Network security threat sensing device and method based on knowledge reasoning and algorithm service

Abstract

The invention discloses a network security threat perception device and method based on knowledge reasoning and algorithm service, and the device comprises a security threat perception and research and judgment subsystem which is configured to complete network security threat perception, and achieves the suspected threat research and judgment together with a knowledge extension subsystem, and generates a defense plan; the knowledge base knowledge extension and service subsystem is configured to extract knowledge from the network security threat field data for knowledge extension and provide knowledge service for the threat perception subsystem and knowledge base users; the intelligent algorithm model training and application subsystem is configured to perform intelligent enabling on a situation threat perception model uploaded by the threat perception subsystem, a knowledge reasoning model uploaded by the knowledge extension subsystem, a semantic association model uploaded by the semantic fusion subsystem and the like in the algorithm training subsystem; and the semantic knowledge fusion and application subsystem is configured to complete dynamic expansion, visual display and application service of the network security threat knowledge graph.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security threat perception, and in particular, relates to a network security threat perception device and method based on knowledge reasoning and algorithm service. Background Art

[0002] With the continuous evolution of network attack methods and the ever-increasing innovation of attack methods, traditional network security protection measures are facing huge challenges. Existing network security threat perception methods mainly rely on known threat feature libraries and rule libraries for protection. However, these methods are difficult to effectively deal with zero-day attacks and advanced persistent threats (APT).

[0003] First, since most network security threat perception methods are based on static feature matching and rule detection, they lack flexibility and adaptability in dealing with new attack methods. Attackers can easily bypass these static protection mechanisms by slightly modifying attack features and techniques. In addition, the update lag and incompleteness of the rule base also make these methods unable to detect and respond to new threats in a timely manner.

[0004] Secondly, existing network security threat perception methods lack effective knowledge reasoning and intelligent analysis capabilities. Although some methods have introduced machine learning and big data analysis technologies, these technologies have great limitations in terms of data samples and computing resource requirements, especially when facing unknown attack data and complex attack patterns, it is difficult to provide efficient and accurate threat perception and analysis services.

[0005] In addition, the construction and maintenance of knowledge bases have become an important part of cybersecurity threat perception. Traditional knowledge bases often rely on manual updates and management, which is not only inefficient but also prone to redundant and inconsistent cybersecurity threat information. In the face of evolving cybersecurity threats, how to achieve automatic expansion, intelligent association and reasoning of knowledge bases has also become a problem that needs to be solved urgently.

[0006] In order to solve the above problems, a network security threat perception device and method based on knowledge reasoning and algorithm service is urgently needed. By integrating technologies such as knowledge base reasoning, intelligent algorithm service and semantic knowledge expansion, it can achieve efficient and accurate threat perception in a complex and changing network security threat environment, providing strong support for network security.

[0007] The relevant patents currently disclosed include:

[0008] 1. Patent "A Threat Situation Perception Assessment Method and System for Multi-granular Network Anomaly Detection", application (patent) number: CN202311798676.5, application date: December 26, 2023. The invention discloses a network anomaly detection method that integrates the website front-end user click behavior and the Uniform Resource Locator (URL) access logic. By extracting the user's access behavior characteristics, it realizes the discovery and early warning of the user's abnormal access behavior. The invention focuses on the detection of user click behavior and URL access logic.

[0009] 2. Patent "Network Security Monitoring and Response System", application (patent) number: CN202410370378.4, application date: March 29, 2024. The invention discloses the system composition of a network security monitoring and response system and the functions of its various functional modules. First, network activity data is collected from network traffic, and then potential security threats and abnormal behaviors are identified through application recognition algorithms. Finally, potential security threat development trends and patterns are identified by analyzing long-term network activity data. The invention focuses on identifying potential network security threats through network traffic analysis.

[0010] 3. Patent "Network Security Situation Perception and Early Warning Method and System Based on Big Data", application (patent) number: CN202410293915.X, application date: March 14, 2024. This invention discloses a method and system for obtaining massive network operation data and performing network security situation perception and analysis processing, which can extract possible risk data based on risk perception results and generate corresponding risk warning information. This invention focuses on situation perception and risk warning of massive data.

[0011] 4. Patent "Network Security Situation Prediction Method and System Based on Artificial Intelligence", application (patent) number: CN202311846583.5, application date: December 29, 2023. The invention discloses a method of using deep learning models to train historical network activity data, monitor real-time network activity data, and regularly update the model to detect new network security threats. The invention focuses on using deep learning models to predict network security situations. Summary of the invention

[0012] The purpose of the present invention is to: the current network faces more complex network security threats, the attack vectors are becoming more diverse, and the attack means are becoming more intelligent. The existing technology often has good perception and detection capabilities for ordinary network attacks, but there is a large technical gap in the threat perception of complex network attacks. First, most of the existing network security threat perception technologies are based on known network attack features. It is difficult to effectively build a detection model under sparse sample conditions, and lacks the ability to perceive network security threats for which prior knowledge is not mastered; second, the existing network security threat perception technology has insufficient granularity in threat situation analysis, and lacks the ability to accurately predict complex network security threat situations in real time.

[0013] In order to solve the above problems, the present invention proposes a network security threat perception device and method based on knowledge reasoning and algorithm services, aiming to achieve deep understanding, rapid detection and accurate response to complex network security threats by integrating knowledge base reasoning, intelligent algorithm services and semantic knowledge expansion technology.

[0014] On the one hand, the purpose of the present invention is achieved by the following technical solutions:

[0015] A network security threat perception device based on knowledge reasoning and algorithm service, the network security threat perception device comprising:

[0016] A security threat perception and assessment subsystem, which is configured to complete network security threat perception, and work with the knowledge expansion subsystem to perform suspected threat assessment and generate defense plans;

[0017] A knowledge base knowledge expansion and service subsystem, wherein the knowledge base knowledge expansion and service subsystem is configured to extract knowledge from network security threat field data for knowledge expansion and provide knowledge services for the threat perception subsystem and knowledge base users;

[0018] Intelligent algorithm model training and application subsystem, which is configured to intelligently empower the situational threat perception model uploaded by the threat perception subsystem, the knowledge reasoning model uploaded by the knowledge expansion subsystem, the semantic association model uploaded by the semantic fusion subsystem, etc. in the algorithm training subsystem, and provide network security threat perception intelligent algorithm training and application services;

[0019] A semantic knowledge fusion and application subsystem, wherein the semantic knowledge fusion and application subsystem is configured to complete dynamic expansion, visualization display and application services of the network security threat knowledge graph.

