Dynamic network risk prediction method and system based on knowledge graph driving

Abstract

The invention belongs to the technical field of dynamic network risk prediction based on knowledge graph driving, and discloses a dynamic network risk prediction method and system based on knowledge graph driving, and the method comprises the steps: firstly obtaining a network security event and a context to construct a knowledge graph, and then detecting entity semantic drift through a preset rule and a deep semantic model, and carrying out node splitting, fusion, renaming or label updating and other structural remodeling on the knowledge graph based on a detection result, and finally carrying out risk prediction by utilizing a graph neural network model. The problem that in a traditional method, a static model cannot adapt to dynamic semantic changes is solved, the recognition capacity of a novel attack mode is improved, the risk detection false report and missing report rate is reduced, and the risk prediction efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of dynamic network risk prediction based on knowledge graph driving, and specifically to a dynamic network risk prediction method and system based on knowledge graph driving, electronic equipment, medium and program product. Background Art

[0002] In reality, cybersecurity knowledge graphs face two difficult problems. One is entity semantic drift. For example, the meaning of the same entity (such as "IP address" or "admin user") changes at different times, tasks, and scenarios. For example, a certain IP address is the source of internal office activities during the day, but it may be an attack entry point at night. The graph cannot distinguish this kind of changing semantics. The other is entity fuzziness or entity ambiguity. For example, the entity expressions that appear in different events or behavior records are vague (such as unknown users, overseas IPs, abnormal process X), making it difficult to determine their actual identity or risk attributes. These nodes in the graph are often incorrectly connected and attributed, resulting in incorrect attack paths; this in turn leads to distorted risk predictions or insufficient progress.

[0003] Therefore, there is an urgent need for a dynamic network risk prediction method driven by knowledge graph to improve the efficiency and accuracy of risk prediction. Summary of the Invention

[0004] The purpose of the present invention is to address the above-mentioned problems and provide a dynamic network risk prediction method and system driven by knowledge graph, electronic equipment, medium and program product.

[0005] To achieve one of the above-mentioned objectives, an embodiment of the present invention provides a knowledge graph-driven dynamic network risk prediction method, comprising:

[0006] Obtaining original cybersecurity event data and its contextual environment information, and constructing an initial knowledge graph consisting of entity nodes, edges, and attribute labels;

[0007] Obtaining contextual features of the current behavior of the entity node and the historical behavior pattern of the entity node, and detecting whether there is semantic drift of the entity node through preset rule matching and / or deep semantic model;

[0008] Based on the detection results, a structural reshaping operation is performed on the entity nodes in the knowledge graph to update the knowledge graph, wherein the structural reshaping includes entity node splitting, entity node fusion, entity node renaming or semantic label updating;

[0009] Based on the updated knowledge graph, network risk prediction is performed through the graph neural network model.

[0010] To achieve one of the above-mentioned objectives, an embodiment of the present invention provides a knowledge graph-driven dynamic network risk prediction system, comprising:

[0011] The first construction module is used to obtain the original network security event data and its contextual environment information and construct an initial knowledge graph, which is composed of entity nodes, edges and attribute labels;

[0012] A first detection module is configured to obtain contextual features of the current behavior of the entity node and the historical behavior pattern of the entity node, and detect whether there is semantic drift in the entity node through preset rule matching and / or deep semantic modeling;

[0013] A reconstruction module is used to perform a structural reshaping operation on the entity nodes in the knowledge graph based on the detection results to update the knowledge graph, wherein the structural reshaping includes entity node splitting, entity node fusion, entity node renaming or semantic label updating;

[0014] The prediction module is used to predict network risks based on the updated knowledge graph through the graph neural network model.

[0015] In order to achieve one of the above-mentioned purposes of the invention, an embodiment of the present invention provides a storage medium storing program instructions, which, when executed, implements the knowledge graph-driven dynamic network risk prediction method as described in any of the above items.

[0016] To achieve one of the above-mentioned purposes of the invention, one embodiment of the present invention provides an electronic device, including a processor and a memory, wherein the memory stores program instructions, and the processor runs the program instructions to implement the dynamic network risk prediction method driven by knowledge graph as described in any of the above items.

[0017] Through the solution provided by the embodiment of the present invention, based on the contextual features of the current behavior of the entity node and the historical behavior pattern of the entity node, through preset rule matching and deep semantic model entity semantic drift detection, through structural reshaping such as entity splitting and label updating, the graph can dynamically adapt to the semantic differences of entities in different times and scenarios, ensuring the accuracy of attack path analysis. Through the neighbor sampling and feature aggregation mechanism of the graph neural network, combined with the dynamic adaptive sampling strategy expansion, the semantic disambiguation of fuzzy entities is enhanced. The semantic drift detection parameters are reversely optimized through the model prediction results to form a closed loop of drift detection-graph reshaping-risk prediction-feedback optimization, reducing the false positive and false negative rate of risk detection and improving the efficiency of risk prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of the knowledge graph-driven dynamic network risk prediction method of the present invention;

[0019] Figure 2 This is a schematic diagram of the knowledge graph structure of the present invention;

[0020] Figure 3 This is a schematic diagram of the structure of the dynamic network risk prediction system driven by knowledge graph according to the present invention;

[0021] Figure 4 It is a structural schematic diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0022] The present invention will be described in detail below with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional changes made by those skilled in the art based on these embodiments are all within the scope of protection of the present invention.

