Network security situation early warning method and system based on knowledge graph

Abstract

The invention discloses a network security situation early warning method and system based on a knowledge graph, and relates to the technical field of network security, the method establishes a normal behavior reference model of a network node through the combination of the knowledge graph and a deep learning algorithm, and enhances the accurate identification and real-time early warning capability of abnormal behaviors. Through an unsupervised learning algorithm, historical data of each node is learned and modeled, and a normal behavior reference value is formed. In the real-time monitoring process, deviation calculation is carried out on the current access behavior of each node and the reference value of the current access behavior, a deviation degree value is obtained and compared with a set deviation threshold value, and abnormal nodes deviating from normal behaviors are identified and marked. The deviation degree model combines key factors such as a transmission protocol and data transmission duration, and can sensitively detect tiny deviation of the node in communication frequency or authority, so as to quickly adapt to a dynamic network environment.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to a network security situation early warning method and system based on knowledge graph. Background Art

[0002] As the internal network system and data flow of enterprises become more complex, traditional network security monitoring methods are difficult to fully analyze the multi-dimensional information in the enterprise network, especially when involving a large number of devices, application systems, permission management and data transmission. Knowledge graph technology can use structured data and relationships to build a correlation graph of each entity in the network system, providing enterprises with a more comprehensive and intuitive network risk analysis method, thereby achieving effective security situation monitoring and early warning.

[0003] In a large enterprise with multiple business departments, there are many complex interconnected structures between network nodes of different departments, such as shared databases, service ports, and file transfer protocols. These nodes have specific access rights and normal communication modes. However, with the expansion of business and the complexity of user behavior, it is inevitable that permission violations, abnormal communications, and potential internal threats increase the security risks of the network. At this stage, the current defects are mainly due to the complexity of the enterprise network environment and the widespread existence of system islands. Security data usually comes from different systems, such as permission management, log management, network traffic monitoring and other systems. It is difficult for traditional security monitoring systems to integrate these sources, resulting in information isolation and fragmentation. When a security incident occurs, traditional systems that lack a global perspective often cannot discover abnormal propagation paths in real time, resulting in the failure to block threats in time. In addition, with the evolution of network attack technology, many potential threat behaviors are hidden and persistent. If a normal behavior model based on historical data cannot be built, the risks brought by persistent abnormal behaviors are easily ignored. Ultimately, this situation may lead to the spread of serious security incidents and even cause the leakage of important data within the enterprise, increasing the cost and difficulty of security protection. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a network security situation early warning method and system based on knowledge graph, which solves the problems mentioned in the background technology.

[0005] To achieve the above objectives, the present invention is implemented by the following technical scheme: comprising the following steps: S1. Collect enterprise network environment data from enterprise-related systems in real time through network detection tools, and perform data cleaning and normalization on the collected enterprise network environment data to obtain data sets of the same magnitude; S2. Construct a knowledge graph construction formula to define the knowledge graph structure, wherein the knowledge graph structure includes node types, edge types, and weight attributes; at the same time, the communication relationship weights and data transmission weights between nodes are calculated through the knowledge graph construction formula, and then a graph database is constructed, and the data sets of the same magnitude are imported into the graph database to generate a complete enterprise network environment knowledge graph; S3, deep learning the enterprise network environment knowledge graph, constructing a normal behavior algorithm model in the enterprise network, calculating the normal behavior benchmark value of each node, and then calculating the deviation between the normal behavior benchmark value and the behavior data of each node to obtain the deviation value, and setting the deviation threshold and the deviation value for difference evaluation; S4. When the difference evaluates abnormal behavior, the risk propagation path score is analyzed based on the reasoning ability of the knowledge graph, and then the comprehensive risk score of each node is calculated and output in combination with the deviation value; S5. Set a first risk threshold and a second risk threshold to perform risk assessment with the comprehensive risk score, and divide the nodes into three warning levels according to the risk assessment results, and generate processing measures based on the three warning levels.

[0006] Preferably, said S1 includes S11 and S12; S11, using an API application program interface to integrate with the enterprise-related system, and collecting enterprise network environment data in real time through the network detection tool; The enterprise-related systems include data classification system, database management system, authority management system, security log and network monitoring system; The enterprise network environment data includes communication frequency, sensitivity score, permission level, historical anomaly coefficient, access data volume, transmission protocol type and data transmission duration; S12, after the collection is completed, the enterprise network environment data is cleaned and standardized; The data cleaning includes deduplication processing, outlier processing and missing value filling; The standardization process is performed by scaling the enterprise network environment data to a range of 0-1 using Min-Max; Use label coding to uniformly represent discrete data in enterprise network environment data using numerical values; The discrete data includes permission level, sensitivity score and transmission protocol type.

[0007] Preferably, S2 includes S21 and S22; S21. Using the knowledge graph construction formula, define the knowledge graph structure, where the knowledge graph structure includes node types, edge types, and edge relationship weights; The node types include all network device nodes and user nodes in the enterprise network environment; The network device node includes each device node storing device ID, device type and IP address information; The user node includes storing user ID, role and authority level; The edge type E includes a communication relationship edge and a data transmission relationship edge; The communication relationship edge includes communication frequency, sensitivity score and authority level; The data transmission relationship edge includes the transmission protocol type and the data transmission duration; The edge relationship weights and assigns weight values ​​to edge attributes.