[0020] According to a preferred embodiment, the security threat perception and assessment subsystem completes security threat perception and assessment through the following steps, including:

[0021] Data generation and collection steps: The security threat perception and assessment subsystem collects network traffic and system logs from network activity data. The collected data is initially processed and cleaned to form structured data input for subsequent threat perception analysis.

[0022] Security threat perception step: The security threat perception and assessment subsystem obtains data input, verifies the recognition capability and accuracy of known attacks, as well as the recognition capability of unknown attacks, and uses the detection results as input to the knowledge expansion subsystem for threat analysis and assessment;

[0023] In the suspected threat assessment step, the security threat perception and assessment subsystem inputs the suspected threat perception result data into the knowledge expansion subsystem to verify the knowledge expansion subsystem's threat data knowledge matching capability and current event knowledge query capability. The knowledge expansion subsystem transmits the query results and the corresponding suspected threat assessment to the security threat perception and assessment subsystem;

[0024] In the step of generating a defense plan, the security threat perception and assessment subsystem inputs the threat assessment results and related assessment data into the knowledge expansion subsystem. The knowledge expansion subsystem analyzes the input data and returns a recommended defense plan, in which the content of the defense plan includes specific defense techniques and tactics.

[0025] According to a preferred embodiment, the network traffic includes traffic data of the application layer, transport layer and network layer, and the system log includes log data generated by operating systems and application programs of various network security devices deployed in the network.

[0026] According to a preferred embodiment, the knowledge base knowledge expansion and service subsystem completes knowledge production and knowledge base service through the following steps, including:

[0027] The knowledge production data input step imports structured data extracted from network activity data and third-party data, and preprocesses and cleans the input data.

[0028] The knowledge expansion step in the field of cybersecurity threats in the knowledge base is to extract knowledge ontology and knowledge relationship based on the constructed data pool and data directory, and complete the corresponding knowledge relationship between the newly entered knowledge ontology and the existing knowledge items in the library, so as to achieve integration with the existing subject knowledge in the knowledge base and complete the knowledge production process;

[0029] Knowledge base knowledge service steps include:

[0030] Suspected threat semantic matching service: performs semantic matching on suspected threats input by the threat perception subsystem, compares them with existing cases in the knowledge base, and returns similar cases and similarity values ​​to the threat perception subsystem;

[0031] Defense plan recommendation service: Generates and returns recommended defense plans based on the threat assessment results input by the threat perception subsystem;

[0032] Network security threat subject knowledge browsing and retrieval service: Knowledge base users browse network security threat subject knowledge content through the web page navigation method provided by the knowledge base, and use keywords to browse and retrieve password subject knowledge content.

[0033] According to a preferred embodiment, the structured data extracted from the network activity data includes: network traffic behavior analysis data, malware behavior data; the third-party data includes: web pages, technical documents, industry reports, and academic papers in the field of network security threats.

[0034] According to a preferred embodiment, the intelligent algorithm model training and application subsystem completes the intelligent algorithm model training and application through the following steps, including:

[0035] The attack sample uploading step includes: using the attack sample uploading interface provided by the algorithm training subsystem to upload the security threat perception data sample library collected by the threat perception subsystem and the relevant model training data in the security and confidentiality intelligent knowledge base provided by the knowledge expansion subsystem to the designated location; selecting the attack sample type to be uploaded from the attack sample creation menu in the attack sample management interface of the algorithm training subsystem, using the data adapter to load the sample data into the algorithm training subsystem, and then managing and modifying the files in the uploaded attack samples, testing the query index function of the sample data, cleaning the data samples, and realizing the data verification of the cleaning result table; selecting network security threat sample data, performing sample representation learning and intelligent labeling, obtaining sample data features, and then testing the intelligent labeling function on this basis to verify the consistency and accuracy of the sample labels;

[0036] The model design / model upload steps include: model design, in the model design interface of the algorithm training subsystem, pull the appropriate model components, fill in the relevant parameters to form a business model solution, then verify the legitimacy of the pulled business model and save it, and perform version control on the pulled business model; model upload, use the model upload interface provided by the intelligent algorithm training subsystem to upload the model code files designed by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem to the specified location, and manage the model through the intelligent algorithm training subsystem;

[0037] Model training step: In the model training interface of the algorithm training subsystem, each model is assigned to a designated node server for training;

[0038] Model evaluation step: During the execution of distributed training jobs, each execution end node performs model evaluation locally through the evaluation logic embedded in the model definition, calculates the corresponding performance indicators, and evaluates the models uploaded or constructed by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem through the algorithm training subsystem evaluation model, returns the evaluation value, collects the evaluation results returned by each execution end, and globally aggregates the local performance indicators of each node to obtain the performance indicators of the entire task;

[0039] The service deployment / model export steps include: service deployment, in the service deployment interface of the algorithm training subsystem, persisting the trained model file to the distributed storage, and after the job status changes to the completed deployable state, binding the job to realize the service deployment of the model; exporting the model, in the job management interface, using the model export interface to export the trained model as a model file for use by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem;

[0040] The model service calling steps include: the threat perception subsystem, the knowledge expansion subsystem, and the semantic fusion subsystem select the service data source for service calling through the interface provided by the algorithm training subsystem platform.

[0041] According to a preferred embodiment, the semantic knowledge fusion and application subsystem completes semantic knowledge fusion and application through the following steps, including:

[0042] Data acquisition step: The semantic fusion subsystem obtains newly added network security threat subject domain knowledge or attack samples, cases and feature knowledge through the data access interface provided by the threat perception subsystem or the knowledge expansion subsystem; obtains new external network security threat data through the data acquisition server; imports relevant data into the data processing server, extracts semantic knowledge from unstructured and semi-structured data; and maps and transforms the structure of semantic knowledge from different sources and formats to unify them into knowledge representations in the same format;

[0043] The knowledge graph construction and update step is to align and disambiguate the entities of the semantic knowledge in a unified format, construct a graph of the semantic knowledge according to the designed knowledge graph concept template, and encrypt and store it in the ciphertext storage server. The newly acquired semantic knowledge is then fused and calculated with the existing knowledge graph to complete the update and expansion of the knowledge graph.