[0023] The scope of the embodiments herein includes the entire scope of the claims, and all available equivalents of the claims. Herein, the terms "first", "second", etc. are only used to distinguish one element from another, without requiring or implying any actual relationship or order between these elements. The terms "include", "comprises", or any other variants thereof are intended to cover non-exclusive inclusions and do not exclude the presence of other identical elements in the structure, device or equipment including the elements. The various embodiments are described in a progressive manner herein, and each embodiment focuses on the differences from other embodiments, and the same similar parts between the various embodiments can be referred to each other.

[0024] An embodiment of the present invention provides a dynamic network risk prediction method based on knowledge graph drive, such as Figure 1 As shown, the following steps are included:

[0025] Step 101: Obtain original network security event data and its contextual environment information, and construct an initial knowledge graph, which is composed of entity nodes, edges and attribute labels.

[0026] In some embodiments, raw event data refers to basic behavior logs, including entities (eg, users, IPs, processes) and their operations.

[0027] Contextual information refers to the background conditions that affect the semantics of an event, including:

[0028] Temporal characteristics: the specific time of the event (e.g., weekdays / late nights) and time period (e.g., office hours);

[0029] Business status: whether it is in the operation and maintenance window, normal operation status, or abnormal alarm status;

[0030] Historical behavior patterns: The entity's past behavior patterns (such as IP access frequency and user login habits).

[0031] Exemplarily, the components of a knowledge graph include:

[0032] Nodes (entities) include users (e.g., admin), IP addresses (e.g., IP_1), processes (e.g., process X), servers (e.g., server A), rules, etc.

[0033] Edges (relationships) include behavioral actions (e.g., "login," "access," "run") and entity attributes (e.g., "belongs to the intranet," "high-risk port").

[0034] Attribute labels, for example, add contextual attributes (such as timestamps and business status tags) to nodes and edges.

[0035] The formula for constructing a knowledge graph can be simplified as follows:

[0036] KG={V,E,A}

[0037] Among them, V is the set of entity nodes (for example, {admin, IP_1, server A}); E is the set of relationship edges (for example, {admin→login→server A, IP_1→access→server A}); A is the set of attributes (for example, {time=23:00, business status=non-operation and maintenance}).

[0038] As an example, the initial knowledge graph constructed is as follows Figure 2 As shown in the figure, the initial event knowledge graph construction process is:

[0039] Node creation: admin (user), IP_1 (IP), server A (host), 443 port (port), process X (process), machine M (host);

[0040] Relationship edge construction: admin → [Login] → Server A; IP_1 → [Access] → Server A: Port 443; Process X → [Run] → Machine M.

[0041] Add attribute tags: Add attributes to the login edge, such as Time = 23:00, Business Status = Non-Operation and Maintenance; add attributes to the IP_1 node, such as Historical Behavior = Daytime Intranet Access; add attributes to the Process X node, such as Historical Running Environment = R&D Environment.

[0042] Step 102: Obtain the contextual features of the current behavior of the entity node and the historical behavior pattern of the entity node, and detect whether the entity node has semantic drift through preset rule matching and / or deep semantic model.

[0043] In this embodiment, semantic drift refers to the change in the semantic role of the same entity in different contexts, which is generally determined by comparing the differences between the entity's current behavior characteristics and historical behavior patterns.

[0044] In some embodiments, for scenarios where entity behavior directly conflicts with preset security rules and requires a quick response, or scenarios where the semantic logic is simple and clear, semantic drift is detected based on preset rule matching.

[0045] For example, when an entity's behavior directly conflicts with pre-set security rules, for example, a time rule: high-privilege user login outside office hours (22:00-6:00); a business rule: access to core ports (such as 443 and 3389) outside of maintenance windows; or a historical pattern rule: an IP address suddenly accessing a sensitive asset it has never touched before (such as a database server). IP_1 accessing a core business system outside of office hours meets the pre-set rule of "outside office hours + access to core assets = abnormality," and thus triggers a drift flag.

[0046] As you can understand, rule-matching detection boasts high computational efficiency and is well-suited for security scenarios requiring high real-time performance, such as firewalls blocking abnormal access in real time and intrusion detection systems (IDS) providing instant alerts. For example, if an admin user logs into a core server late at night, the rules can quickly match the login rules for non-maintenance windows and core servers, immediately flagging the session as suspected drift.

[0047] Entity semantic drift can be determined by a single or a combination of a few features. In scenarios that do not require complex semantic understanding, it can also be detected based on preset rule matching. For example, if a process runs in the production environment but has only appeared in the test environment, or if the IP address suddenly initiates a public network connection from the intranet segment, and process X runs on machine M in the production environment for the first time, the rule can directly determine semantic drift by assuming that the running environment ≠ the historical environment.

[0048] Specifically, by directly comparing the conflict between the entity's current behavior and historical patterns through the preset security policy, it can be simplified into the formula:

[0049]

[0050] Among them, C cur is the current context feature, R i is the i-th safety rule.

[0051] For example, taking the admin login event as an example, the current context features and historical behavior patterns are as follows:

[0052] C cur ={Time=23:00 (non-office hours), Business Status=non-operation and maintenance window, Login Target=

[0053] Core computer room server A};

[0054] C his ={Logged into the intranet common server between 9:00-18:00 on weekdays, no records of accessing the core computer room}, C his For historical behavior patterns;

[0055] For example, the rule matching process is as follows:

[0056] Rule R1: if (login time Office hours) → Trigger drift, matching condition: 23:00 [9:00,18:00] → established;

[0057] Rule R2: if (login target = core computer room ∧ non-O&M window) → trigger drift, matching condition: server A is in the core computer room and business status ≠ O&M → established;

[0058] The detection result is, Rule_Drift = True, marking admin as a drift entity.