[0008] Preferably, S22, using a graph database to store and manage node relationships, edge relationships and weight data, setting the memory cache and index of the graph database to optimize query efficiency according to the scale and number of enterprise networks, and setting access rights for different users; Use the graph database batch import tool Neo4j to import the defined knowledge graph structure into the graph database; Then use the Cypher query language to batch create nodes and edges, add attributes to each node and edge, and set a unique identifier for each node, along with the defined knowledge graph structure; Then, based on the knowledge graph construction formula, the communication relationship edge weight and data transmission relationship edge weight are calculated respectively to measure the risks of different relationships between nodes; The calculation results of the communication relationship edge weights and data transmission relationship edge weights are assigned to the edges in the graph to indicate the risk levels of the communication relationships and data transmission paths, thus generating a complete enterprise network environment knowledge graph.

[0009] Preferably, said S3 includes S31, S32 and S33; S31. Using an unsupervised learning algorithm in deep learning, deeply learn the historical communication frequency, sensitivity score, authority level, and historical anomaly coefficient of each node in the enterprise network environment knowledge graph to construct the normal behavior algorithm model; Then, the real-time communication frequency, sensitivity score, authority level and historical abnormality coefficient of all nodes currently detected are input into the normal behavior algorithm model to calculate the benchmark value of each node; Multiply the communication frequency of each node by the sensitivity score to obtain the communication weight. Then use the permission level as a weighted item to reflect the authority influence of the node, and then subtract the historical anomaly coefficient to obtain the baseline value of the node.

[0010] Preferably, S32, collecting the access behavior of each current node in real time through a network monitoring tool, and performing an absolute deviation from the reference value, and then accumulating the deviations of all nodes to obtain the total absolute deviation of all nodes; Then calculate the weighted value of the transmission protocol type and the data transmission duration and add it to the absolute deviation part to correct the deviation degree and obtain the deviation degree value; S33, calculating the deviation value of each node under normal circumstances through historical behavior data, and performing average value processing and standard deviation processing, obtaining the average value and standard deviation of the deviation value of each node under normal circumstances, and calculating and outputting the deviation threshold F1 in combination with the adjustment parameters; Based on the difference evaluation between the deviation threshold F1 and the deviation value, the current abnormal behavior is analyzed, and the specific evaluation content is as follows; When the deviation value is greater than the deviation threshold, the current node is automatically marked as an abnormal node; When the deviation value is ≤ the deviation threshold, no marking is required.

[0011] Preferably, said S4 includes S41 and S42; S41. After identifying the current node as an abnormal node, based on the reasoning ability of the knowledge graph, the enterprise network risk propagation path is found through the edge relationship weights, sensitivity scores and authority levels, and the abnormal propagation path formula is used to calculate and output the risk propagation path score, and analyze the severity of the network analysis propagation path.

[0012] Preferably, S42, based on the risk propagation path score and the deviation value, a comprehensive calculation is performed, and a weight coefficient is set to adjust the risk propagation path score and the deviation value, and the impact of the score is analyzed to generate a comprehensive risk score for each node.

[0013] Preferably, said S5 includes S51 and S52; S51. Customize the first risk threshold and the second risk threshold according to the enterprise needs, conduct risk assessment with the comprehensive risk score, and divide the nodes into three warning levels based on the risk assessment results. The specific assessment contents are as follows; When the comprehensive risk score is less than the first risk threshold, the current node is classified as the first-level warning level; When the second risk threshold ≤ comprehensive risk score < first risk threshold, the current node is classified as the second warning level; When the comprehensive risk score is ≥ the first risk threshold, the current node is divided into three warning levels; Level 1 warning level < Level 2 warning level < Level 3 warning level; S52, generating corresponding treatment measures based on the three warning levels; When the first-level warning level is received again, only the current state of the first-level warning level node is recorded, and continuous monitoring is performed without immediate intervention, and the comprehensive risk score of the current node is stored in the graph database, and the current state of the node is updated regularly; When the second-level warning level is received, an automated report generation tool is used to generate a report on the current status of the second-level warning level node and send it to the designated security team. Then, through the security policy engine, the security team is advised to plan to isolate the node. When the third level warning level is received, automatic isolation is implemented through the security protection system, the highest level alarm is sent to the security team in real time using the alarm system, an event entry is created in the event management system, and detailed information of the node is recorded.

[0014] A network security situation early warning system based on knowledge graph, including a data collection and preprocessing module, a knowledge graph construction module, a normal behavior deviation analysis module, an abnormal propagation path and risk analysis module and a hierarchical early warning module; The data collection and preprocessing module collects enterprise network environment data from enterprise-related systems in real time through network detection tools, and performs data cleaning and normalization on the collected enterprise network environment data to obtain data sets of the same magnitude; The knowledge graph construction module defines the knowledge graph structure by constructing a knowledge graph construction formula, and the knowledge graph structure includes node types, edge types and weight attributes; at the same time, the communication relationship weights and data transmission weights between nodes are calculated respectively through the knowledge graph construction formula, and then a graph database is constructed, and the data sets of the same magnitude are imported into the graph database to generate a complete enterprise network environment knowledge graph; The normal behavior deviation analysis module conducts deep learning on the enterprise network environment knowledge graph, constructs a normal behavior algorithm model in the enterprise network, calculates the normal behavior benchmark value of each node, and then calculates the deviation between the normal behavior benchmark value and the behavior data of each node to obtain the deviation value, and sets the deviation threshold and the deviation value for difference evaluation; The abnormal propagation path and risk analysis module analyzes the risk propagation path score based on the reasoning ability of the knowledge graph when the difference evaluates the abnormal behavior, and then comprehensively calculates and outputs the comprehensive risk score of each node in combination with the deviation value; The graded warning module performs risk assessment by setting a first risk threshold and a second risk threshold and the comprehensive risk score Rs, and divides the nodes into three warning levels according to the risk assessment results, and generates processing measures based on the three warning levels.