[0044] The semantic service calling steps include: semantic knowledge retrieval, the threat perception subsystem uploads the entity and attribute parameters to be retrieved through the semantic knowledge retrieval interface provided by the semantic fusion subsystem, the semantic fusion subsystem performs matching calculations, finds the corresponding search content and returns the search results; graph linkage analysis, receives the linkage analysis request from the threat perception subsystem through the graph linkage analysis interface, the parameters include the entity name to be analyzed, relationship type, attribute and association conditions, the semantic fusion subsystem performs multi-graph linkage analysis according to the corresponding parameters, finds the relationship path of related entities between multiple graphs, and returns the path result; hierarchical navigation reasoning, the threat perception subsystem calls the hierarchical navigation reasoning interface provided by the semantic fusion subsystem to upload parameters such as the navigation reasoning starting node and reasoning rules, the semantic fusion subsystem performs reasoning calculations on the knowledge graph according to the reasoning rules, and returns the reasoning results of the calculated implicit relationship and the new attributes or attribute values ​​that the node may have to the threat perception subsystem.

[0045] According to a preferred embodiment, the semantic knowledge fusion and application subsystem is further configured to perform human-computer interaction services, including:

[0046] Semantic knowledge retrieval visualization service: Users enter the name of the graph they want to retrieve in the semantic knowledge retrieval interface, and the system displays the association relationship between each node in the knowledge graph in the form of a graph on the interface;

[0047] Graph linkage analysis visualization service: users enter entity names, relationship types, attributes, and association conditions in the graph analysis interface. After the system performs analysis, the path relationship between entities and their attributes across multiple graphs is displayed on the interface.

[0048] Navigation reasoning visualization service: Users enter the reasoning starting node and reasoning rules in the knowledge graph navigation reasoning interface. After the system executes the reasoning, it displays the reasoning results in the form of a node relationship diagram.

[0049] According to a preferred embodiment, in the semantic knowledge retrieval visualization service, the user changes the graph display style by selecting dynamic layout or tree layout, and performs screening analysis and displays the filtered graph content by entering entity name, attribute name, and graph display layer conditions.

[0050] On the other hand, the present invention also discloses:

[0051] A network security threat perception method based on knowledge reasoning and algorithm service, wherein the network security threat perception method uses a network security threat perception device to complete network security threat perception, including:

[0052] Security threat perception and assessment, relying on the attack sample library / case library / feature library of the threat perception subsystem and the knowledge base of the knowledge expansion subsystem, to achieve the perception of network security threats and the assessment of suspected threats, generate emergency plans, and realize the discovery and response to complex network security threats;

[0053] Knowledge base knowledge expansion and services: for scenarios where knowledge is produced in the field of cybersecurity threats, online expansion of knowledge in the knowledge base’s cybersecurity threats field is achieved through access to network activity data, suspected threat analysis services are provided, and intelligent cybersecurity knowledge base knowledge services are realized;

[0054] Intelligent algorithm model training and application, using attack samples and algorithm models uploaded by users as input, relying on the sample data management, intelligent scheduling of computing resources, intelligent algorithm training and application services provided by the algorithm training subsystem, to realize intelligent training and application of situation threat perception models uploaded by the threat perception subsystem, knowledge reasoning models uploaded by the knowledge expansion subsystem, and semantic association models uploaded by the semantic fusion subsystem in the algorithm training subsystem, intuitively quantify the model training effect, and realize intelligent algorithm training and application services;

[0055] Semantic knowledge fusion and application, by acquiring network security threat field knowledge from the threat perception subsystem and knowledge expansion subsystem, combined with network security threat information extracted from external network activity data, verifies the dynamic expansion and update capabilities of the knowledge graph; relying on the constructed network security threat knowledge graph, realizes the retrieval, linkage analysis, navigation reasoning and visualization of network security threat knowledge; provides knowledge graph retrieval and correlation analysis services to the threat perception subsystem, and verifies the fusion analysis and application services of network security threat semantic knowledge.

[0056] The aforementioned main scheme of the present invention and its further options can be freely combined to form multiple schemes, all of which are schemes that can be adopted and claimed for protection by the present invention. After understanding the scheme of the present invention, those skilled in the art can understand that there are multiple combinations based on the prior art and common knowledge, all of which are technical schemes to be protected by the present invention, and they are not exhaustively listed here.

[0057] Beneficial effects of the present invention:

[0058] (1) Comprehensive threat perception and assessment capabilities

[0059] The present invention realizes the comprehensive perception and analysis of complex network security threats through the joint operation of the threat perception subsystem and the knowledge expansion subsystem. The threat perception subsystem can effectively collect and process network activity data, including known and unknown network threats, to ensure the accuracy of identifying various complex network attacks. At the same time, the knowledge expansion subsystem provides accurate threat analysis results by matching and analyzing the input threat data, which helps to timely discover potential threats and take corresponding defense measures.

[0060] (2) Dynamic knowledge expansion and intelligent service capabilities

[0061] The knowledge base knowledge expansion and service subsystem can dynamically expand the knowledge base in the field of network security threats to ensure that the knowledge base always covers the latest threat information. By accessing real-time network activity data, the knowledge expansion subsystem can automatically generate and update relevant knowledge to improve the timeliness and accuracy of the knowledge base. In addition, the knowledge expansion subsystem also provides intelligent threat analysis and defense plan recommendation services to provide users with accurate knowledge support and security strategy recommendations.

[0062] (3) Efficient intelligent algorithm training and application capabilities

[0063] The intelligent algorithm model training and application subsystem provides comprehensive algorithm training and model management functions. Users can upload various attack samples and algorithm models. The algorithm training subsystem optimizes and verifies model performance through intelligent training and evaluation processes. The algorithm training subsystem supports dynamic scheduling and distributed training of models to ensure the efficiency and accuracy of model training. At the same time, the algorithm training subsystem provides an intuitive display of model evaluation results to help users quickly understand and optimize model performance.

