Network security knowledge graph embedding method and device based on mixed space

Abstract

The invention discloses a network security knowledge graph embedding method and device based on a mixed space, and the method comprises the following steps: S1, mapping entities and relationships of a network security knowledge graph into a hyperbolic space and a hyperspherical space at the same time; s2, respectively mapping points in the hyperbolic space and points in the hyperspherical space to a tangent space through logarithm mapping, and mapping vectors in the tangent space back to corresponding geometric spaces through exponential mapping; s3, the hyperbolic space embedding and the hyperspherical space embedding are switched to a tangent space through logarithmic mapping, the geometric information embedded in the tangent space and the geometric information in the Euclidean space are fused, and the fused geometric information is returned to a target geometric space through exponential mapping; and S4, carrying out weighted fusion on the geometric information in different geometric spaces by using an attention mechanism. According to the method, the capability of capturing complex relations and multi-layer structures of the atlas is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of knowledge graph embedding technology, and in particular to a network security knowledge graph embedding method and device based on hybrid space. Background Art

[0002] With the rapid development of network technology, cybersecurity threats are becoming increasingly diverse, complex, and dynamic. Due to the highly dynamic and complex nature of cybersecurity threats, attack paths are also complex to construct. Traditional security defense systems primarily rely on rule matching and static feature detection. Traditional threat assessment and anomaly detection methods based on static feature classification are unable to meet current needs and effectively respond to new attack methods. Therefore, it is necessary to introduce a complex cybersecurity knowledge graph to comprehensively identify risks and attack paths.

[0003] In recent years, knowledge graphs have been widely used in the field of cybersecurity due to their powerful ability to organize structured information. Traditional knowledge graph embedding methods can be roughly divided into three categories: matrix factorization-based methods, random walk-based methods, and neural network-based methods. These methods often suffer from embedding distortion or reduced representation efficiency, making them unable to efficiently and accurately represent complex and multidimensional cybersecurity knowledge graphs, resulting in insufficient accuracy and robustness in threat analysis. Against this backdrop, a hybrid space embedding fusion method is proposed to enhance the expressive power and accuracy of cybersecurity knowledge graphs, thereby improving the accuracy of threat analysis. Summary of the Invention

[0004] In view of this, it is necessary to provide a network security knowledge graph embedding method and device based on hybrid space to effectively solve the technical problems of weak expression ability and accuracy of network security knowledge graph embedding.

[0005] The present invention provides a network security knowledge graph embedding method based on hybrid space, comprising the following steps: Step S1: Map the entities and relationships of the network security knowledge graph to the hyperbolic space and the hyperspherical space simultaneously to generate hyperbolic space embedding and hyperspherical space embedding; Step S2: Mapping the points in the hyperbolic space and the points in the hyperspherical space to the tangent space respectively through logarithmic mapping, and mapping the vectors in the tangent space back to the corresponding geometric space through exponential mapping, thereby realizing information propagation in the geometric space; Step S3: Switching the hyperbolic space embedding and the hyperspherical space embedding to the tangent space respectively through logarithmic mapping, fusing the geometric information embedded in the tangent space with the geometric information in the Euclidean space, and returning the fused geometric information to the target geometric space through exponential mapping; Step S4: Use the attention mechanism to perform weighted fusion of geometric information in different geometric spaces to embed the network security knowledge graph.

[0006] Preferably, the step S1 is specifically as follows: Obtaining triples of network security knowledge graph , the triplet includes the head entity node , tail entity node and relationship nodes , from the input triples, the relationship between entities is modeled through geometric transformation, and a hybrid space embedding is generated for the head entity node and the tail entity node of the network security knowledge graph, and the hybrid space embedding includes hyperbolic space embedding and hyperspherical space embedding.

[0007] Preferably, in step S2, the points in the hyperbolic space and the points in the hyperspherical space are respectively mapped to the tangent space by logarithmic mapping, specifically: in, Indicates that the points on the embedding space By logarithmic mapping, it is projected onto the In the tangent space, is the curvature factor of the current geometric space, 、 is a point in the embedded space, that is, a point in the hyperbolic space or the hyperspherical space, For a given point in the embedding space, , is the point set in the embedding space, represents Möbius addition.