[0059] In some embodiments, for scenarios requiring complex contextual semantic understanding, unknown or novel drift pattern detection scenarios, and semantically ambiguous or ambiguous scenarios, drift detection is performed based solely on a deep semantic model or based on rule matching combined with a deep semantic model.

[0060] For example, these scenarios include, but are not limited to, complex contextual semantic understanding scenarios, when entity drift requires a comprehensive judgment based on multi-dimensional context, such as the combined semantics of time (late night) + business status (non-operation and maintenance) + access characteristics (high traffic + core ports); gradual changes in entity historical behavior patterns (such as the gradual expansion of IP address access frequency and port range). For unknown or new drift pattern detection scenarios, for example, attackers use legitimate user accounts to conduct low-frequency exploratory access (which is difficult to capture with rules, but can be discovered by models through behavioral vector differences); processes gradually obtain system permissions through multi-stage mutations. For semantically ambiguous or ambiguous scenarios, when a single feature cannot clearly determine drift, it is necessary to rely on the overall difference in semantic representation, such as the semantic distinction between the same IP address in "late weekday nights" (possibly overtime) and "late weekend nights" (more likely an attack); and semantic identification of processes with similar names but different actual functions (such as "svchost.exe" and the fake "svvhost.exe").

[0061] Specifically, the deep semantic model can be a security-specific large language model (SecLLM). In this embodiment, the SecLLM is based on the Transformer architecture and integrates the semantics of the security knowledge graph with contextual reasoning capabilities. Its core algorithm framework is as follows:

[0062] The basic model uses a decoder-only architecture similar to GPT, but is optimized for security scenarios, including:

[0063] Security semantic embedding layer: maps network security entities (IP, users, processes, etc.) and behaviors (login, access, attack, etc.) into semantic vectors, integrating entity types, attributes, and knowledge graph relationships.

[0064] Context-aware encoder: Captures the semantic association between event context (time, business status, historical behavior patterns) and entities through a multi-head attention mechanism.

[0065] Security rule injection module: converts preset security rules (such as "abnormal high-risk operations late at night") into rule vectors and cross-validates them with the language model output.

[0066] It can be simplified into the formula:

[0067] SecLLM(E,C,R)=TransformerDecoder(Emb(E)+Emb(C)+RuleVec(R))

[0068] Among them, E is the entity (for example, IP_1); C is the context (for example, "late night + non-operation and maintenance window"); R is the security rule (for example, "abnormal access to core ports in non-operation and maintenance windows"); Emb is the semantic embedding function; RuleVec is the rule vectorization function.

[0069] For example, taking entity IP_1 as an example, the specific working process of SecLLM includes:

[0070] 1. Input processing stage

[0071] Data formatting: Convert events and context into prompts, for example:

[0072] [Event]: IP_1 accessed port 443 of server A at 23:00

[0073] [Context]: Current time = late at night, business status = non-operation window, IP_1's historical behavior = daytime intranet work

[0074] [Rule]: Non-operation and maintenance window + core port access = abnormal behavior

[0075] Question: Did the semantics of IP_1 drift in this incident? What type of risk does this involve?

[0076] Vectorized representation: entity IP_1 → embedding vector (including historical tags such as intranet IP and office use); context "late night + non-operation and maintenance" → embedding vector Rule "Non-Operation and Maintenance + Core Port = Abnormal"

[0077] 2. Semantic Reasoning Stage

[0078] Calculated through the Transformer's self-attention mechanism, it can be simplified to the formula:

[0079]

[0080] in, The entity vector representing IP_1 is a vector that converts the basic information of the network entity IP_1 into a vector through an encoding model (such as word embedding or entity representation model). For example, the attributes of IP_1 (such as the intranet IP, belonging to a certain business network segment, and historically having the role of "office visitor") are encoded into Used to express the basic semantics of IP_1 itself.

[0081] The context information vector is a vector that encodes the context features of IP_1's current behavior (such as time, access port, business status, and access target). For example, if IP_1's current behavior is "accessing the core system port 443 at 23:00, and the system is in a non-operational state", these context features (time = late at night, port = 443, and business status = non-operational state) will be encoded into Used to express the semantics of the environment in which the behavior occurs.

[0082] Represents a rule information vector, which encodes the security rules and policies related to IP_1's behavior (such as "accessing core ports during non-operation and maintenance periods is abnormal" and "office IP access late at night requires special monitoring"). For example, the security rule "non-operation and maintenance period + core port access → abnormal" will be encoded as Used to express semantic requirements at the rule level.

[0083] [;;] represents vector concatenation, which takes the entity vector Context vector Rule Vector Concatenate them sequentially into a longer vector. For example, It is 128-dimensional. It is 128-dimensional. It is 128-dimensional, and after splicing it becomes a 384-dimensional vector. Stringing the three types of information together allows the Transformer's self-attention mechanism to see the three types of information: entity, context, and rule at the same time.

[0084] Attention() represents the self-attention mechanism, which calculates the attention weights of different positions within the concatenated vector to find which information is more important and more relevant. This process is achieved through three steps:

[0085] 1. Calculate attention score

[0086] For each position in the concatenated long vector (which can be understood as each feature dimension or each piece of information), calculate its similarity with other positions. Simplified version of the formula (actually multi-headed and scaled):

[0087]

[0088] Among them, Q (query vector), K (key vector), V (value vector): are usually generated from the concatenated long vector through linear transformation (which can be simply understood as different perspectives of the same vector). For example, for the concatenated vector Three sets of vectors (Q, K, V) will be generated, which are used to "actively query associations", "passively provide association basis", and "output the results after association" respectively. To avoid excessively large values ​​after the dot product, which would result in extreme softmax outputs (either 0 or 1), the scaling factor is used to make the attention weights more reasonable. Softmax converts similarity scores into probabilities (weights) between 0 and 1, ensuring that the sum of the weights at all positions equals 1.