[0064] (4) Knowledge graph construction and application capabilities

[0065] The semantic knowledge fusion and application subsystem realizes the semantic management and application of knowledge by constructing and updating the network security threat knowledge graph. The semantic fusion subsystem can extract semantic knowledge from multi-source data, uniformly represent and store it in the ciphertext storage server to ensure data security and consistency. The knowledge graph not only supports the retrieval and linkage analysis of network security threat knowledge, but also provides hierarchical navigation and reasoning functions to help users deeply understand and respond to complex security threats.

[0066] (5) Powerful data processing and integration capabilities

[0067] The entire solution has powerful data processing and integration capabilities, and can obtain and process data from multiple sources, including network traffic, system logs, public documents, etc. Through data preprocessing and cleaning, the accuracy and consistency of the data are ensured, providing reliable data support for subsequent threat perception, knowledge expansion, and algorithm training. In addition, it also has flexible interfaces and service call functions, supporting data sharing and collaborative work between subsystems, and improving the comprehensive protection capabilities of the overall solution.

[0068] (6) Friendly human-computer interaction interface

[0069] The solution has designed a variety of human-computer interaction services, including semantic knowledge retrieval, graph linkage analysis, and navigation reasoning. Users can easily perform knowledge retrieval and threat analysis operations through an intuitive visual interface. By providing a variety of display methods and interactive functions, users can choose different views and layouts as needed, flexibly adjust the display content, and improve the user's operating experience and work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 It is a schematic diagram of the composition of the network security threat perception device of the present invention;

[0071] Figure 2 This is a schematic diagram of the work flow of the security threat perception and assessment subsystem;

[0072] Figure 3 It is a schematic diagram of the workflow of the knowledge base knowledge expansion and service subsystem;

[0073] Figure 4 It is a schematic diagram of the workflow of the intelligent algorithm model training and application subsystem;

[0074] Figure 5 It is a schematic diagram of the workflow of the semantic knowledge fusion and application subsystem. DETAILED DESCRIPTION

[0075] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0076] refer to Figure 1As shown, the present invention discloses a network security threat perception device based on knowledge reasoning and algorithm service, wherein the network security threat perception device includes a security threat perception and analysis subsystem, a knowledge base knowledge expansion and service subsystem, an intelligent algorithm model training and application subsystem, and a semantic knowledge fusion and application subsystem.

[0077] (1) Security Threat Perception and Assessment Subsystem

[0078] The threat perception subsystem mainly undertakes the functions of network security threat perception, and works with the knowledge expansion subsystem to realize suspected threat analysis and generate defense plans, and has the ability to discover and respond to complex network security threats. The specific working methods and processes include four steps: data generation and collection, security threat perception, suspected threat analysis, and generation of defense plans. Figure 2 shown.

[0079] Data generation and collection: The data collection equipment of the threat perception subsystem collects network traffic and system logs from network activity data. Network traffic includes traffic data at the application layer, transport layer, and network layer. System logs include log data generated by the operating systems and application programs of various network security devices deployed in the network. The collected data is initially processed and cleaned to form structured data input for subsequent threat perception analysis.

[0080] Security threat perception: The threat perception subsystem obtains data input to verify the recognition capability and accuracy of known attacks, as well as the recognition capability of unknown attacks. The detection results of the threat perception subsystem are used as input to the knowledge expansion subsystem for further threat analysis and assessment.

[0081] Suspected threat analysis: The threat perception subsystem inputs the suspected threat perception result data into the knowledge expansion subsystem to verify the knowledge expansion subsystem's threat data knowledge matching capability and current event knowledge query capability. The knowledge expansion subsystem transmits the query results and the corresponding suspected threat analysis to the threat perception subsystem.

[0082] Generate defense plan: The threat perception subsystem inputs the threat assessment results and related assessment data into the knowledge expansion subsystem. The knowledge expansion subsystem analyzes the input data and returns a recommended defense plan. The defense plan includes specific defense techniques and tactics for reference and implementation by the threat perception subsystem.

[0083] The main functions of the threat perception subsystem include:

[0084] ① Collect known and unknown complex network security threat data, where known complex attack samples are attack samples used for model construction, and unknown complex attack samples are attack samples not used for model construction.

[0085] ② After inputting the operating traffic and logs of network security threats, it is possible to accurately perceive complex network security threats with known and unknown prior features, and after processing, it can form threat result data.

[0086] ③ After the threat perception subsystem transmits the suspected threat result data to the knowledge expansion subsystem, the knowledge expansion subsystem can support the threat perception subsystem to perform matching and correlation analysis on the perceived threat events and generate threat assessment results.

[0087] ④ After the threat perception subsystem transmits the threat result data to the knowledge expansion subsystem, the knowledge expansion subsystem can return the recommended defense plan.

[0088] (2) Knowledge base knowledge expansion and service subsystem

[0089] The knowledge expansion subsystem mainly undertakes the functions of extracting knowledge from the cybersecurity threat field data to expand the knowledge base, and providing knowledge services for the threat perception subsystem and knowledge base users, and providing knowledge production and knowledge base service capabilities. The specific working methods and processes include three steps: knowledge production data input, knowledge expansion in the cybersecurity threat field of the knowledge base, and knowledge base knowledge services. Figure 3 shown.

[0090] Knowledge production data input: Data sources include structured data extracted from network activity data (such as network traffic behavior analysis data, malware behavior data, etc.) and third-party data sources (such as web pages, technical documents, industry reports, academic papers, etc. in the field of network security threats from public sources). All data are pre-processed and cleaned to ensure data accuracy and consistency.

[0091] Knowledge expansion in the cybersecurity threat domain of the knowledge base: After the underlying data in the cybersecurity threat domain is imported, it is parsed, cleaned, and regularized for persistent storage. Based on the constructed data pool and data directory, after knowledge ontology extraction and knowledge relationship extraction, the corresponding knowledge relationship between the newly entered knowledge ontology and the existing knowledge items in the library is supplemented, thereby integrating with the existing subject knowledge in the knowledge base to complete the knowledge production process.