[0015] The present invention provides a network security situation early warning method and system based on knowledge graph, which has the following beneficial effects: (1) This method realizes the real-time and efficient collection and integration of enterprise network environment data through the construction of knowledge graph, effectively improving the comprehensiveness and accuracy of network security analysis. Network detection tools and API interfaces are used to connect different systems to collect network environment data in real time. After the network environment data is collected, it is cleaned and normalized so that the data from different data sources in the enterprise network can be unified to form a data set of the same magnitude and imported into the graph database. This all-round data integration not only solves the problem of information islands in traditional network security monitoring, but also structures multi-dimensional data through knowledge graphs, enabling enterprises to conduct a panoramic analysis of potential security threats based on a global network perspective, providing an accurate data foundation for subsequent anomaly detection and risk assessment.

[0016] (2) This method combines knowledge graphs with deep learning algorithms to establish a normal behavior baseline model for network nodes, thereby enhancing the ability to accurately identify abnormal behaviors and provide real-time warnings. Through an unsupervised learning algorithm, the historical data of each node is learned and modeled to form a normal behavior baseline value. During real-time monitoring, the deviation between the current access behavior of each node and its baseline value is calculated to obtain the deviation value, which is then compared with the set deviation threshold to identify and mark abnormal nodes that deviate from normal behavior. This deviation model combines key factors such as transmission protocol and data transmission duration, and can sensitively detect small deviations in the communication frequency or authority of nodes, thereby quickly adapting to dynamic network environments. By analyzing and evaluating the differences in real-time deviation data, the system can accurately identify complex hidden threats and issue warnings when anomalies first occur, significantly improving the company's risk response efficiency.

[0017] (3) This method uses a comprehensive risk scoring mechanism to achieve multi-level warning and automated response for nodes with different risk levels, effectively optimizing network security management strategies. First, based on the reasoning ability of the knowledge graph, the abnormal propagation path is identified, and the propagation path score is obtained by calculating the weight, permission level and sensitivity score on the path. Subsequently, the system combines the deviation value with the propagation path score to calculate the comprehensive risk score, and compares it with the risk threshold set by the enterprise to divide the node into three warning levels. In the first-level warning, the system only records the node status and continuously monitors; the second-level warning generates an automated report and recommends isolation; the third-level warning immediately triggers automatic isolation and issues the highest alert to the security team. Through different levels of warning strategies, enterprises can quickly and flexibly respond to high, medium and low risks, and achieve all-round protection from continuous monitoring to automatic response. The combination of comprehensive risk scoring and multi-level warning ensures the accuracy and efficiency of the system in security management, and can improve the practicality of security protection while minimizing risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a schematic diagram of a process flow of a network security situation early warning method based on a knowledge graph of the present invention; Figure 2 This is a schematic diagram of the steps of a network security situation early warning system based on a knowledge graph in the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Example 1 See also Figure 1 The present invention provides a network security situation early warning method based on knowledge graph. To achieve the above purpose, the present invention is implemented by the following technical scheme: comprising the following steps: S1. Collect enterprise network environment data from enterprise-related systems in real time through network detection tools, clean and normalize the collected enterprise network environment data, obtain data sets of the same magnitude, build a graph database, and import the data sets of the same magnitude into the graph database; S2. Construct a knowledge graph construction formula to define the knowledge graph structure G=(V, E, W), which includes node type, edge type and weight attribute; then calculate the communication relationship weight and data transmission weight between nodes through the knowledge graph construction formula, and then construct a graph database, import the same-level data set into the graph database, and generate a complete enterprise network environment knowledge graph; S3. Conduct deep learning on the enterprise network environment knowledge graph, build a normal behavior algorithm model in the enterprise network, calculate the normal behavior benchmark value Bn of each node, and then calculate the deviation between the normal behavior benchmark value Bn and the behavior data of each node to obtain the deviation value Ds, and set the deviation threshold F1 and the deviation value Ds for difference evaluation; S4. When the abnormal behavior is evaluated by difference, the risk propagation path score Rp is analyzed based on the reasoning ability of the knowledge graph, and then the comprehensive risk score Rs of each node is calculated and output in combination with the deviation value Ds; S5. Set the first risk threshold T1 and the second risk threshold T2 and the comprehensive risk score Rs to perform risk assessment, and divide the nodes into three warning levels according to the risk assessment results, and generate processing measures based on the three warning levels.

[0021] In this embodiment, this method realizes an efficient early warning mechanism for the network security situation of an enterprise by constructing a dynamic knowledge graph. First, multi-dimensional enterprise network environment data is collected in real time through a network detection tool, cleaned and normalized to ensure data consistency, and the same-level data set is imported into a graph database to construct a knowledge graph containing node and edge relationships. Then, the communication relationship and data transmission weight are calculated using the knowledge graph structure formula G=(V, E, W) to generate a complete knowledge graph of the enterprise network environment. Through a deep learning algorithm model, a normal behavior benchmark value Bn is established for each node in the graph, and the deviation value Ds is compared with the real-time behavior data, and the deviation threshold F1 is set for difference evaluation, so as to accurately identify abnormal behaviors that deviate from the normal. Thereafter, combined with the reasoning ability of the knowledge graph, the risk propagation path score Rp is calculated, and the comprehensive risk score Rs of the node is generated by comprehensive evaluation of the deviation degree Ds and the propagation path score Rp. Finally, by setting the first risk threshold T1 and the second risk threshold T2, the nodes are divided into three warning levels, and corresponding treatment measures are generated to ensure priority response to high-risk nodes. Through the implementation of this process, the goal of real-time and accurate network security situation awareness and risk warning is achieved. This method combines knowledge graphs with deep learning technology, and can analyze network behavior in a multi-dimensional and dynamic manner, issue warnings at the early stage of anomalies, and ensure timely detection of potential threats. Overall, this method improves the accuracy and efficiency of security risk identification, enables enterprises to respond quickly and take differentiated protection measures, effectively builds a layered network security defense system, and significantly reduces the potential risks and propagation impact of network security incidents.

