] It should be noted that LDA topic modeling maps the descriptive text of a conceptual entity to a topic distribution and generates a topic vector to represent the semantic features of each conceptual entity. The topic distribution vector can reflect the semantic similarity of different conceptual entities. For example, "database server" and "data storage" may have similar weights on the topic of "data processing", indicating that they have similar semantics. The output of LDA (i.e., the topic distribution vector) can be used as a feature of each conceptual entity to reflect its weight on different topics, helping us identify which conceptual entities are semantically similar. For example, if the topic distributions of two conceptual entities are similar, we can assume that they may be semantically related.

[0097] In this process, we first obtain external data of concept entities (such as DBpedia and web documents) and extract descriptive text from them. Then, we generate the topic distribution of descriptive text through the LDA topic model, use the topic vector to reflect the semantic features of the concept entity, and then use principal component analysis (PCA) to reduce its dimension. Then, we generate the BERT semantic embedding of low-dimensional semantic embedding through the BERT model, and fuse them to obtain the first embedding representation of the concept entity. Through this method, we not only capture the deep semantic relationship of the concept entity, but also improve the semantic recognition ability of similar concepts, providing high-quality embedding support for subsequent entity alignment.

[0098] In a possible implementation, generating a second embedding representation of an instance entity using a GAN module specifically includes:

[0099] S307: With the goal of generating entity embeddings that conform to real instances, the GAN module is trained under the supervision of an adversarial loss function. The adversarial loss function is specifically:

[0100]

[0101] Among them, min G max D The adversarial targets of the generator G and the discriminator D are G when the function takes the minimum value and D when the function takes the maximum value, respectively. data (x) represents the real instance entity distribution about the real instance entity x, p s (s) represents the noise distribution about noise s, D(x) represents the probability that x output by the discriminator D is a real instance entity, G(s) represents the generated instance entity generated by the generator about noise s, and D(G(s)) represents the probability that G(s) output by the discriminator D is a real instance entity. Represents the distribution of real instance entities p data The average value of all real instance entities x sampled in (x), Denotes the noise distribution p sThe average value of all noise s sampled in (s).

[0102] S308: Use the trained GAN module to output multiple generated instance entity embeddings, i.e., second embedding representations:

[0103] s i =G(s)

[0104] Among them, s i represents the entity embedding of the i-th generated instance generated based on the noise s.

[0105] It should be noted that the GAN module is used to generate the second embedding representation of the instance entity, and the adversarial training between the generator and the discriminator is used to generate a generated embedding that is close to the real instance embedding. The generator generates instance embeddings based on noise data, and the discriminator judges the authenticity of the generated embedding to ensure that the embedding is close to the real instance data. The final output embedding representation is privacy-preserving because they are generated based on noise and do not directly expose the original data, thereby achieving data privacy protection and diverse expression, laying the foundation for subsequent instance entity alignment.

[0106] S4: Use the GCN module to integrate the first embedding representation and the second embedding representation to obtain the target entity.

[0107] Among them, the GCN module GCN (Graph Convolutional Network) is a neural network specially designed for processing graph structure data. It achieves deep representation of each node in the graph by aggregating the features of the node and its neighboring nodes. GCN has significant advantages in processing related data such as knowledge graphs and social networks. It can integrate and propagate the feature information of nodes to obtain a more comprehensive embedding representation. The GCN module is used to integrate the embedding representations of conceptual entities and instance entities to generate a unified embedding representation of the target entity. By aggregating node features layer by layer, the GCN module associates conceptual entities and instance entities with each other in the graph structure, and finally forms an accurate entity alignment representation, which helps to capture the semantic and structural relationships of network assets in the global graph and enhance the overall consistency of the data.

[0108] In a possible implementation, S4 specifically includes:

[0109] S401: Assign the first embedding representation to the concept entity nodes in the knowledge graph, and assign the second embedding representation to the instance entity nodes in the knowledge graph respectively.