[0008] Preferably, in step S2, the vector in the tangent space is mapped back to the corresponding geometric space by exponential mapping, specifically: in, Represents the vector in the tangent space Projected onto the curvature by exponential mapping The hypersphere space or curvature is On the hyperbolic space, is the vector in the tangent space, is a point in the corresponding target geometric space, that is, a point in the hyperbolic space or the hyperspherical space, represents the Möbius addition, is the curvature factor of the target geometric space.

[0009] Preferably, the vector addition adopted by the exponential mapping and the logarithmic mapping is Möbius addition, and the Möbius addition is specifically: in, 、 is a point in geometric space, represents the Möbius addition, for 、 The inner product of is the curvature value of the projected target geometric space.

[0010] Preferably, in step S3, the geometric information embedded in the tangent space is fused with the geometric information in the Euclidean space, specifically: in, 、 are the geometric information in tangent space and the geometric information in Euclidean space respectively, Represents the fused geometric information, 、 To control the attention factor of information dissemination, is the geometric information of the Euclidean space in the tangent space, It is the result of converting geometric space information into tangent space through logarithmic mapping.

[0011] Preferably, the step S4 is specifically as follows: The attention vector obtained through training assigns corresponding weights to each geometric space based on the geometric distance; the weighted sum of the embeddings of each geometric space is calculated, and the training activation is performed through a nonlinear activation function.

[0012] Preferably, the weighted sum of the embeddings of each geometric space is calculated, specifically: The embedding of the head entity node is weighted fused in each geometric space: in, represents the weighted fusion result of head entity, 、 They are the head entity embedding in hyperbolic space and the head entity embedding in hyperspherical space, It means that the vector in the tangent space is projected onto the curvature by exponential mapping. In the new mapping space, Indicates that the points on the Euclidean space are projected onto the curvature by logarithmic mapping. In the new mapping space, It means that the points on the hypersphere space will be projected onto the curvature of In the new mapping space, is the attention vector in the hypersphere space; The embedding of the tail entity node is weighted fused in each geometric space: in, represents the weighted fusion result of the tail entity, is the tail entity embedding in hyperbolic space, is the tail entity embedding of the hypersphere space, It means that the vector in the tangent space is projected onto the curvature by exponential mapping. In the new mapping space, Indicates that the points on the Euclidean space are projected onto the curvature by logarithmic mapping. In the new mapping space, It means that the points on the hypersphere space will be projected onto the curvature of In the new mapping space, is the attention weight of the tail entity in the hyperbolic space, is the attention weight of the tail entity in the hypersphere space.

[0013] The present invention also provides a network security knowledge graph embedding device based on a hybrid space, comprising a memory and a processor, wherein a computer program is stored on the memory, and when the computer program is executed by the processor, the network security knowledge graph embedding method based on a hybrid space is implemented.

[0014] Compared with the existing technology, the present invention has the following beneficial effects: traditional network security knowledge graph embedding methods are mainly based on Euclidean space or hyperbolic space. Although these methods can better represent simple chain relationships and tree structures, they show certain limitations when processing network security data with cycles and complex dependencies. In order to meet this challenge, the hybrid space embedding fusion method proposed in the present invention not only integrates the embedding of hyperbolic space and hyperspherical space, but also introduces the cross-space propagation of geometric information, and adaptively optimizes the geometric characteristics of each space through the attention mechanism to improve the quality of network security embedding representation and the reasoning ability of the system, and significantly enhances the ability of knowledge graphs in capturing complex relationships and multi-level structures. The present invention solves the challenges faced by traditional embedding models when processing complex network security data, especially when facing hierarchical and ring-structured attack paths, and provides more accurate network security threat predictions. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings: FIG1 is a flow chart of an embodiment of a hybrid space-based network security knowledge graph embedding method provided by the present invention; Figure 2 yes Figure 1 In the embodiment shown, the hybrid space is entirely embedded in a framework diagram of an embodiment; Figure 3 yes Figure 1 A schematic representation of an embodiment of a hyperbolic embedding and a hyperspherical embedding in the embodiment shown; Figure 4 yes Figure 1 The scatter plot of the embedding matrix of an embodiment of hybrid spatial embedding in the illustrated embodiment; Figure 5 This is a schematic diagram of traditional single space embedding. DETAILED DESCRIPTION

[0016] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, and are not used to limit the scope of the present invention.