[0022] Example 2 This embodiment is explained in Example 1, please refer to Figure 1 , specifically: S1 includes S11 and S12; S11. Use API application program interface to integrate with enterprise related systems and collect enterprise network environment data in real time through network detection tools; Enterprise-related systems include data classification systems, database management systems, authority management systems, security logs, and network monitoring systems; Enterprise network environment data includes communication frequency Nc, sensitivity score Sa, permission level Pg, historical anomaly coefficient He, access data volume Dv, transmission protocol type Tp and data transmission duration Cd; The communication frequency Nc is obtained by collecting the number of communications between nodes in the enterprise network environment in real time through the network monitoring system, and counting the communication frequency of each pair of nodes; The sensitivity score Sa is obtained by obtaining sensitivity information from the data classification system, for example, by setting different sensitivity levels such as low, medium and high for data classification through the data labeling system, and marking the data type in the database management system, for example, the data of the financial system is set to 1.0, the R&D data is set to 0.8, and the general business data is set to 0.5; The permission level Pg obtains the permission level of each user or device node by calling the API application program interface of the permission management system, and maps it to a numerical permission score. The administrator's permission can be set to 1.0, the ordinary user's permission is set to 0.6, and the guest user's permission is set to 0.3; The historical anomaly coefficient He is obtained by analyzing the historical anomaly event records of each node from the security log, counting the number of anomalies of each node and normalizing them. The specific method includes extracting the type and number of abnormal events from the log, and summarizing them by node to obtain the historical anomaly coefficient; The access data volume Dv is used to monitor the size of the data packet in each communication through the network detection tool, and the average data volume of the communication between the two nodes is calculated; The transmission protocol type Tp extracts the protocol type of each communication through the network monitoring system and assigns security scores to different protocols, such as HTTP protocol score of 0.3, HTTPS protocol score of 0.8, and FTP protocol score of 0.5; The data transmission duration Cd is obtained by extracting the start time and end time of each communication through a network detection tool, calculating the transmission duration by difference, and normalizing the duration by time interval to ensure data consistency in different time periods; S12. After the collection is completed, the enterprise network environment data is cleaned and standardized; Data cleaning includes deduplication, outlier processing, and missing value filling; Deduplication processing deletes duplicate records to avoid multiple occurrences of parameters of the same node, which may affect the analysis results.

[0023] Outlier processing detects outliers, such as records with communication frequencies much higher than other nodes, which may be the result of misoperation or system errors.

[0024] Missing value filling: For missing data items, such as the missing sensitivity score of a node, the missing data items can be filled by using the mean value or referring to the values ​​of similar nodes; Normalization is performed by scaling the enterprise network environment data to a range of 0-1 using Min-Max. Use label encoding to uniformly represent discrete data in the enterprise network environment data using numerical values. For example, map HTTP, HTTPS, and FTP to security scores such as 0.3, 0.8, and 0.5, and uniformly use numerical values ​​to represent them. Discrete data includes permission level Pg, sensitivity score Sa and transmission protocol type Tp.

[0025] In this embodiment, the method is connected to the enterprise-related system by using the API application program interface to collect enterprise network environment data in real time. For the collected enterprise network environment data. After the data collection is completed, the enterprise network environment data is cleaned and standardized. Duplicate records are removed by deduplication to avoid misjudgment caused by data redundancy, and outlier detection is performed to screen out abnormal data caused by misoperation or system errors. At the same time, the missing item data is filled with the mean or referenced to the same node value to ensure data integrity. Finally, the data is scaled to the range of 0-1 by the Min-Max standardization method, and the discrete data is assigned by label encoding, so that different types of parameters can be digitized and unified, and finally form a data set of the same magnitude. The implementation of this method achieves the purpose of efficient integration and cleaning of data, and improves the accuracy and availability of data through a unified data processing process. Its beneficial effect is that through data cleaning and standardization, not only the basic data quality of the map construction is greatly improved, but also the accuracy of subsequent deviation detection and abnormal analysis is ensured.

[0026] Example 3 This embodiment is explained in Example 2. Please refer to Figure 1 , specifically: S2 includes S21 and S22; S21. Use the knowledge graph to construct a formula to define the knowledge graph structure G=(V, E, W). The knowledge graph structure G=(V, E, W) includes node type V, edge type E and edge relationship weight W. Node type V includes all network device nodes and user nodes in the enterprise network environment; The network device nodes include each device node storing device ID, device type and IP address information; User nodes include storage of user ID, role, and permission level; Edge type E represents the relationship between nodes, including communication relationship edges and data transmission relationship edges; The communication relationship edge represents the daily communication between devices, including the communication frequency Nc, sensitivity score Sa and permission level Pg; The data transmission relationship edge represents the data flow path between different nodes, including the transmission protocol type Tp and the data transmission duration Cd; The edge relationship weight W is assigned to the edge attribute.