[0110] S402: Calculate the adjacency matrix and weight matrix of the assigned knowledge graph respectively:

[0111] S403: Based on the adjacency matrix and weight matrix, the knowledge graph is integrated in the GCN module:

[0112] H (l+1) =σ(A'H (l) W (l) )

[0113] H (0) =h final (e i )+s i

[0114] Among them, H (l) and H (l+1) denote the node embedding matrices of the lth layer GCN and the l+1th layer GCN of the GCN module including the first embedding representation and the second embedding representation, respectively, A' denotes the adjacency matrix of the knowledge graph after allocation, and W (l) represents the learnable weight matrix used to transform the node embedding of layer l into the node embedding of layer l+1, σ represents the ReLU activation function, and H (0) represents the initial node embedding matrix, s i represents the entity embedding of the i-th generated instance based on the noise s, h final (e i ) means e i The first embedding representation of .

[0115] Optionally, the learnable weight matrix may be calculated as follows:

[0116] Randomly initialize the learnable weight matrix.

[0117] In each integration process, based on the principle of back-propagation, the gradient descent method is used to update the initialized learnable weight matrix until the change rate of the learnable weight matrix is ​​less than the preset change rate:

[0118]

[0119] Among them, λ represents the learning rate, Represents the cross entropy loss function L with respect to W before update (l) The gradient of It means to find partial derivative, y i and Represent the true label and predicted label of node i respectively, and N represents the total number of knowledge graph nodes in the knowledge graph.

[0120] The knowledge graph is integrated using the integrated learnable weight matrix.

[0121] It should be noted that the update of the learnable weight matrix uses the gradient descent method. The specific steps are to calculate the gradient of the loss function to the weight matrix through back propagation, so as to find the direction of weight adjustment and make the model classify nodes more accurately. First, the weight matrix is ​​randomly initialized, and through multiple iterations, the difference between the predicted value and the true label is calculated according to the loss function, and the gradient of the weight matrix is ​​back propagated to update the weight and gradually reduce the error. Using these optimized weights, the semantic relationship between knowledge graph nodes is integrated, so that the model can have stronger recognition accuracy and robustness on new data.

[0122] S404: Output each knowledge graph node in the integrated knowledge graph as a target entity.

[0123] It should be noted that in each layer of GCN, the embeddings of concept entities and instance entities aggregate the features of their respective neighboring nodes layer by layer. This means that the features of concept entities will propagate to instance entities to a certain extent, and the features of instance entities will also have an impact on concept entities. Through multi-layer convolution calculations, concept and instance embeddings are gradually merged into a unified embedding space to achieve the semantic association required for alignment.

[0124] Specifically, in S4, the first embedding representation and the second embedding representation are first assigned to the concept entity node and the instance entity node in the knowledge graph, respectively. Then, the adjacency matrix and weight matrix of the knowledge graph are calculated to support the embedding integration in the GCN module. Through multi-layer graph convolution, each layer gradually aggregates the features of neighbor nodes, so that the concept entity and the instance entity are gradually merged in the embedding space, and finally a unified target entity embedding representation is generated. This method ensures that the semantic associations between concept and instance entities are fully mined, providing a solid structural foundation for achieving precise alignment.

[0125] S5: Extract entity features and entity labels of the target entity and establish a target entity training set.

[0126] Among them, the entity feature is the historical asset status corresponding to the target entity, and the entity label is the status mark corresponding to the historical asset status.

[0127] It should be noted that the status mark in the training set of the target entity remains the same and unchanged, the asset status. The historical asset status of the target entity is used as the entity feature, and the corresponding status mark (such as normal or abnormal) is used as the entity label to establish a training set. By integrating the behavior history and status mark of the target entity into training data, the model can better learn the characteristic performance of the target entity in different states, thereby improving the recognition accuracy of future asset status. This process provides a reliable data foundation for subsequent anomaly detection models, which helps to accurately locate the security risks of network assets.