[0017] Example 1 See also Figure 1 In this embodiment, a network security knowledge graph embedding method based on a hybrid space specifically includes the following steps: Step S1: Map the entities and relationships of the network security knowledge graph to the hyperbolic space and the hyperspherical space simultaneously to generate hyperbolic space embedding and hyperspherical space embedding; Step S2: Mapping the points in the hyperbolic space and the points in the hyperspherical space to the tangent space respectively through logarithmic mapping, and mapping the vectors in the tangent space back to the corresponding geometric space through exponential mapping, thereby realizing information propagation in the geometric space; Step S3: Switching the hyperbolic space embedding and the hyperspherical space embedding to the tangent space respectively through logarithmic mapping, fusing the geometric information embedded in the tangent space with the geometric information in the Euclidean space, and returning the fused geometric information to the target geometric space through exponential mapping; Step S4: Use the attention mechanism to perform weighted fusion of geometric information in different geometric spaces to embed the network security knowledge graph.

[0018] To enrich the information representing network security attack paths and better enhance the expressiveness and accuracy of network security knowledge graphs, this embodiment provides an innovative hybrid space embedding and fusion method. This method embeds network entities into multiple geometric spaces, including hyperbolic space and hyperspherical space, and combines geometric information propagation and fusion to significantly enhance the graph's ability to capture complex relationships and multi-layered structures. This embodiment aims to address the challenges faced by traditional embedding models when processing complex network security data, particularly when faced with hierarchical and cyclic attack paths, providing more accurate network security threat predictions. Traditional network security knowledge graph embedding methods are mainly based on Euclidean space or hyperbolic space. While these methods can well represent simple chain relationships and tree structures, they exhibit certain limitations when processing network security data with loops and complex dependencies. To address this challenge, the hybrid space embedding and fusion method proposed in this embodiment not only combines the embedding of hyperbolic space and hyperspherical space, but also introduces cross-space propagation of geometric information. Through the attention mechanism, it adaptively optimizes the geometric characteristics of each space to improve the quality of network security embedding representations and the system's reasoning capabilities.

[0019] Traditional single-space embeddings such as Figure 5 As shown in the figure, the knowledge graph information graph is directly embedded into the hyperbolic space through the spatial embedding method. In order to accurately extract the structural information of the graph in the complex layer of network security knowledge graph, this embodiment proposes a method based on hybrid space embedding. The overall embedding framework of this embodiment is shown in the figure. Figure 2 As shown in the figure, a cybersecurity knowledge graph is specified, and given a cybersecurity knowledge graph triple, spatial embeddings are generated for entities in the knowledge graph from the input triples, including embeddings in Euclidean hyperbolic space and embeddings in hyperspherical space; then, the embeddings in hyperbolic space and embeddings in hyperspherical space are mapped from hyperbolic space and hyperspherical space to tangent space respectively through logarithmic mapping, and the propagation of geometric information is promoted through logarithmic mapping. The vectors in tangent space are then mapped back to geometric space through exponential function, and the consistency of information propagation and space is guaranteed by exponential function; then, through logarithmic mapping, the model can interact the information in hyperbolic space and hypersphere; finally, in order to better integrate different spatial structure information, it is necessary to use attention mechanism to make the geometric information of Euclidean space and tangent space interact, capture the characteristics of different spaces, and adaptively form a reliable spatial structure through interactive geometric information.

[0020] Furthermore, the step S1 is specifically as follows: Obtaining triples of network security knowledge graph , the triplet includes the head entity node , tail entity node and relationship nodes , from the input triples, the relationship between entities is modeled through geometric transformation, and a hybrid space embedding is generated for the head entity node and the tail entity node of the network security knowledge graph, and the hybrid space embedding includes hyperbolic space embedding and hyperspherical space embedding.