[0089] 2. Assigning attention weights

[0090] Through the above score calculation, each position will get a weight, which represents the closeness of its association with other positions. For example, in the concatenated vector, One section is "time = midnight 23:00, port = 443", and the other section is "Non-maintenance period + core port → abnormality".

[0091] The self-attention mechanism will find that the "similarity score" of these two pieces of information is very high (because the scene and rules are highly matched) → assign a high weight (such as 0.6); Although the "intranet office IP" is weakly associated with the first two sections, it will also be assigned a low weight (for example, 0.2); other irrelevant locations will be assigned an extremely low weight (for example, 0.01).

[0092] 3. Weighted summation outputs the fusion vector

[0093] Use the "weight" of each position to do a weighted summation of the vectors at the corresponding position, and finally get a new vector that integrates all the information but highlights the key associations It can be simplified into the formula:

[0094]

[0095] Weight i is the attention weight of the i-th position;

[0096] Vector i is the original vector at the ith position (from the concatenated long vector).

[0097] Then, the new vector obtained based on the attention mechanism Calculate the current semantic vector Compared with IP_1 historical semantic vector The difference, for example, can be simplified to the formula:

[0098]

[0099] in, Similarly, the semantic coding model is used to convert the regular behavioral characteristics of IP_1 over the past period of time (such as the last 30 days or the historical stable period) into a vector.

[0100] Cosine similarity is used to calculate the similarity between two vectors in the direction. The mathematical formula is:

[0101]

[0102] is the vector dot product, which reflects the degree of numerical overlap between two vectors; This is the product of the vector modulus and length, used for normalization to eliminate the effects of vector length. It measures the semantic similarity between IP_1's current behavior and its historical behavior. A higher value indicates a more stable behavior pattern; a lower value indicates a higher likelihood of behavioral drift.

[0103] If the difference exceeds a certain threshold, it is determined to be semantic drift. For example, if the score is >0.6 (threshold), it is determined to be semantic drift.

[0104] 3. Output decision stage

[0105] The output decision can be simplified to the formula:

[0106]

[0107] The output space contains categories such as "normal", "semantic drift", and "high risk drift".

[0108] As an example, taking the nighttime access scenario of IP_1 as an example, the processing process includes:

[0109] 1. Input data:

[0110] Event: IP_1 accesses port 443 (core port) of server A at 23:00.

[0111] Context: Late at night, during a non-operation and maintenance window, IP_1 historically accessed the intranet service port (8080) during the day.

[0112] Rule: Non-operation and maintenance window + core port access → exception.

[0113] 2. Reasoning process:

[0114] IP_1 embedding vector Contains "Intranet IP" and "Daytime Office" tags;

[0115] Contextual Embedding Includes "Time = Late Night" and "Business Status = Non-Operation and Maintenance";

[0116] Rules The quantity code is "{non-operation and maintenance, core port}→abnormal".

[0117] Attention calculation:

[0118] The model uses multi-head attention to discover the strong correlation between "late night", "non-operation and maintenance" and "core port access", and generates a comprehensive semantic vector. The characteristic is "IP_1 performs high-risk operations at abnormal times."

[0119] For the daytime semantic vector of IP_1 (“office use”), calculate:

[0120] Drift_Score=0.8 (>0.6 threshold), semantic drift is determined.

[0121] Output: High risk drift.

[0122] Step 103: Based on the detection results, a structural reshaping operation is performed on the entity nodes in the knowledge graph to update the knowledge graph, where the structural reshaping includes entity node splitting, entity node fusion, entity node renaming, or semantic label updating.

[0123] When entity nodes exhibit multiple mutually exclusive behavior patterns due to semantic drift, splitting the entities can avoid semantic confusion and allow the knowledge graph to more accurately reflect the different behavior scenarios of the entities. This means splitting a semantically ambiguous entity into multiple entities with clear semantics and single behavior patterns, each carrying the semantics and relationships in a specific scenario.

[0124] For example, let's take IP_1 as an example. The original knowledge graph states that IP_1 is a physical node with a historical behavior of "accessing the business port (8080) during the day, belonging to an office IP address." The current semantic drift behavior is "accessing the core port (443) late at night, a suspected attack source." Based on the preset rule (accessing the core port during non-office hours) and SecLLM calculation, if Drift_Score > 0.6, semantic drift is determined.

[0125] Split operation:

[0126] Split into two entity nodes: "IP_1_day" and "IP_1_night".

[0127] "IP_1_day" retains the historical behavior semantics, and the association relationship is "daytime → access business port 8080 → office scene".

[0128] "IP_1_night" carries the current drift semantics, and the association relationship is "late night → access to core port 443 → suspected attack scenario."

[0129] After the split, the knowledge graph can clearly distinguish the behavior patterns of IP_1 in different time periods. When subsequently analyzing the "night attack risk", we can directly focus on "IP_1_night" to avoid interference from normal historical behavior.

[0130] If semantic analysis reveals that multiple entity nodes represent the same entity in different scenarios or stages, or have high semantic overlap, merging them can simplify the graph structure and strengthen semantic connections. For example, entities with different names but consistent behavior and semantics, or temporary nodes created by drifting the same entity, need to be merged back to the original entity and have their semantics updated.

[0131] For example, taking the user admin as an example, the original knowledge graph state: there is an admin entity (normal office semantics, associated with "daytime login → access to normal servers"), and due to semantic drift, a temporary node "admin_abnormal" (associated with "late night login → access to core computer rooms") is generated. SecLLM analysis shows that the abnormal behavior of "admin_abnormal" is a temporary drift of the admin entity, which is essentially different behavior of the same user. Subsequent verification confirmed that it was an operation and maintenance error (not a continuous attack).