[0128] S6: Combined with information entropy, a random forest model is constructed based on the target entity training set.

[0129] Among them, information entropy is a concept in information theory, which is used to measure the uncertainty or information content of data. The larger the entropy value, the higher the degree of chaos in the data. In classification tasks, information entropy can be used to measure the contribution of features to class distinction and help decision trees select the best split point. The random forest model is an integrated learning model that performs classification or regression by constructing multiple decision trees. Each tree randomly selects part of the data and features for training, and finally obtains the final prediction through the voting results or average of all trees. The advantage of random forest is that it can reduce the bias and variance of a single decision tree and improve the stability and generalization ability of the model. Information entropy is used to guide the construction of the random forest model and help determine the best splitting strategy, so as to train a model that can accurately identify anomalies on the target entity training set. Through the integration of multiple decision trees, random forest avoids the bias problem of a single tree, and detects and marks abnormal states in new data by learning the feature patterns in historical data, thereby improving the robustness of the model and its sensitivity to abnormal data. This method ensures efficient monitoring of network data assets and reduces the rate of false positives and missed positives.

[0130] In a possible implementation, S6 specifically includes:

[0131] S601: Initialize a random forest with multiple decision trees, where the decision tree parameters of each decision tree are different:

[0132] T j =DecisionTree(X j ,Y j ,d j ,s j ),j=1,2,…,m

[0133] Among them, T j represents the j-th decision tree of the random forest, d j and j Respectively represent T j The depth and segmentation threshold of the decision tree are the minimum number of sample segmentations, m represents the number of decision trees, and X j and Y j Respectively represent the functions used to construct T j Entity features and entity labels in the training subset of .

[0134] Optionally, the specific calculation method of the decision tree depth, the decision tree segmentation threshold and the number of decision trees is:

[0135]

[0136] Among them, m, d, s minRespectively represent the number of decision trees, decision tree depth and minimum split threshold of each decision tree, δ = 0.05 represents the error probability under the PAC learning framework, ε = 0.01 represents the error margin, VCdim(m) represents the VC dimension of random forest complexity under the current number of decision trees m, N' represents the total number of training samples consistent with the total number of knowledge graph nodes, τ = 0.5 represents the adjustment factor for controlling the range of decision tree depth expansion, VCdim(d) represents the VC dimension of random forest complexity under the current decision tree depth d, R(d) represents the Rademacher complexity of random forest generalization ability under the current decision tree depth d, ξ = 0.1 represents the adjustment factor for controlling the number of decision tree splits, ψ represents the minimum split threshold s at the current minimum split threshold min The tolerance error probability calculated by the Hoeffding inequality is: CRB(Y) represents the tolerance error probability under the current minimum segmentation threshold s min The following metric random forest model is used for entity label Y j Cramer-Rao lower bound on forecast accuracy.

[0137] It should be noted that the VC dimension and the number of training samples are used to ensure that the complexity of the random forest model is reasonable, avoid overfitting and underfitting, and help select a suitable number of decision trees so that the model can strike a balance between accuracy and computational efficiency. The depth is constrained by the VC dimension and Rademacher complexity, which measure the generalization ability and complexity of the model, ensuring that the stability of the model is not sacrificed while achieving high accuracy, and avoiding overfitting caused by excessive depth. The minimum segmentation threshold is set by the Cramer-Rao lower bound and the Hoeffding inequality error constraint to ensure that the model is robust to small data fluctuations while maintaining the accuracy of the prediction. Overall, this parameter selection method uses the basis of statistical learning theory to dynamically adjust the model structure to achieve higher generalization ability and stable prediction results on complex data. This not only improves the model's sensitivity to abnormal situations, but also reduces the misjudgment rate, making random forests more reliable in complex network data asset security identification tasks.

[0138] S602: Divide the training set according to the number of decision trees to obtain multiple training subsets.

[0139] S603: Number the samples in each training subset.