[0092] Knowledge base knowledge services: ① Suspected threat semantic matching service: semantic matching of suspected threats input by the threat perception subsystem, comparison with existing cases in the knowledge base, and return of similar cases and similar values ​​to the threat perception subsystem. ② Defense plan recommendation service: based on the determined threat assessment results input by the threat perception subsystem, generate and return recommended defense plans, including specific defense techniques and tactics. ③ Network security threat subject knowledge browsing and retrieval service: users can access the knowledge base portal page, access the network security threat subject knowledge homepage through the navigation link, and further browse on demand. Enter the search content in the search bar of the network attack subject knowledge page to view the returned related pages.

[0093] The main functions implemented by the knowledge expansion subsystem include:

[0094] ① Knowledge base expansion: Select technical documents in the field of cybersecurity threats in the data pool from the console to observe the automatic creation of knowledge production process. View the ontology properties of each newly added knowledge entry and the newly created relationship connections with other adjacent knowledge entries through the console.

[0095] ② Knowledge base service: For suspected threats input by the threat perception subsystem, the knowledge expansion subsystem can return the similarity value and description of the inventory threat case that are closest to the suspected threat; for confirmed threats input by the threat perception subsystem, the knowledge expansion subsystem can return a defense plan consisting of targeted defense techniques and tactics that should be taken; knowledge base users can browse the knowledge content on the network security threat theme through the web page navigation method provided by the knowledge base, and use keywords to browse and retrieve the knowledge content on the password theme.

[0096] (3) Intelligent algorithm model training and application subsystem

[0097] The algorithm training subsystem mainly undertakes functions including algorithm design, algorithm training and algorithm testing. From the three aspects of network security threat sample resource management, intelligent algorithm service and network security threat perception algorithm training, it realizes the intelligent empowerment of the situation threat perception model uploaded by the threat perception subsystem, the knowledge reasoning model uploaded by the knowledge expansion subsystem, and the semantic association model uploaded by the semantic fusion subsystem in the algorithm training subsystem, providing the ability of network security threat perception intelligent algorithm training and application services. The specific working methods and processes include six steps: attack sample upload, model design / model upload, model training, model evaluation, service deployment / model export, and model service call, as shown in the attached figure. Figure 4 shown.

[0098] Upload attack samples: ① Use the attack sample upload interface provided by the algorithm training subsystem to upload the security threat perception data sample library collected by the threat perception subsystem and the relevant model training data in the security and confidentiality intelligent knowledge base provided by the knowledge expansion subsystem to the specified location. The upload process includes selecting the type of attack sample to be uploaded, loading the sample data using the data adapter, and managing and cleaning the sample data. Ensure that the uploaded data samples have been format checked and security scanned, and divided into training sets and test sets to ensure the generalization ability and evaluation effect of the model. In order to ensure the generalization ability and evaluation effect of the model, the attack samples uploaded by the threat perception subsystem and the knowledge expansion subsystem are divided into training sets and test sets. The training set is used for model training and optimization, and the test set is used for model evaluation and verification. According to business needs, select the appropriate attack sample division ratio. ② In the attack sample management interface of the algorithm training subsystem, select the attack sample type you want to upload from the attack sample creation menu, and use the data adapter to load the sample data into the algorithm training subsystem. Then you can manage and modify the files in the uploaded attack samples, test the query index function of the sample data, clean the data samples, and verify the data in the cleaning result table. Select network security threat sample data, perform sample representation learning and intelligent labeling, obtain sample data features, and then test the intelligent labeling function on this basis to verify the consistency and accuracy of the sample labels.

[0099] Model design / model upload: ① Model design: In the model design interface of the algorithm training subsystem, pull appropriate data preprocessing, feature conversion, feature selection, classification, regression, clustering, deep learning, reinforcement learning and other model components, fill in the relevant parameters to form a business model solution, then verify the legitimacy of the pulled business model and save it, and perform version control on the pulled business model. ② Model upload: Use the model upload interface provided by the algorithm training subsystem to upload the model code files designed by the threat perception subsystem (such as the malicious sample feature expansion model based on Markov transform), the knowledge expansion subsystem (such as the threat perception model based on knowledge reasoning), and the semantic fusion subsystem (such as the network attack pattern recognition model based on dense convolutional network) to the specified location. The uploaded model is managed through the model management function provided by the algorithm training subsystem, including version control and legitimacy verification.

[0100] Model training: In the model training interface of the algorithm training subsystem, assign the model to the specified node server for training. The training platform automatically allocates resources and schedules tasks according to the model scale to ensure the efficiency and stability of training. Select the model to be trained in the job training interface, set the corresponding training parameters, and click the Start Training button. The algorithm training subsystem will monitor the training rounds and progress after the training starts to ensure the smooth progress of the training process.

[0101] Model evaluation: During the execution of distributed training jobs, by embedding evaluation logic in the model definition, each execution end node performs model evaluation locally and calculates the corresponding performance indicators. The threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem uploaded or constructed models (such as network security threat identification business models) are evaluated through the algorithm training subsystem evaluation model, and evaluation values ​​including accuracy and recall are returned. The evaluation results returned by each execution end are collected, and the local performance indicators of each node are globally aggregated to obtain the performance indicators of the entire task.

[0102] Service deployment / export model: ① Service deployment: In the service deployment interface of the algorithm training subsystem, persist the trained model file to the distributed storage. After the job status changes to the completed deployable state, bind the job to realize the service deployment of the model. ② Export model: In the job management interface, use the model export interface to export the trained model as a model file for use by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem.

[0103] Model service call: ① The threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem select the service data source through the interface provided by the algorithm training subsystem platform to make service calls. ② Through the visual service call user interface provided by the platform, convenient manual testing and access to service instances are performed. ③ By dynamically selecting service data, the corresponding business model call parsing and results are obtained for business input. ④ For the models uploaded by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem, the algorithm training subsystem performs embedding operations, binds the visualization page to the trained job model, and realizes service release. ⑤ Through the new service binding job interface, a simple service call is made in the service management interface, and the uploaded data or newly uploaded data is selected to make service calls to the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem, and the model usage results are returned to the user through the model response interface.