[0132] Fusion Operation:

[0133] Merge "admin_abnormal" back into the "admin" entity.

[0134] Updated the semantic label of "admin" to add "Once accidentally accessed the core computer room late at night (not an attack)".

[0135] Adjust the association relationship, retain the edge "Late Night → Accessing the Core Computer Room (Single Misoperation)", and mark the risk level as "Low" (to distinguish it from real attack behavior).

[0136] After fusion, the knowledge graph avoids entity redundancy and can accurately record the complete behavior of the admin user. When subsequently analyzing user risks, the actual threat of the behavior can be reasonably assessed based on the updated semantic labels.

[0137] When the semantics of an entity change fundamentally due to drift, and the original name no longer accurately reflects the new semantics, renaming it to a name that aligns with the new semantics facilitates identification and analysis. After renaming, the entity's associations are retained, but the semantic labels are updated simultaneously.

[0138] For example, let's take Process X as an example. The original knowledge graph states: Process X entity, with a semantic label of "R&D test process (associated with R&D environment machines, low risk)." After rule matching (production environment operation ≠ historical R&D environment) and SecLLM calculation, semantic drift is determined, and the new semantics are "Unauthorized process in production environment (associated with production environment machines, high risk)."

[0139] Rename operation:

[0140] Rename "Process X" to "Process X_unauthorized".

[0141] Update the semantic label to "Unauthorized operation in the production environment, suspected violation / attack payload."

[0142] The original association relationship (for example, the running relationship with machine M) is retained, but the "unauthorized running" attribute is marked on the relationship edge.

[0143] After renaming, knowledge graph users can intuitively identify the risk nature of the process. When subsequently analyzing the security of the production environment, "Process X_unauthorized" can be quickly identified as a high-risk node, triggering further disposal procedures.

[0144] If the entity has not undergone structural changes such as splitting or fusion, but its semantics have changed due to drift, its semantic label can be directly updated to make the entity's semantic description match the current behavior and risk status without changing the entity structure.

[0145] For example, in the scenario where IP_1 is not split, the original knowledge graph state is: IP_1 entity, with the semantic label "Intranet office IP (associated with daytime access to business ports, low risk)." After detection and determination of semantic drift, the current behavior semantics is "Suspected nighttime attack source (associated with late-night access to core ports, high risk)." However, a comprehensive assessment indicates that this is a short-term anomaly, and no entity splitting is required.

[0146] Semantic label update operation:

[0147] In the semantic label of IP_1, "High-risk behavior at night: accessing core ports (23:00), Drift_Score = 0.85" is added.

[0148] The original "Intranet Office IP" label is retained, and the risk level is adjusted from "Low" to "Medium" (due to abnormal behavior).

[0149] In the association relationship, the "high-risk access" attribute is added to the edge of "late night → access core port 443".

[0150] After the update, the knowledge graph can reflect the semantic changes of IP_1 in real time. Subsequent graph-based risk analysis can quickly identify abnormal behaviors of the IP through semantic labels, while retaining historical normal semantics to facilitate tracing the evolution of behavior.

[0151] Step 104: Based on the updated knowledge graph, network risk prediction is performed using a graph neural network model.

[0152] In this embodiment, the graph neural network model is specifically the GraphSAGE (Graph Sample and Aggregate) model. The core advantage of GraphSAGE is its inductive learning approach, which allows it to generate embeddings (vector representations) for newly added or modified entities (such as the split IP_1_night) without retraining the entire model. Even if the knowledge graph structure changes (additions, deletions, or modifications), GraphSAGE does not need to recalculate the entire graph.

[0153] The essence of network risk prediction lies in exploring the relationship risks between entities (IP addresses, processes, users) and their associated nodes (access ports, time, and rules). The core logic of GraphSAGE is to aggregate neighbor information: by sampling an entity's neighbors (for example, the neighbors of IP_1_night are "late-night time nodes, 443 port nodes, and abnormal rule nodes"), the semantics of these neighbors are aggregated into the entity itself, accurately capturing the comprehensive characteristics of "entity + associated risk scenarios."

[0154] GraphSAGE operates in two steps: sampling neighbors (Sample) and aggregating features (Aggregate), corresponding to the "finding related scenarios + aggregating concurrent risks" phase of network risk analysis, as shown in the following table:

[0155]

[0156] For the target entity v (e.g. IP_1_night), the formula for GraphSAGE to calculate its embedding can be simplified as:

[0157]

[0158] in, Represents the target entity v, and the output embedding (risk feature vector) after calculation in the k-th layer of the GraphSAGE model. It can be understood that after the k-th layer of neighbor information aggregation, the semantics and risk attributes of entity v are encoded into a numerical vector.

[0159] Each layer This layer integrates more comprehensive information about neighboring nodes than the previous k-1 layers. For example, a k=1 layer only integrates direct neighbors (e.g., port 443 and the 23:00 time node directly associated with IP_1_night); a k=2 layer integrates "neighbors of neighbors" (e.g., the "core business system" associated with port 443 and the "historical attack period" associated with the 23:00 time node). The higher the number of layers, the richer the integrated association information, and the more comprehensive the portrayal of entity risk.

[0160] N(v) represents the neighbor nodes of entity v, which are all directly associated nodes of entity v in the knowledge graph. Examples include behavioral context nodes (e.g., port 443 accessed, time node 23:00); security rule nodes (e.g., rule R indicating "Accessing a core port during non-maintenance hours is an anomaly"); and other associated entities (e.g., a core business system server accessed by IP_1_night).