[0140] S604: Calculate the information gain of samples with different numbers as split nodes respectively:

[0141]

[0142] Among them, H(Y) represents the information entropy of the training subset Y, H(Y q) represents each subset Y obtained by taking the sample corresponding to number q as the splitting node q The sum of the information entropy.

[0143] It should be noted that the entropy after segmentation is significantly reduced (that is, the information gain is large), indicating that this feature can segment the data set well. Therefore, the larger the information gain, the more suitable this feature is for splitting nodes.

[0144] S605: Select samples corresponding to numbers whose information gain values ​​are greater than a preset information gain value as the splitting criteria of the decision tree to train the decision tree to obtain a random forest model.

[0145] It should be noted that random forests enhance the generalization and accuracy of the model for data by initializing multiple decision trees with different parameters. By sampling the training set multiple times, each decision tree independently evaluates different data slices to enhance the understanding of the data. This method can effectively reduce the bias of the model, because different trees can capture data features from their own perspectives and reduce the risk of overfitting. Information gain, as a criterion for selecting the best split, ensures the optimal split of the decision tree at each node to minimize the uncertainty after each split and improve the prediction accuracy of the entire model.

[0146] S7: Acquire the real-time entity features of the target entity to be identified in the network data assets, that is, the real-time asset status corresponding to the target entity to be identified.

[0147] S8: Input the real-time asset status into the random forest model and output the recognition result of the real-time asset status.

[0148] The recognition results include normal state and abnormal state.

[0149] S9: When the identification result is abnormal, the target entity to be identified in the output network data asset is abnormal; otherwise, the target entity to be identified in the output network data asset is normal.

[0150] In a possible implementation manner, after S9, the method further includes:

[0151] In the event that the target entity to be identified is abnormal, a warning message for starting a defense mode is sent to the source entity aligned to the target entity to be identified.

[0152] Among them, the source entity is other entities aligned to the target entity. In the case of a unified target entity to be identified, when an anomaly is found, cross-source warnings can be completed quickly, and rapid responses and joint defenses can be performed to improve the security of network data assets.

[0153] In the actual application process, based on the entity alignment technology, network data assets are divided into abstract conceptual entities (such as applications) and specific instance entities (such as applications A and B), and embedded representations are generated through the BERT and GAN modules respectively, so as to integrate information from different data sources under the premise of protecting privacy. After that, the graph structure is aligned through the GCN module to ensure accurate matching of entities from different sources and generate target entities. The random forest model optimized by information entropy is combined to monitor the real-time asset status. The model weight can be dynamically adjusted according to the diversity and uncertainty of the data status to improve the sensitivity of anomaly detection. This method not only improves the real-time and accuracy in the security monitoring of network data assets, but also realizes cross-organizational collaborative defense, effectively reduces false positives and false negatives, and provides strong support for network security monitoring.

[0154] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0155] In the present invention, network data assets are divided into generalized concept entities and detailed instance entities with objects, and then the BERT module and the GAN module are used to generate embedded representations of concept entities and instance entities respectively. Then, based on the embedded representation, the graph structure is used to complete entity alignment to obtain the target entity. BERT captures the deep semantic relationship of the concept entity and enhances the understanding of abstract data. The instance embedding generated by GAN can effectively protect data privacy and cope with the interference caused by distribution differences. The alignment is completed using the graph structure, which can integrate global relationships, ensure accurate matching of different entities, improve the accuracy and robustness of alignment, and achieve data privacy protection. After alignment, the random forest model established in combination with information entropy is used to identify the real-time asset status and output the data status. The introduction of information entropy can dynamically adjust the feature weight, enhance the model's sensitivity to abnormal data, and accurately separate normal and abnormal states, so that the model can capture the diversity and uncertainty of data, effectively reduce the misjudgment rate, and provide more accurate real-time monitoring and risk warning functions. Combined with entity alignment, abnormal data activities from different sources can be identified and associated in a timely manner, helping enterprises to effectively monitor network security situation, improve the accuracy and real-time performance of asset protection, thereby significantly reducing security risks of data assets. When security issues arise, unified cross-organizational and cross-source rapid security responses can be completed in a timely manner, thereby improving joint defense capabilities, avoiding false alarms and missed alarms, and improving the security of network data assets.