[0027] S22. Use a graph database to store and manage node relationships, edge relationships, and weight data. According to the scale and number of enterprise networks, set the graph database's memory cache and index to optimize query efficiency, and set access rights for different users. Use the graph database batch import tool Neo4j to import the defined knowledge graph structure G = (V, E, W) into the graph database; Then use the Cypher query language to batch create nodes and edges, add attributes to each node and edge, and set a unique identifier for each node, such as ID and IP address, with the defined knowledge graph structure G=(V, E, W); Then, based on the knowledge graph construction formula, the communication relationship edge weight and data transmission relationship edge weight are calculated respectively to measure the risks of different relationships between nodes for use in subsequent queries; The calculation results of the communication relationship edge weights and data transmission relationship edge weights are assigned to the edges in the graph to indicate the risk levels of the communication relationships and data transmission paths, thus generating a complete enterprise network environment knowledge graph.

[0028] The knowledge graph construction formula is as follows; ; In the formula, Nc i represents the communication frequency of the ith communication relationship edge, Sa i represents the sensitivity score of the ith communication relationship edge, Pg i represents the permission level of the ith communication relationship edge, n represents the total number of communication relationship edges, Cd j Indicates the data transmission duration of the jth data transmission relationship edge, Tp j represents the transmission protocol type of the jth data transmission relationship edge, and m represents the total number of data transmission relationship edges; represents the edge weight of the communication relationship, Represents the edge weight of the data transmission relationship.

[0029] In this embodiment, the method defines the knowledge graph structure of the enterprise network environment through the knowledge graph construction formula, and realizes the comprehensive modeling of nodes, edges and weights. By storing and managing the constructed knowledge graph G through a graph database such as Neo4j, efficient query and management of node relationships, edge relationships and their weights are realized. Based on the scale and number of nodes of the enterprise network, the memory cache and index of the graph database are optimized, and the query efficiency is further improved. Through the batch import tool and Cypher query language of the graph database, batch creation of nodes and edges with attributes such as ID and IP address is realized, ensuring the uniqueness and comprehensiveness of each node. Finally, the weights of the communication relationship edge and the data transmission relationship edge are calculated respectively through the knowledge graph construction formula, and the calculation results are assigned to the edge attributes of the graph to identify the risk level of the communication and data transmission paths, and generate a complete enterprise network environment knowledge graph. The implementation of this method achieves the purpose of structuring and quantitative representation of complex node relationships in the enterprise network environment, and constructs a knowledge graph guided by risk weights. Its beneficial effect is that through the storage and query of the graph database, the risk information of each node relationship in the network can be quickly and accurately analyzed and extracted, providing support for enterprises to achieve more accurate network security situation awareness.

[0030] Example 4 This embodiment is explained in Example 3, please refer to Figure 1 , specifically: S3 includes S31, S32 and S33; S31. Through the unsupervised learning algorithm in deep learning, the historical communication frequency Nc, sensitivity score Sa, authority level Pg and historical anomaly coefficient He of each node in the enterprise network environment knowledge graph are deeply learned to build a normal behavior algorithm model; Then, the real-time communication frequency Nc, sensitivity score Sa, authority level Pg and historical anomaly coefficient He of all nodes currently detected are input into the normal behavior algorithm model to calculate the benchmark value Bn of each node. The specific calculation method is as follows; Multiply the communication frequency Nc of each node by the sensitivity score Sa to obtain the communication weight. Use the authority level Pg as a weighted item to reflect the authority influence of the node, and then subtract the historical anomaly coefficient He to avoid the benchmark value of the node with frequent historical anomalies being too high, thereby obtaining the node's benchmark value Bn; The reference value Bn is calculated and output by the following normal behavior algorithm model; ; In the formula, He i Represents the historical anomaly coefficient of the i-th node.

[0031] S32, using a network monitoring tool to collect the access behavior Av of each node in real time, and perform an absolute deviation from a reference value Bn, and then accumulate the deviations of all nodes to obtain the total absolute deviation of all nodes; Then calculate the weighted value of the transmission protocol type Tp and the data transmission duration Cd and add them to the absolute deviation part to correct the deviation degree and obtain the deviation degree value Ds; The deviation value Ds is calculated and output by the following algorithm formula; ; S33. Calculate the deviation value Ds of each node under normal circumstances through historical behavior data, and perform average value processing and standard deviation processing to obtain the average value of the deviation value Ds of each node under normal circumstances. and standard deviation , and combined with the adjustment parameters, calculate the output deviation threshold F1. The specific calculation formula of the deviation threshold F1 is F1= +z× , z represents the adjustment coefficient of the standard deviation; Based on the deviation threshold F1 and the deviation value Ds, the difference evaluation is performed to analyze the current abnormal behavior. The specific evaluation contents are as follows; When the deviation value Ds>deviation threshold F1, the current node is automatically marked as an abnormal node; When the deviation value Ds ≤ the deviation threshold F1, no marking is required.