[0161] This represents the embedding (feature vector) of entity v's neighbor node u (e.g., port 443, time 23:00) at layer k-1 of the GraphSAGE model. This can be understood as the risk characteristics of neighbor node u itself, before entering layer k of aggregation. This allows entity v's embedding to indirectly incorporate information about "neighbors of neighbors" and even more distant connections, achieving "multi-hop risk aggregation" and more comprehensively capturing the associated risks of network entities.

[0162] AGGREGATE k , represents the aggregation function of the kth layer. At the kth layer of GraphSAGE, all neighbor nodes u of entity v are aggregated. Function to combine into a vector.

[0163] Common aggregate functions are:

[0164] Mean aggregation: average the embeddings of all neighbors (simple, suitable for preliminary aggregation);

[0165] LSTM aggregation: Uses a recurrent neural network to sequentially process neighbor embeddings, capturing temporal and logical associations between neighbors (suitable for scenarios with sequential relationships, such as "accessing a port first, then triggering a rule").

[0166] Pooling aggregation (max pooling / min pooling): Select the most extreme features (such as the maximum risk value) in the neighbor embedding and strengthen the key risks.

[0167] As an example, take the risk prediction after IP_1 split as an example,

[0168] 1. Status after knowledge graph update

[0169] Entity split: IP_1 → IP_1_day (normal working hours) + IP_1_night (abnormal working hours at night)

[0170] Relationships (list only the key relationship of IP_1_night):

[0171] IP_1_night → Time (23:00, label: High-frequency attack period)

[0172] IP_1_night → Port node (443, label: core high-risk port)

[0173] IP_1_night → Rule node (R: Accessing the core port during non-operation and maintenance period → Abnormal, label: High-risk rule)

[0174] 2. GraphSAGE prediction process

[0175] Step 1: Sampling neighbors (finding associated risk nodes)

[0176] For IP_1_night, sample first-order neighbors (directly associated nodes):

[0177] Time node (23:00): Feature vector h time =[1,0,1] (1 represents "high-frequency attack period")

[0178] Port node (443): feature vector h port =[1,1,0] (1 means "core high risk")

[0179] Rule node (R): feature vector h rule =[0,1,1] (1 means "high risk rule match")

[0180] Step 2: Aggregate neighbor features (generate entity risk vector)

[0181] Use the mean aggregation function (simplified example) to calculate the embedding of IP_1_night:

[0182]

[0183] Step 3: Risk prediction (comparison with thresholds or historical distributions)

[0184] Assume that historically, entities with a risk vector average value greater than 0.5 have a probability of being attacked within the next 72 hours greater than 80%. The vector for IP_1_night is [0.67, 0.67, 0.67], with all dimensions greater than 0.5. This predicts that this entity faces a high risk of attack within the next 72 hours.

[0185] Optionally, based on the intensity and type of entity semantic drift, the type and depth of sampled neighbor nodes are adaptively expanded. Specifically, when an entity node adds a new security rule-type neighbor node due to semantic drift, the associated historical violation record nodes and penalty level nodes of the security rule-type neighbor node are included in the indirect neighbor sampling range; when the semantic drift of the entity node manifests as risk concentration in the time dimension, the time series neighbor sampling depth is increased.

[0186] In some embodiments, when the risk attributes of entities in the knowledge graph change due to semantic drift, the neighbor sampling range of the Graph SAGE model is synchronously adjusted, and the type and depth of the sampled neighbor nodes are adaptively expanded according to the type and intensity of the entity semantic drift. Specifically, when the entity semantic drift manifests as a "security rule conflict" (for example, IP_1 accessing the core port at night triggers the "high-risk access during non-operation and maintenance period" rule) or "time dimension risk concentration" (for example, frequent abnormal access during a fixed late-night period), the sampling strategy expansion is automatically activated.

[0187] For rule-conflicting drift, if a new "security rule node" is detected as a neighbor (for example, Rule R: Non-O&M access core ports → Anomaly), the associated nodes of that rule node (such as "Rule R historical violation records" and "Rule R penalty levels") are included in the indirect neighbor sampling scope. For example, if IP_1_night triggers Rule R, the sampling scope is expanded from "Rule R" to "Rule R associated historical attack case nodes."

[0188] For time-dependent drift, if entity drift is detected as a "high-frequency anomaly within a fixed time period" (e.g., three consecutive days of late-night access), the time series neighbor depth is expanded from one hop (the current time node) to three hops (the current time node + the nodes of the same time period from the previous two days) to capture risk patterns in the time dimension. For example, if admin_night logs in late at night for consecutive days, the "Login Records from Yesterday at 23:00" and "Login Records from the Day Before Yesterday at 23:00" nodes are sampled to analyze the persistence of the behavior.

[0189] Optionally, the determination of the type of entity semantic drift includes: when the current behavior of the entity node triggers at least one preset security rule (e.g., accessing a core port during non-maintenance periods, or accessing a high-risk system from an office IP), recording a rule conflict count (Rule_Match_Count); calculating the cosine distance between the current semantic vector and the historical semantic vector using the SecLLM model; if the distance value is greater than a threshold (e.g., 0.5) and the rule conflict count is greater than a threshold (e.g., ≥1), determining it as rule conflict drift;

[0190] Analyze the time series distribution of entity node behavior and calculate the temporal concentration of historical and current temporal patterns. Combined with the offset of temporal features in the semantic vector, if the temporal concentration is lower than a preset threshold (e.g., 0.85) and the cosine distance of the semantic vector is greater than a threshold (e.g., 0.4), it is determined to be a temporal drift.