[0156] Reference Manual Attached Figure 3 , showing a structural schematic diagram of a network data asset security identification system based on entity alignment provided by the present invention.

[0157] The present invention further provides a network data asset security identification system 20 based on entity alignment, which is applied to the above-mentioned network data asset security identification method based on entity alignment, and comprises:

[0158] Processor 201.

[0159] The memory 202 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 201, a network data asset security identification method based on entity alignment as in the method embodiment is implemented.

[0160] The network data asset security identification system 20 based on entity alignment provided by the present invention can execute the above-mentioned network data asset security identification method based on entity alignment and achieve the same or similar technical effects. To avoid repetition, the present invention will not go into details.

[0161] It should be understood that the processor in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0162] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0163] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0164] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0165] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0166] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0167] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0168] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0169] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0170] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0171] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0172] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0173] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method for securely identifying network data assets based on entity alignment as described in the method embodiment is implemented.

[0174] A computer-readable storage medium provided by the present invention can implement the steps and effects of the network data asset security identification method based on entity alignment of the above method embodiment. To avoid repetition, the present invention will not go into details.

[0175] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0176] There are a few points to note:

[0177] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0178] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0179] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0180] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network data asset security identification method based on entity alignment, characterized in that: include: S1: Acquire a network data asset and a historical asset status of the network data asset and a corresponding status mark, wherein the status mark includes an abnormal status mark and a normal status mark; S2: Establishing the association relationship of the network data assets, taking the network data assets as conceptual entities, and extracting the network data assets with objects as instance entities; S3: Generate a first embedding representation of the concept entity using a BERT module, and generate a second embedding representation of the instance entity using a GAN module; S4: using a GCN module to integrate the first embedding representation and the second embedding representation to obtain a target entity; S5: extracting entity features and entity labels of the target entity to establish a target entity training set, wherein the entity features are historical asset states corresponding to the target entity, and the entity labels are state labels corresponding to the historical asset states; S6: combining information entropy and building a random forest model based on the target entity training set; S7: Acquire the real-time entity characteristics of the target entity to be identified in the network data asset, that is, the real-time asset status corresponding to the target entity to be identified; S8: inputting the real-time asset status into the random forest model, and outputting the recognition result of the real-time asset status, wherein the recognition result includes a normal state and an abnormal state; S9: When the identification result is abnormal, outputting that the target entity to be identified in the network data asset is abnormal; otherwise, outputting that the target entity to be identified in the network data asset is normal.

2. The network data asset security identification method based on entity alignment according to claim 1 is characterized in that: The network data assets include web servers, database servers, file servers, routers, switches, firewalls, applications, employee accounts, administrator accounts, and customer accounts; The historical asset status includes the number of requests, the number of visits, the number of network connections, the number of access devices and the number of active users within a preset time period.