[0104] The main functions implemented by the algorithm training subsystem include:

[0105] ① Attack sample upload: Output the format check and security scan results of the uploaded attack samples, manage the data samples, and store them securely in the specified location.

[0106] ②Model design / model upload: Output the machine learning or deep learning model designed on this platform; output the legitimacy verification results of the user-uploaded model, and implement version control of the user-uploaded model.

[0107] ③Model training: The platform automatically allocates resources and performs task scheduling according to the model scale, automatically assigns the model to the corresponding node server for training, and outputs the model after parameter training.

[0108] ④ Model evaluation: Evaluate the performance of the model, such as the accuracy and recall rate of network security threat perception, and collect the evaluation results returned by each execution end, globally aggregate the local performance indicators of each node, and give the performance indicators of the entire task.

[0109] ⑤ Service deployment / export model: Distribute and store the trained model files, and support users to export model files; associate the model files with the corresponding network security threat perception services to form an executable model service.

[0110] ⑥Model service call: call the model for reasoning and return the calculation results.

[0111] (4) Semantic knowledge fusion and application subsystem

[0112] The semantic fusion subsystem mainly undertakes functions including dynamic expansion of network security threat knowledge graph, visualization display and application services. Among them, application services mainly include two service modes: interface call and human-computer interaction. These two modes verify application service capabilities such as semantic knowledge retrieval, graph linkage analysis and hierarchical navigation reasoning. The specific working methods and processes include four steps: data acquisition, knowledge graph construction and update, semantic service call, and human-computer interaction service. Figure 5 shown.

[0113] Data acquisition: The semantic fusion subsystem obtains new cybersecurity threat subject domain knowledge or attack samples, cases, and feature knowledge through the data access interface provided by the threat perception subsystem or the knowledge expansion subsystem. New external cybersecurity threat data is obtained through the data acquisition server. The relevant data is imported into the data processing server to extract semantic knowledge from unstructured and semi-structured data. Semantic knowledge from different sources and formats is mapped and converted into a unified knowledge representation in the same format.

[0114] Knowledge graph construction and update: Entity alignment and disambiguation processing are performed on the semantic knowledge in a unified format. The semantic knowledge graph is constructed according to the designed knowledge graph concept template and encrypted and stored in the ciphertext storage server. The newly acquired semantic knowledge is then fused with the existing knowledge graph to complete the update and expansion of the knowledge graph.

[0115] Semantic service call: ① Semantic knowledge retrieval: The threat perception subsystem uploads the parameters such as entities and attributes to be retrieved through the semantic knowledge retrieval interface provided by the semantic fusion subsystem. The semantic fusion subsystem performs matching calculations, finds the corresponding search content and returns the search results. ② Graph linkage analysis: The linkage analysis request from the threat perception subsystem is received through the graph linkage analysis interface. The parameters include the entity name to be analyzed, the relationship type, the attribute and the association condition. The semantic fusion subsystem performs multi-graph linkage analysis based on these parameters, finds the relationship path between related entities in multiple graphs, and returns the path results. ③ Hierarchical navigation reasoning: The threat perception subsystem calls the hierarchical navigation reasoning interface provided by the semantic fusion subsystem to upload parameters such as the navigation reasoning starting node and reasoning rules. The semantic fusion subsystem performs reasoning calculations on the knowledge graph according to the reasoning rules, and returns the reasoning results such as the calculated implicit relationship and the new attributes or attribute values ​​that the node may have to the threat perception subsystem.

[0116] Human-computer interaction service: ① Visualization of semantic knowledge retrieval: Users enter the name of the graph they want to retrieve in the semantic knowledge retrieval interface, and the system displays the association relationship of each node in the knowledge graph in the form of a graph on the interface. Users can change the graph display style by selecting dynamic layout, tree layout, etc. By entering conditions such as entity name, attribute name, and number of graph display layers, screening analysis is performed and the filtered graph content is displayed. ② Visualization of graph linkage analysis: Users enter entity name, relationship type, attribute, and association conditions in the graph analysis interface. After the system performs analysis, the path relationship between entities and their attributes between multiple graphs is displayed on the interface. ③ Visualization of navigation reasoning: Users enter the reasoning starting node and reasoning rule in the knowledge graph navigation reasoning interface. After the system performs reasoning, the reasoning result is displayed in the form of a node relationship diagram. Users can click other nodes on the graph to display more reasoning content.

[0117] The main functions implemented by the semantic fusion subsystem include:

[0118] ① Data acquisition: Collect data from different sources and structures, and after processing, successfully obtain semantic knowledge expressed in the same format.

[0119] ② Knowledge graph construction and update: Complete the construction of the knowledge graph and store it in a encrypted form on the encrypted storage server, and successfully use the newly acquired semantic knowledge to expand and update the existing knowledge graph.

[0120] ③Semantic service call: successfully receive the semantic retrieval request input by the threat perception subsystem and return the retrieval result; successfully receive the entity knowledge to be analyzed, relationship type, attributes and association conditions and other parameters input by the threat perception subsystem, and return the relationship path of related entities between multiple graphs; successfully receive the inference starting node and inference rules and other parameters from the threat perception subsystem, and return the result after inference calculation.

[0121] ④ Human-computer interaction service: successfully receive the input search content in the semantic retrieval interface and display the search results in multiple ways; successfully receive the input entities, relationships, attributes, and association conditions in the graph linkage analysis interface, and successfully display the path relationship between the subject to be analyzed in multiple graphs; successfully receive the input content such as the reasoning starting node and reasoning rules in the knowledge graph navigation reasoning interface, and display the reasoning results in an expandable node relationship diagram.

[0122] The present invention also discloses a network security threat perception method based on knowledge reasoning and algorithm service. The network security threat perception method comprises:

[0123] (1) Security threat perception and assessment

[0124] Relying on the attack sample library / case library / feature library of the threat perception subsystem and the knowledge base of the knowledge expansion subsystem, we can perceive complex network security threats and analyze suspected threats, generate emergency plans, and realize the discovery and response functions of complex network security threats.

[0125] (2) Knowledge base knowledge expansion and services

[0126] For the scenario of knowledge production in the field of network security threats, the online expansion of the knowledge base in the field of network security threats is achieved by accessing network activity data, and suspected threat analysis services can be provided to realize the knowledge service function of the intelligent network security knowledge base.