[0191] Here, temporal concentration is used to measure the regularity of behavior time. The closer the concentration value is to 1, the more concentrated (regular) the temporal pattern is; the closer it is to 0, the more dispersed (irregular) the pattern is. Specifically, a day is divided into 24 hours (or four time periods: 12:00-6:00 AM, 6:00-12:00 AM, 12:00-18:00 PM, and 18:00-24:00 PM), and the temporal distribution of the entity's historical and current behavior is calculated. For example, the historical distribution interval: For example, if the admin user logged in only on weekdays between 9:00 AM and 6:00 PM for the past six months, the interval length is 9 hours (9:00-18:00). The current distribution interval: If the user logged in between 11:00 PM and 1:00 AM for three consecutive Friday nights, the interval is expanded to 9:00-18:00 (original interval) + 11:00 PM and 1:00 AM (new interval), for a total length of 11 hours (9 hours + 2 hours). Concentration = historical distribution interval length / current distribution interval length. In this example, concentration = 9 / 11 is approximately equal to 0.82.

[0192] As mentioned above, the intensity of entity semantic drift can be determined based on the rule conflict count and / or the threshold of the cosine distance, which will not be repeated here.

[0193] Optionally, the results of the risk prediction are compared with the actual security logs, the deviation features of false positives or missed positives are extracted, and it is determined whether the deviation is related to semantic drift detection; in response to the deviation being related to semantic drift detection, the rule matching conditions of the semantic drift detection and / or the attention weights of the graph neural network model are adaptively adjusted, for example, the model's attention weights for features such as time patterns and rule conflicts are optimized; according to the adjusted detection logic, the entity semantic drift is re-identified, and the entity labels, splitting or fusion relationships in the knowledge graph are updated.

[0194] Specifically, when the risk prediction results output by the model deviate from the actual security log (for example, falsely reporting "normal behavior as attack" or missing reporting "attack behavior as normal"), the deviation features are extracted, such as:

[0195] False positive scenario: For example, IP_1_night is predicted as high risk, but is actually an operation and maintenance operation;

[0196] Missing report scenario: For example, the abnormal login of admin_night is not identified as drift.

[0197] Analyze whether the root cause of the deviation is related to semantic drift detection:

[0198] If the false positive is due to a too low rule threshold (for example, the non-operation and maintenance period is too wide), adjust the rule matching conditions for semantic drift detection;

[0199] If the missed detection is due to the deep semantic model not capturing the temporal pattern changes, the temporal feature embedding weights of SecLLM are optimized.

[0200] Specifically, if the deviation manifests as a misjudgment of the entity's semantic role (for example, misjudging a "nighttime operation and maintenance IP address" as an "attack source") or a "behavioral pattern omission" (for example, failing to identify the drift of "periodic late-night logins"), it is related to semantic drift detection. Check whether the deviation occurred during the semantic drift detection phase (rule matching or deep semantic model failure). For example, if the abnormal login of admin_night is not recognized, it is necessary to confirm whether it is because the rule does not cover the "nighttime core computer room access" scenario, or SecLLM does not capture the change in time pattern. In addition, the drift detection consistency of similar entities can be analyzed. If the nighttime behavior of multiple IP addresses is misjudged, it may be due to the time feature weight setting of the detection model.

[0201] As an example, adaptive adjustment of rule matching can be the adjustment of rule thresholds. For example, when there are multiple false alarms of "legitimate operation and maintenance operations between 22:00 and 23:00", the threshold of "non-operation and maintenance period" is adjusted from "22:00-6:00" to "23:00-5:00" to reduce semantic drift misjudgments.

[0202] Model weight optimization can be achieved by enhancing SecLLM's attention weights on time patterns such as "consecutive late-night logins on Fridays" through gradient backpropagation.

[0203] Specifically, in the SecLLM model, the embedding vector of the input token (e.g., "Friday", "late night", "continuous") corresponding to the time pattern (e.g., "continuous Friday night") is set as a trainable parameter. For example, the word embedding vector of "Friday" is "late at night" The mark is the key feature of the time pattern; at the same time, the loss term containing the time pattern feature is constructed and simplified into the formula, L time =α×(1-attention_weight time ); where attention_weight time is the model's attention weight for the temporal pattern tagen, α is the weight coefficient (e.g. 0.8), and the loss function L is calculated. time The gradient of the temporal pattern token embedding vector can be simplified to the formula:

[0204]

[0205] Update the embedding vector by backpropagation so that attention_weight time For example, the attention weight of “Friday” and “late night” increases from 0.2 to 0.6. When processing the sentence “consecutive Friday late night logins”, SecLLM automatically assigns higher weights to time-related tokens, improving the semantic representation ability of time patterns.

[0206] like Figure 3 As shown, an embodiment of the present invention provides a dynamic network risk prediction system driven by a knowledge graph, including:

[0207] The first construction module 301 is used to obtain original network security event data and its context information and construct an initial knowledge graph, which is composed of entity nodes, edges and attribute labels;

[0208] A first detection module 302 is configured to obtain contextual features of the current behavior of the entity node and the historical behavior pattern of the entity node, and detect whether there is semantic drift in the entity node through preset rule matching and / or deep semantic modeling;

[0209] A reconstruction module 303 is configured to perform a structural reshaping operation on the entity nodes in the knowledge graph based on the detection results to update the knowledge graph, wherein the structural reshaping includes entity node splitting, entity node fusion, entity node renaming, or semantic label updating;

[0210] The prediction module 304 is used to predict network risks based on the updated knowledge graph through a graph neural network model.