3. The network data asset security identification method based on entity alignment according to claim 1 is characterized in that: The association relationship is a knowledge graph; S2 specifically includes: S201: Establishing a knowledge graph of the network data assets through Neo4j software; S202: clustering the knowledge graph nodes based on the graph Laplacian matrix to obtain multiple node clusters; S203: Calculate the comprehensive centrality of each node cluster by combining degree centrality, closeness centrality and betweenness centrality: C composite (v)=αC d (v)+βC c (v)+γC b (v) α+β+γ=1 Among them, C compositecluster represents the comprehensive centrality of the node cluster S, C composite (v) represents the comprehensive centrality of the knowledge graph node v in the node cluster S, α, β and γ represent the degree centrality C of the knowledge graph node v in the node cluster respectively. d (v) Closeness centrality C c (v) and betweenness centrality C b deg(v) represents the degree of knowledge graph node v, i.e., the number of connections with other knowledge graph nodes. d(v,u) represents the shortest path distance between knowledge graph node v and knowledge graph node u. st represents the total number of shortest paths from knowledge graph node s to knowledge graph node t, σ st (v) represents the number of shortest paths passing through node v, N represents the total number of knowledge graph nodes, and V represents the set of knowledge graph nodes; S204: Output the knowledge graph nodes in the node cluster whose comprehensive centrality is greater than the preset comprehensive centrality as the concept entity, and output the knowledge graph nodes in the node cluster whose comprehensive centrality is less than or equal to the preset comprehensive centrality as the instance entity.

4. The network data asset security identification method based on entity alignment according to claim 3 is characterized in that: The S202 specifically includes: S2021: Calculate the adjacency matrix and degree matrix of the knowledge graph nodes, wherein the elements of the adjacency matrix represent the connection relationship between two knowledge graph nodes, and if there is a connection relationship, the corresponding element value is one, otherwise the value is zero, and the elements of the degree matrix represent the number of connections between the knowledge graph node and other knowledge graph nodes; S2022: Determine the graph Laplacian matrix of the knowledge graph node based on the adjacency matrix and the degree matrix: L=DA Where L represents the graph Laplacian matrix obtained based on the adjacency matrix A and the degree matrix D; S2023: Calculate the normalized graph Laplacian matrix of the graph Laplacian matrix: Among them, L norm represents the normalized graph Laplacian matrix; S2024: performing eigenvalue decomposition on the normalized graph Laplacian matrix, retaining a preset number of eigenvalues ​​that is less than a preset eigenvalue, and calculating eigenvectors of each retained eigenvalue; S2025: Using the feature vector as an embedding representation of a corresponding knowledge graph node; S2026: Clustering the embedded representation using a k-means algorithm to obtain multiple node clusters.

5. The network data asset security identification method based on entity alignment according to claim 1 is characterized in that: The step of generating a first embedding representation of the concept entity using a BERT module specifically includes: S301: Acquire external data about the concept entity, wherein the external data includes a general knowledge graph and a web page document; S302: extracting descriptive text about the concept entity from the external data; S303: Generate topic distribution of the descriptive text in combination with the LDA topic model: K opt =argmin K Perplexity(D,K) Among them, P(w|d,K opt ) represents the probability of word w in descriptive text d under the number of topics Kopt, P(w|d,K) represents the probability of word w in descriptive text d under the number of topics K, K opt represents the total number of topics about the descriptive text set D generated by the LDA topic model based on the perplexity Perplexity(D,K). Perplexity(D,K) represents the perplexity of D when the number of topics is K. argmin K Perplexity(D,K) means taking the number of topics K that minimizes Perplexity(D,K) as the optimal number of topics K opt , P(w|z=k) represents the probability distribution of word w in the current topic z, i.e., the kth topic, P(z=k|d) represents the topic distribution of d, log represents the logarithmic function, exp represents the natural exponential function, N d represents the number of words in d, i.e. the length of the descriptive text d; S304: Generate a low-dimensional semantic embedding of the topic distribution of the concept entity through a principal component analysis algorithm: I will d =PCA(θ d ) θ d =P(z=k|d) Among them, θ' d Represents the intermediate variable θ obtained using the principal component analysis algorithm PCA d Low-dimensional semantic embedding of S305: Generate the BERT semantic embedding of the low-dimensional semantic embedding using the BERT module: h(e i )=BERT(e i ) Among them, h(e i ) represents the i-th concept entity e i BERT semantic embedding, BERT represents the BERT module; S306: Fusing the low-dimensional semantic embedding and the BERT semantic embedding to obtain a first embedding representation of the concept entity: h final (e i )=ηh(e i )+(1-η)θ' d Among them, h final (e i ) means e i The first embedding representation of is, and η represents the fusion weight coefficient.