[0032] In this embodiment, the method constructs a normal behavior model of the enterprise network by deeply learning the historical communication frequency Nc, sensitivity score Sa, authority level Pg and historical anomaly coefficient He of each node in the enterprise network environment knowledge graph. The model calculates the reference value Bn of each node, multiplies the communication frequency Nc by the sensitivity score Sa to generate a communication weight, combines the weight of the authority level Pg, and subtracts the historical anomaly coefficient He to suppress nodes with frequent anomalies, thereby calculating an accurate normal behavior reference value Bn. In real-time monitoring of the current access behavior Av of each node, the absolute deviation between it and the normal behavior reference value Bn is accumulated to obtain the total deviation value Ds of all nodes. In order to further improve the accuracy of the deviation, the weighted values ​​of the transmission protocol type Tp and the data transmission time Cd are added to the deviation calculation to form a comprehensive deviation value Ds to accurately reflect the abnormal degree of node behavior. By analyzing the historical behavior data, the average and standard deviation of the deviation value Ds of each node under normal conditions are calculated, and then combined with the adjustment parameters, the deviation threshold F1 is calculated. By comparing the deviation value Ds with the deviation threshold F1, it is possible to accurately assess whether the current behavior of the node is abnormal. If Ds exceeds F1, it is automatically marked as an abnormal node, otherwise no processing is required. This method achieves the purpose of accurately identifying abnormal behavior by building a normal behavior model and monitoring deviations in real time. Its beneficial effect is that the deviation model constructed using multi-dimensional parameters improves the sensitivity and accuracy of detection. With the support of comprehensive deviation calculation and difference evaluation, the system can respond to potential threats in real time, ensuring that even subtle anomalies can be identified in a timely manner.

[0033] Example 5 This embodiment is explained in Example 4. Please refer to Figure 1 , specifically: S4 includes S41 and S42; S41. After identifying the current node as an abnormal node, based on the reasoning ability of the knowledge graph, the enterprise network risk propagation path is found through the edge relationship weight W, the sensitivity score Sa and the authority level Pg, and the abnormal propagation path formula is used to calculate the output risk propagation path score Rp to analyze the severity of the network analysis propagation path; The risk propagation path score Rp is calculated and output by the following abnormal propagation path formula; ; In the formula, k represents the path edge, W k Pg represents the kth edge relationship weight on the path; k Indicates the permission level of the node on the kth edge of the path, Sa k Represents the sensitivity score of the node on the kth edge of the path, Path represents the path, Represents traversing each edge k on the path Path.

[0034] Example 5 This example is an explanation of Example 4. Figure 1 Specifically: S42, based on the risk propagation path score Rp and the deviation value Ds, a comprehensive calculation is performed, and a weight coefficient is set to adjust the risk propagation path score Rp and the deviation value Ds, and the impact of the score is analyzed to generate a comprehensive risk score Rs for each node; The comprehensive risk score Rs is calculated and output by the following algorithm formula; ; In the formula, and They represent the weight coefficients of the deviation value Ds and the risk propagation path score Rp respectively. If the current behavior deviates from the important value, take > If the risk of transmission is greater, > .

[0035] In this embodiment, after re-identifying the abnormal nodes, the method uses the reasoning function of the knowledge graph to locate the potential risk propagation path based on multi-dimensional factors such as edge relationship weight W, sensitivity score Sa and permission level Pg. Combined with the abnormal propagation path formula, the weight W of each edge k on the path is calculated. k With permission level Pg k and sensitivity score Sa k Calculations are performed to generate a risk propagation path score Rp, which accurately assesses the severity of abnormal propagation. Then, through comprehensive risk calculation, the risk propagation path score Rp is combined with the deviation value Ds to generate a comprehensive risk score Rs for each node. In this process, the relative influence of Rp and Ds is balanced according to the weight coefficient set by the enterprise security policy. If the current behavior deviation is more significant, the weight of Ds is preferred; if the propagation risk is greater, the weight of Rp is preferred, so as to obtain the most realistic risk score. The implementation of this method achieves the purpose of accurately quantifying and grading network security risks through multi-level risk assessment. Its beneficial effect is that through the reasoning and path analysis of the knowledge graph, it can not only quickly lock the high-risk propagation path, but also combine the comprehensive scoring mechanism of deviation and propagation path, making the risk assessment more comprehensive and dynamic.

[0036] Example 6 This embodiment is explained in Example 5. Please refer to Figure 1 , specifically: S5 includes S51 and S52; S51, customizing the first risk threshold T1 and the second risk threshold T2 according to the needs of the enterprise, performing risk assessment with the comprehensive risk score Rs, and dividing the nodes into three warning levels based on the risk assessment results. The specific assessment contents are as follows; When the comprehensive risk score Rs is less than the first risk threshold T1, the current node is classified as the first-level warning level; When the second risk threshold T1≤comprehensive risk score Rs<first risk threshold T2, the current node is divided into the second warning level; When the comprehensive risk score Rs ≥ the first risk threshold T2, the current node is divided into three warning levels; Level 1 warning level < Level 2 warning level < Level 3 warning level; S52, generating corresponding treatment measures based on the three warning levels; When the first-level warning level is received again, only the current status of the first-level warning level node is recorded, and continuous monitoring is carried out without immediate intervention. The comprehensive risk score Rs of the current node is stored in the graph database, and the current status of the node is updated regularly; When a Level 2 warning is received, the automated report generation tool is used to generate a report on the current status of the Level 2 warning node and send it to the designated security team. The security policy engine then recommends that the security team plan to isolate the node. When the third-level warning level is received, automatic isolation is implemented through the security protection system, the alarm system is used to send the highest level alarm to the security team in real time, event entries are created in the event management system, and detailed information of high-risk nodes is recorded.

[0037] In this embodiment, the method customizes the first risk threshold T1 and the second risk threshold T2 according to the needs of the enterprise, dynamically evaluates the risk level of each node based on the comprehensive risk score Rs, and divides the nodes into three warning levels, so as to ensure the accuracy and timeliness of the warning level classification. Through this flexible warning classification system, enterprises can take corresponding response measures under different risk levels. Differentiated processing schemes are designed according to different warning levels to ensure the optimal allocation of resources and efficient response. This hierarchical response system not only improves the system's automated response capabilities, but also ensures that high-risk nodes can receive priority attention. This method achieves the purpose of rapid identification and accurate response through hierarchical warning and automated disposal. Its beneficial effect is that through customized threshold settings and classification strategies, risk response becomes more flexible and reasonable, avoiding waste of resources and delayed response.