[0127] (3) Intelligent algorithm model training and application

[0128] Taking the attack samples and algorithm models uploaded by users as input, relying on the sample data management, intelligent scheduling of computing resources, intelligent algorithm training and application service functions provided by the algorithm training subsystem, the situation threat perception model uploaded by the threat perception subsystem, the knowledge reasoning model uploaded by the knowledge expansion subsystem, the semantic association model uploaded by the semantic fusion subsystem, etc. are intelligently trained and applied in the algorithm training subsystem, the model training effect is intuitively quantified, and the intelligent algorithm training and application service functions are realized.

[0129] (4) Semantic knowledge fusion and application

[0130] By acquiring the cybersecurity threat domain knowledge of the threat perception subsystem and the knowledge expansion subsystem, combined with the cybersecurity threat information extracted from the external network activity data, the dynamic expansion and update capabilities of the knowledge graph are verified. Relying on the constructed cybersecurity threat knowledge graph, the retrieval, linkage analysis, navigation reasoning and visualization of cybersecurity threat knowledge are realized. The threat perception subsystem is provided with knowledge graph retrieval and correlation analysis services to verify the fusion analysis and application service capabilities of cybersecurity threat semantic knowledge.

[0131] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security threat perception device based on knowledge reasoning and algorithm services, characterized in that: The network security threat perception device comprises: A security threat perception and assessment subsystem, which is configured to complete network security threat perception, and work with the knowledge expansion subsystem to perform suspected threat assessment and generate defense plans; A knowledge base knowledge expansion and service subsystem, wherein the knowledge base knowledge expansion and service subsystem is configured to extract knowledge from network security threat field data for knowledge expansion and provide knowledge services for the threat perception subsystem and knowledge base users; Intelligent algorithm model training and application subsystem, which is configured to intelligently empower the situational threat perception model uploaded by the threat perception subsystem, the knowledge reasoning model uploaded by the knowledge expansion subsystem, and the semantic association model uploaded by the semantic fusion subsystem in the algorithm training subsystem, and provide network security threat perception intelligent algorithm training and application services; A semantic knowledge fusion and application subsystem, wherein the semantic knowledge fusion and application subsystem is configured to complete dynamic expansion, visualization display and application services of the network security threat knowledge graph.

2. The network security threat perception device according to claim 1, characterized in that: The security threat perception and assessment subsystem completes security threat perception and assessment through the following steps, including: Data generation and collection steps: The security threat perception and assessment subsystem collects network traffic and system logs from network activity data. The collected data is initially processed and cleaned to form structured data input for subsequent threat perception analysis. Security threat perception step: The security threat perception and assessment subsystem obtains data input, verifies the recognition capability and accuracy of known attacks, as well as the recognition capability of unknown attacks, and uses the detection results as input to the knowledge expansion subsystem for threat analysis and assessment; In the suspected threat assessment step, the security threat perception and assessment subsystem inputs the suspected threat perception result data into the knowledge expansion subsystem to verify the knowledge expansion subsystem's threat data knowledge matching capability and current event knowledge query capability. The knowledge expansion subsystem transmits the query results and the corresponding suspected threat assessment to the security threat perception and assessment subsystem; In the step of generating a defense plan, the security threat perception and assessment subsystem inputs the threat assessment results and related assessment data into the knowledge expansion subsystem. The knowledge expansion subsystem analyzes the input data and returns a recommended defense plan, in which the content of the defense plan includes specific defense techniques and tactics.

3. The network security threat perception device according to claim 2, characterized in that: The network traffic includes traffic data of the application layer, transport layer and network layer, and the system log includes log data generated by operating systems and application programs of various network security devices deployed in the network.

4. The network security threat perception device according to claim 1, characterized in that: The knowledge base knowledge expansion and service subsystem completes knowledge production and knowledge base services through the following steps, including: The knowledge production data input step imports structured data extracted from network activity data and third-party data, and preprocesses and cleans the input data. The knowledge expansion step in the field of cybersecurity threats in the knowledge base is to extract knowledge ontology and knowledge relationship based on the constructed data pool and data directory, and complete the corresponding knowledge relationship between the newly entered knowledge ontology and the existing knowledge items in the library, so as to achieve integration with the existing subject knowledge in the knowledge base and complete the knowledge production process; Knowledge base knowledge service steps include: Suspected threat semantic matching service: performs semantic matching on suspected threats input by the threat perception subsystem, compares them with existing cases in the knowledge base, and returns similar cases and similarity values ​​to the threat perception subsystem; Defense plan recommendation service: Generates and returns recommended defense plans based on the threat assessment results input by the threat perception subsystem; Network security threat subject knowledge browsing and retrieval service: Knowledge base users browse network security threat subject knowledge content through the web page navigation method provided by the knowledge base, and use keywords to browse and retrieve password subject knowledge content.

5. The network security threat perception device according to claim 4, characterized in that: The structured data extracted from network activity data includes: network traffic behavior analysis data, malware behavior data; third-party data includes: web pages, technical documents, industry reports, and academic papers in the field of network security threats.