6. The network data asset security identification method based on entity alignment according to claim 1 or 5 is characterized in that: The using a GAN module to generate a second embedding representation of the instance entity specifically includes: S307: With the goal of generating entity embeddings that conform to real instances, the GAN module is trained under the supervision of an adversarial loss function, where the adversarial loss function is specifically: Among them, min G max D The adversarial targets of the generator G and the discriminator D are G when the function takes the minimum value and D when the function takes the maximum value, respectively. data (x) represents the real instance entity distribution about the real instance entity x, p s (s) represents the noise distribution about noise s, D(x) represents the probability that x output by the discriminator D is a real instance entity, G(s) represents the generated instance entity generated by the generator about noise s, and D(G(s)) represents the probability that G(s) output by the discriminator D is a real instance entity. Represents the distribution of real instance entities p data The average value of all real instance entities x sampled in (x), Denotes the noise distribution p s The average value of all noise s sampled in (s); S308: Use the trained GAN module to output multiple generated instance entity embeddings, namely the second embedding representation: s i =G(s) Among them, s i represents the entity embedding of the i-th generated instance generated based on the noise s.

7. The network data asset security identification method based on entity alignment according to claim 5 is characterized in that: The S4 specifically includes: S401: assigning the first embedding representation to the concept entity nodes in the knowledge graph, and assigning the second embedding representation to the instance entity nodes in the knowledge graph respectively; S402: Calculate the adjacency matrix and weight matrix of the assigned knowledge graph respectively; S403: Based on the adjacency matrix and the weight matrix, the knowledge graph is integrated in the GCN module: H (l+1) =σ(A'H (l) W (l) ) H (0) =h final (e i )+s i Among them, H (l) and H (l+1) denote the node embedding matrices of the lth layer GCN and the l+1th layer GCN of the GCN module including the first embedding representation and the second embedding representation, respectively, A' denotes the adjacency matrix of the knowledge graph after allocation, and W (l) represents the learnable weight matrix used to transform the node embedding of layer l into the node embedding of layer l+1, σ represents the ReLU activation function, and H (0) represents the initial node embedding matrix, s i represents the entity embedding of the i-th generated instance based on the noise s, h final (e i ) means e i The first embedding representation of ; S404: Output each knowledge graph node in the integrated knowledge graph as the target entity.

8. The network data asset security identification method based on entity alignment according to claim 1 is characterized in that: The S6 specifically includes: S601: Initialize a random forest with multiple decision trees, where the decision tree parameters of each decision tree are different: T j =DecisionTree(X j ,Y j ,d j ,s j ),j=1,2,…,m Among them, T j represents the j-th decision tree of the random forest, d j and j Respectively represent T j The depth and segmentation threshold of the decision tree are the minimum number of sample segmentations, m represents the number of decision trees, and X j and Y j Respectively represent the functions used to construct T j Entity features and entity labels in the training subset of ; S602: Divide the training set according to the number of decision trees to obtain multiple training subsets; S603: numbering samples in each training subset; S604: Calculate the information gain of samples with different numbers as split nodes respectively: Among them, H(Y) represents the information entropy of the training subset Y, H(Y q ) represents each subset Y obtained by taking the sample corresponding to number q as the splitting node q The sum of the information entropy of S605: Select samples corresponding to numbers whose information gain values ​​are greater than a preset information gain value as the splitting criteria of the decision tree to train the decision tree to obtain the random forest model.

9. The network data asset security identification method based on entity alignment according to claim 1 is characterized in that: After S9, the method further includes: In the case that the target entity to be identified is abnormal, a warning message for starting a defense mode is sent to a source entity aligned with the target entity to be identified.

10. A network data asset security identification system based on entity alignment, characterized in that: include: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the network data asset security identification method based on entity alignment as described in any one of claims 1 to 9 is implemented.

Images