[0038] Example 7 See also Figure 1 and Figure 2, a network security situation early warning system based on knowledge graph, including data collection and preprocessing module, knowledge graph construction module, normal behavior deviation analysis module, abnormal propagation path and risk analysis module and hierarchical early warning module; The data collection and preprocessing module collects enterprise network environment data from enterprise-related systems in real time through network detection tools, and performs data cleaning and normalization on the collected enterprise network environment data to obtain data sets of the same magnitude; The knowledge graph construction module defines the knowledge graph structure G=(V, E, W) by constructing a knowledge graph construction formula, and the knowledge graph structure G=(V, E, W) includes node type, edge type and weight attribute; at the same time, the communication relationship weight and data transmission weight between nodes are calculated respectively through the knowledge graph construction formula, and then a graph database is constructed, and the data set of the same magnitude is imported into the graph database to generate a complete enterprise network environment knowledge graph; The normal behavior deviation analysis module conducts deep learning on the enterprise network environment knowledge graph, constructs a normal behavior algorithm model in the enterprise network, calculates the normal behavior benchmark value Bn of each node, and then calculates the deviation between the normal behavior benchmark value Bn and the behavior data of each node to obtain the deviation value Ds, and sets the deviation threshold F1 and the deviation value Ds for difference evaluation; The abnormal propagation path and risk analysis module analyzes the risk propagation path score Rp based on the reasoning ability of the knowledge graph when the difference evaluates the abnormal behavior, and then comprehensively calculates and outputs the comprehensive risk score Rs of each node in combination with the deviation value Ds; The graded warning module performs risk assessment by setting a first risk threshold T1 and a second risk threshold T2 and the comprehensive risk score Rs, and divides the nodes into three warning levels according to the risk assessment results, and generates processing measures based on the three warning levels.

[0039] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that many changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the invention.

Claims

1. A network security situation early warning method based on knowledge graph, characterized by: The following steps are involved: S1. Collect enterprise network environment data from enterprise-related systems in real time through network detection tools, and perform data cleaning and normalization on the collected enterprise network environment data to obtain data sets of the same magnitude; S2. Construct a knowledge graph construction formula to define the knowledge graph structure, where the knowledge graph structure includes node types, edge types, and weight attributes; At the same time, the communication relationship weight and data transmission weight between nodes are calculated through the knowledge graph construction formula, and then a graph database is constructed, and the data sets of the same magnitude are imported into the graph database to generate a complete enterprise network environment knowledge graph; S3, deep learning the enterprise network environment knowledge graph, constructing a normal behavior algorithm model in the enterprise network, calculating the normal behavior benchmark value of each node, and then calculating the deviation between the normal behavior benchmark value and the behavior data of each node to obtain the deviation value, and setting the deviation threshold and the deviation value for difference evaluation; S4. When the difference evaluates abnormal behavior, the risk propagation path score is analyzed based on the reasoning ability of the knowledge graph, and then the comprehensive risk score of each node is calculated and output in combination with the deviation value; S5. Set a first risk threshold and a second risk threshold to perform risk assessment with the comprehensive risk score, and divide the nodes into three warning levels according to the risk assessment results, and generate processing measures based on the three warning levels.

2. A network security situation early warning method based on knowledge graph according to claim 1, characterized in that: Said S1 includes S11 and S12; S11, using an API application program interface to integrate with the enterprise-related system, and collecting enterprise network environment data in real time through the network detection tool; The enterprise-related systems include data classification system, database management system, authority management system, security log and network monitoring system; The enterprise network environment data includes communication frequency, sensitivity score, permission level, historical anomaly coefficient, access data volume, transmission protocol type and data transmission duration; S12, after the collection is completed, the enterprise network environment data is cleaned and standardized; The data cleaning includes deduplication processing, outlier processing and missing value filling; The standardization process is performed by scaling the enterprise network environment data to a range of 0-1 using Min-Max; Use label coding to uniformly represent discrete data in enterprise network environment data using numerical values; The discrete data includes permission level, sensitivity score and transmission protocol type.

3. A network security situation early warning method based on knowledge graph according to claim 2, characterized in that: The S2 includes S21 and S22; S21. Using the knowledge graph construction formula, define the knowledge graph structure, where the knowledge graph structure includes node types, edge types, and edge relationship weights; The node types include all network device nodes and user nodes in the enterprise network environment; The network device node includes each device node storing device ID, device type and IP address information; The user node includes storing user ID, role and authority level; The edge types include communication relationship edges and data transmission relationship edges; The communication relationship edge includes communication frequency, sensitivity score and authority level; The data transmission relationship edge includes the transmission protocol type and the data transmission duration; The edge relationship weights and assigns weight values ​​to edge attributes.

4. A network security situation early warning method based on knowledge graph according to claim 3, characterized in that: S22. Use a graph database to store and manage node relationships, edge relationships, and weight data. According to the scale and number of enterprise networks, set the graph database's memory cache and index to optimize query efficiency, and set access rights for different users. Use the graph database batch import tool Neo4j to import the defined knowledge graph structure into the graph database; Then use the Cypher query language to batch create nodes and edges, add attributes to each node and edge, and set a unique identifier for each node; Then, based on the knowledge graph construction formula, the communication relationship edge weight and data transmission relationship edge weight are calculated respectively to measure the risks of different relationships between nodes; The calculation results of the communication relationship edge weights and data transmission relationship edge weights are assigned to the edges in the graph to indicate the risk levels of the communication relationships and data transmission paths, thus generating a complete enterprise network environment knowledge graph.