6. The network security threat perception device according to claim 1, characterized in that: The intelligent algorithm model training and application subsystem completes the intelligent algorithm model training and application through the following steps, including: The attack sample uploading step includes: using the attack sample uploading interface provided by the algorithm training subsystem to upload the security threat perception data sample library collected by the threat perception subsystem and the relevant model training data in the security and confidentiality intelligent knowledge base provided by the knowledge expansion subsystem to the designated location; selecting the attack sample type to be uploaded from the attack sample creation menu in the attack sample management interface of the algorithm training subsystem, using the data adapter to load the sample data into the algorithm training subsystem, and then managing and modifying the files in the uploaded attack samples, testing the query index function of the sample data, cleaning the data samples, and realizing the data verification of the cleaning result table; selecting network security threat sample data, performing sample representation learning and intelligent labeling, obtaining sample data features, and then testing the intelligent labeling function on this basis to verify the consistency and accuracy of the sample labels; The model design / model upload steps include: model design, in the model design interface of the algorithm training subsystem, pull the appropriate model components, fill in the relevant parameters to form a business model solution, then verify the legitimacy of the pulled business model and save it, and perform version control on the pulled business model; model upload, use the model upload interface provided by the intelligent algorithm training subsystem to upload the model code files designed by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem to the specified location, and manage the model through the intelligent algorithm training subsystem; Model training step: In the model training interface of the algorithm training subsystem, each model is assigned to a designated node server for training; Model evaluation step: During the execution of distributed training jobs, each execution end node performs model evaluation locally through the evaluation logic embedded in the model definition, calculates the corresponding performance indicators, and evaluates the models uploaded or constructed by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem through the algorithm training subsystem evaluation model, returns the evaluation value, collects the evaluation results returned by each execution end, and globally aggregates the local performance indicators of each node to obtain the performance indicators of the entire task; The service deployment / model export steps include: service deployment, in the service deployment interface of the algorithm training subsystem, persisting the trained model file to the distributed storage, and after the job status changes to the completed deployable state, binding the job to realize the service deployment of the model; exporting the model, in the job management interface, using the model export interface to export the trained model as a model file for use by the threat perception subsystem, knowledge expansion subsystem, and semantic fusion subsystem; The model service calling steps include: the threat perception subsystem, the knowledge expansion subsystem, and the semantic fusion subsystem select the service data source for service calling through the interface provided by the algorithm training subsystem platform.

7. The network security threat perception device according to claim 1, characterized in that: The semantic knowledge fusion and application subsystem completes semantic knowledge fusion and application through the following steps, including: Data acquisition step: The semantic fusion subsystem obtains newly added network security threat subject domain knowledge or attack samples, cases and feature knowledge through the data access interface provided by the threat perception subsystem or the knowledge expansion subsystem; obtains new external network security threat data through the data acquisition server; imports relevant data into the data processing server, extracts semantic knowledge from unstructured and semi-structured data; and maps and transforms the structure of semantic knowledge from different sources and formats to unify them into knowledge representations in the same format; The knowledge graph construction and update step is to align and disambiguate the entities of the semantic knowledge in a unified format, construct a graph of the semantic knowledge according to the designed knowledge graph concept template, and encrypt and store it in the ciphertext storage server. The newly acquired semantic knowledge is then fused and calculated with the existing knowledge graph to complete the update and expansion of the knowledge graph. The steps of calling semantic services include: semantic knowledge retrieval, the threat perception subsystem uploads the entities and attribute parameters to be retrieved through the semantic knowledge retrieval interface provided by the semantic fusion subsystem, the semantic fusion subsystem performs matching calculations, finds the corresponding search content and returns the search results; graph linkage analysis, receives the linkage analysis request from the threat perception subsystem through the graph linkage analysis interface, the parameters include the entity name to be analyzed, the relationship type, the attribute and the association condition, the semantic fusion subsystem performs multi-graph linkage analysis according to the corresponding parameters, finds the relationship path of related entities between multiple graphs, and returns the path result; hierarchical navigation reasoning, the threat perception subsystem calls the hierarchical navigation reasoning interface provided by the semantic fusion subsystem to upload the navigation reasoning starting node and reasoning rule parameters, the semantic fusion subsystem performs reasoning calculations on the knowledge graph according to the reasoning rules, and returns the reasoning results of the calculated implicit relationship and the new attributes or attribute values ​​that the node may have to the threat perception subsystem.

8. The network security threat perception device according to claim 7, characterized in that: The semantic knowledge fusion and application subsystem is also configured to provide human-computer interaction services, including: Semantic knowledge retrieval visualization service: Users enter the name of the graph they want to retrieve in the semantic knowledge retrieval interface, and the system displays the association relationship between each node in the knowledge graph in the form of a graph on the interface; Graph linkage analysis visualization service: users enter entity names, relationship types, attributes, and association conditions in the graph analysis interface. After the system performs analysis, the path relationship between entities and their attributes across multiple graphs is displayed on the interface. Navigation reasoning visualization service: Users enter the reasoning starting node and reasoning rules in the knowledge graph navigation reasoning interface. After the system executes the reasoning, it displays the reasoning results in the form of a node relationship diagram.

9. The network security threat perception device according to claim 8, characterized in that: In the semantic knowledge retrieval visualization service, the user can change the graph display style by selecting dynamic layout or tree layout, and can perform screening analysis and display the filtered graph content by entering entity name, attribute name, and graph display layer number conditions.

10. A network security threat perception method based on knowledge reasoning and algorithm service, characterized in that: The network security threat perception method is to use the network security threat perception device according to any one of claims 1 to 9 to complete network security threat perception, including: Security threat perception and assessment, relying on the attack sample library / case library / feature library of the threat perception subsystem and the knowledge base of the knowledge expansion subsystem, to achieve the perception of network security threats and the assessment of suspected threats, generate emergency plans, and realize the discovery and response to complex network security threats; Knowledge base knowledge expansion and services: for scenarios where knowledge is produced in the field of cybersecurity threats, online expansion of knowledge in the knowledge base’s cybersecurity threats field is achieved through access to network activity data, suspected threat analysis services are provided, and intelligent cybersecurity knowledge base knowledge services are realized; Intelligent algorithm model training and application, using attack samples and algorithm models uploaded by users as input, relying on the sample data management, intelligent scheduling of computing resources, intelligent algorithm training and application services provided by the algorithm training subsystem, to realize intelligent training and application of the situation threat perception model uploaded by the threat perception subsystem, the knowledge reasoning model uploaded by the knowledge expansion subsystem, and the semantic association model uploaded by the semantic fusion subsystem in the algorithm training subsystem, intuitively quantify the model training effect, and realize intelligent algorithm training and application services; Semantic knowledge fusion and application, by acquiring network security threat field knowledge from the threat perception subsystem and knowledge expansion subsystem, combined with network security threat information extracted from external network activity data, verifies the dynamic expansion and update capabilities of the knowledge graph; relying on the constructed network security threat knowledge graph, realizes the retrieval, linkage analysis, navigation reasoning and visualization of network security threat knowledge; provides knowledge graph retrieval and correlation analysis services to the threat perception subsystem, and verifies the fusion analysis and application services of network security threat semantic knowledge.

Images