[0211] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, including a processor and a memory, wherein the memory stores program instructions, and the processor runs the program instructions to implement the dynamic network risk prediction method driven by knowledge graph as described in any of the above items.

[0212] Another embodiment of the present application further provides a computer-readable storage medium having computer program instructions stored thereon, which can be executed by a processor to implement the methods and / or technical solutions of any one or more embodiments of the present application.

[0213] In particular, the methods and / or embodiments of the present application can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for executing the method shown in the flowchart. When the computer program is executed by a processor, the above-mentioned functions defined in the method of the present application are performed.

[0214] It should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each implementation method can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0215] The series of detailed descriptions listed above are only specific descriptions of feasible implementation methods of the present invention. They are not intended to limit the scope of protection of the present invention. Any equivalent implementation methods or changes that do not deviate from the technical spirit of the present invention should be included in the scope of protection of the present invention.

Claims

1. A dynamic network risk prediction method based on knowledge graph driving, characterized by: The following steps are involved: Obtaining original cybersecurity event data and its contextual environment information, and constructing an initial knowledge graph consisting of entity nodes, edges, and attribute labels; Obtaining contextual features of the current behavior of the entity node and the historical behavior pattern of the entity node, and detecting whether there is semantic drift of the entity node through preset rule matching and / or deep semantic model; Based on the detection results, a structural reshaping operation is performed on the entity nodes in the knowledge graph to update the knowledge graph, wherein the structural reshaping includes entity node splitting, entity node fusion, entity node renaming or semantic label updating; Based on the updated knowledge graph, network risk prediction is performed through the graph neural network model.

2. The knowledge graph-driven dynamic network risk prediction method according to claim 1 is characterized in that: include: Through preset rule matching and / or deep semantic model, it is determined whether the entity node has semantic drift. Specifically, preset rule matching is adopted in the first type of scenario, and deep semantic model or preset rule matching combined with deep semantic model is adopted in the second type of scenario; wherein the first type of scenario includes scenarios where the entity behavior directly conflicts with the preset security rules, scenarios that require rapid response, or scenarios with simple and clear semantic logic; the second type of scenario includes scenarios with complex contextual semantic logic, unknown or new drift pattern detection scenarios, or semantic fuzzy and ambiguous scenarios.

3. The knowledge graph-driven dynamic network risk prediction method according to claim 1 is characterized in that: include: The structural reshaping includes entity node splitting, entity node fusion, entity node renaming or semantic label updating. Specifically, when an entity node has semantic drift and multiple mutually exclusive behaviors appear, the entity node is split into multiple nodes, and the association relationship is updated based on the current behavior; when an entity node has semantic drift and generates temporary nodes, it is merged back to the original entity and the semantics is updated; when an entity node has semantic drift and its semantics undergoes fundamental changes, the entity node is renamed, the association relationship is retained, and the semantic label is updated synchronously; when an entity node has semantic drift but there is no need to split, fuse or rename the entity node, its semantic label is directly updated.

4. The knowledge graph-driven dynamic network risk prediction method according to claim 1 is characterized in that: include: The network risk prediction using a graph neural network model includes sampling and feature aggregation of entity nodes and their neighbor nodes in the updated knowledge graph, wherein the sampling specifically includes obtaining direct neighbor nodes and indirect neighbor nodes of the target entity node, and the neighbor nodes include at least behavior context nodes, security rule nodes, and time attribute nodes; the feature aggregation includes aggregating the risk feature vectors of the neighbor nodes to the target entity node through an aggregation function to generate a comprehensive risk feature vector of the target entity node; and predicting the network risk corresponding to the target entity node based on the comprehensive risk feature vector of the target entity node and the historical risk threshold or historical risk distribution.

5. The knowledge graph-driven dynamic network risk prediction method according to claim 4 is characterized in that: include: Based on the intensity and type of entity semantic drift, the type and depth of sampled neighbor nodes are adaptively expanded. Specifically, when an entity node adds a new security rule neighbor node due to semantic drift, the associated historical violation record nodes and penalty level nodes of the security rule neighbor node are included in the indirect neighbor sampling range; when the semantic drift of the entity node manifests as risk concentration in the time dimension, the time series neighbor sampling depth is increased.

6. The knowledge graph-driven dynamic network risk prediction method according to claim 3 is characterized in that: include: Comparing the risk prediction results with the actual security logs, extracting deviation features of false positives or false negatives, and determining whether the deviations are related to semantic drift detection; In response to the deviation being associated with semantic drift detection, adaptively adjusting a rule matching condition for semantic drift detection and / or optimizing an attention weight of the graph neural network model; Based on the adaptive adjustment, entity semantic drift is re-detected and the knowledge graph is re-updated.

7. A knowledge graph-driven dynamic network risk prediction system, characterized by: include: The first construction module is used to obtain the original network security event data and its contextual environment information and construct an initial knowledge graph, which is composed of entity nodes, edges and attribute labels; A first detection module is configured to obtain contextual features of the current behavior of the entity node and the historical behavior pattern of the entity node, and detect whether there is semantic drift in the entity node through preset rule matching and / or deep semantic modeling; A reconstruction module is used to perform a structural reshaping operation on the entity nodes in the knowledge graph based on the detection results to update the knowledge graph, wherein the structural reshaping includes entity node splitting, entity node fusion, entity node renaming or semantic label updating; The prediction module is used to predict network risks through a graph neural network model based on the updated knowledge graph.

8. An electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, wherein the instructions are executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 6.

9. A computer-readable medium having computer program instructions stored thereon, characterized in that: The computer program instructions can be executed by a processor to implement the method according to any one of claims 1 to 5.

10. A computer program product comprising a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images