5. A network security situation early warning method based on knowledge graph according to claim 4, characterized in that: The S3 includes S31, S32 and S33; S31. Using an unsupervised learning algorithm in deep learning, deeply learn the historical communication frequency, sensitivity score, authority level, and historical anomaly coefficient of each node in the enterprise network environment knowledge graph to construct the normal behavior algorithm model; Then, the real-time communication frequency, sensitivity score, authority level and historical abnormality coefficient of all nodes currently detected are input into the normal behavior algorithm model to calculate the benchmark value of each node; Multiply the communication frequency of each node by the sensitivity score to obtain the communication weight. Then use the permission level as a weighted item to reflect the authority influence of the node, and then subtract the historical anomaly coefficient to obtain the baseline value of the node.

6. A network security situation early warning method based on knowledge graph according to claim 5, characterized in that: S32, collecting the access behavior of each node in real time through a network monitoring tool, and performing an absolute deviation from the reference value, and then accumulating the deviations of all nodes to obtain the total absolute deviation of all nodes; Then calculate the weighted value of the transmission protocol type and the data transmission duration and add it to the absolute deviation part to correct the deviation degree and obtain the deviation degree value; S33, calculating the deviation value of each node under normal circumstances through historical behavior data, and performing average value processing and standard deviation processing, obtaining the average value and standard deviation of the deviation value of each node under normal circumstances, and calculating and outputting the deviation threshold value in combination with the adjustment parameters; Based on the deviation threshold and the deviation value, a difference evaluation is performed to analyze the current abnormal behavior. The specific evaluation contents are as follows; When the deviation value is greater than the deviation threshold, the current node is automatically marked as an abnormal node; When the deviation value is ≤ the deviation threshold, no marking is required.

7. A network security situation early warning method based on knowledge graph according to claim 6, characterized in that: The S4 includes S41 and S42; S41. After identifying the current node as an abnormal node, based on the reasoning ability of the knowledge graph, the enterprise network risk propagation path is found through the edge relationship weights, sensitivity scores and authority levels, and the abnormal propagation path formula is used to calculate and output the risk propagation path score, and analyze the severity of the network analysis propagation path.

8. A network security situation early warning method based on knowledge graph according to claim 7, characterized in that: S42. Based on the risk propagation path score and the deviation value, a comprehensive calculation is performed, and a weight coefficient is set to adjust the risk propagation path score and the deviation value. At the same time, the impact of the score is analyzed to generate a comprehensive risk score for each node.

9. A network security situation early warning method based on knowledge graph according to claim 8, characterized in that: The S5 includes S51 and S52; S51. Customize the first risk threshold and the second risk threshold according to the enterprise needs, conduct risk assessment with the comprehensive risk score, and divide the nodes into three warning levels based on the risk assessment results. The specific assessment contents are as follows; When the comprehensive risk score is less than the first risk threshold, the current node is classified as the first-level warning level; When the second risk threshold ≤ comprehensive risk score < first risk threshold, the current node is classified as the second warning level; When the comprehensive risk score is ≥ the first risk threshold, the current node is divided into three warning levels; Level 1 warning level < Level 2 warning level < Level 3 warning level; S52, generating corresponding treatment measures based on the three warning levels; When the first-level warning level is received again, only the current state of the first-level warning level node is recorded, and continuous monitoring is performed without immediate intervention, and the comprehensive risk score of the current node is stored in the graph database, and the current state of the node is updated regularly; When the second-level warning level is received, an automated report generation tool is used to generate a report on the current status of the second-level warning level node and send it to the designated security team. Then, through the security policy engine, the security team is advised to plan to isolate the node. When the third level warning level is received, automatic isolation is implemented through the security protection system, the highest level alarm is sent to the security team in real time using the alarm system, an event entry is created in the event management system, and detailed information of the node is recorded.

10. A network security situation early warning system based on knowledge graph, applied to a network security situation early warning method based on knowledge graph according to any one of claims 1 to 9, characterized in that: It includes data collection and preprocessing module, knowledge graph construction module, normal behavior deviation analysis module, abnormal propagation path and risk analysis module and graded warning module; The data collection and preprocessing module collects enterprise network environment data from enterprise-related systems in real time through network detection tools, and performs data cleaning and normalization on the collected enterprise network environment data to obtain data sets of the same magnitude; The knowledge graph construction module defines the knowledge graph structure by constructing a knowledge graph construction formula, and the knowledge graph structure includes node types, edge types and weight attributes; at the same time, the communication relationship weights and data transmission weights between nodes are calculated respectively through the knowledge graph construction formula, and then a graph database is constructed, and the data sets of the same magnitude are imported into the graph database to generate a complete enterprise network environment knowledge graph; The normal behavior deviation analysis module conducts deep learning on the enterprise network environment knowledge graph, constructs a normal behavior algorithm model in the enterprise network, calculates the normal behavior benchmark value of each node, and then calculates the deviation between the normal behavior benchmark value and the behavior data of each node to obtain the deviation value, and sets the deviation threshold and the deviation value for difference evaluation; The abnormal propagation path and risk analysis module analyzes the risk propagation path score based on the reasoning ability of the knowledge graph when the difference evaluates the abnormal behavior, and then comprehensively calculates and outputs the comprehensive risk score of each node in combination with the deviation value; The graded warning module performs risk assessment by setting a first risk threshold and a second risk threshold and the comprehensive risk score, and divides the nodes into three warning levels according to the risk assessment results, and generates processing measures based on the three warning levels.

Images