[0021] In the knowledge graph embedding task, entities and relationships are usually represented by vectors, and the learning of these vectors depends on the existing links in the graph. Specifically, the embedding method attempts to map the entities and relationships in the graph into a low-dimensional space, and use these embeddings to predict new links, thereby completing the graph. However, traditional knowledge graph embedding methods mostly rely on a single geometric space. Although this method can handle some simple relational structures, it has certain limitations when facing complex fields with multiple geometric characteristics, such as network security. To this end, this embodiment simultaneously projects and maps the entities and relationships of the knowledge graph into two geometric spaces, so that the geometric information can be subsequently transferred through exponential mapping and logarithmic mapping.

[0022] This embodiment adopts the geometric interactive knowledge graph embedding method to perform spatial modeling. This method models the relationship between entities through geometric transformation, and concentrates the rigid transformation in n-dimensional space, including translation, rotation and other operations, into a special Euclidean group. In the system, the geometric transformations in space can be modeled more extensively, especially when complex spatial structures need to be processed in network security, this group can provide more degrees of freedom. Through these geometric groups, the model can accurately capture and model transformations in space, such as reflection, flipping, translation, rotation, and homogeneous transformations. These geometric transformations provide powerful expression capabilities for attack patterns and threat paths in the field of network security. Hyperbolic space is suitable for modeling hierarchical relationships. For example, the hierarchical relationship between attack methods and attack technologies. Hypersphere space is suitable for modeling cyclic structures, such as the representation of multiple cyclic dependencies in an attack path. The schematic diagram of hyperbolic and hypersphere embedding representation is shown below. Figure 3 As shown, Figure 3 The left side is a hyperspherical embedding, and the right side is a hyperbolic embedding.

[0023] Specifically, the geometric interactive knowledge graph embedding method is: given a network security graph triple , from the input triples, for entities in the knowledge graph and Generate spatial embeddings, including embeddings in Euclidean hyperbolic space and embedding in hypersphere space , then and The hyperbolic space and the hyperspherical space are mapped to the tangent space respectively to generate a hybrid space embedding, which promotes the propagation of geometric information through logarithmic mapping.

[0024] Furthermore, in step S2, the points in the hyperbolic space and the points in the hyperspherical space are respectively mapped to the tangent space by logarithmic mapping, specifically: in, Indicates that the points on the embedding space By logarithmic mapping, it is projected onto the In the tangent space, is the curvature factor of the current geometric space, 、 is a point in the embedded space, that is, a point in the hyperbolic space or the hyperspherical space, For a given point in the embedding space, , is the point set in the embedding space, represents Möbius addition.

[0025] In the process of embedding knowledge graphs in the cybersecurity field, it is crucial to handle information propagation in multiple geometric spaces. Different geometric spaces, such as Euclidean space, hyperbolic space, and hyperspherical space, have their own unique spatial properties and measurement methods. To achieve effective information propagation between these geometric spaces, this embodiment utilizes geometric information propagation techniques. These techniques are based on mapping operations between different spaces, particularly through the combination of logarithmic and exponential mappings, enabling efficient interaction and fusion of information across these spaces.

[0026] The fundamental difference between hyperbolic space and hyperspherical space lies in their spatial curvature. Hyperbolic space has negative curvature, while hyperspherical space has positive curvature. This difference in curvature determines their geometric structure and affects how information propagates. Due to its negative curvature, hyperbolic space is well-suited for modeling hierarchical structures or relationships with extensive branches, such as the multi-level relationships in attack patterns and attack paths. Meanwhile, hyperspherical space, with its positive curvature, excels at representing periodic or ring-like structures, making it suitable for capturing cyclic or repetitive patterns in attack behavior.

[0027] In hybrid space embedding, information propagation mainly relies on exponential mapping and logarithmic mapping. These two mappings are the basis for effective information transmission between geometric spaces. They can ensure that the geometric structures of different spaces are effectively integrated.

[0028] Logarithmic mapping: Mapping a point in a geometric space from that space to a tangent space. Taking hyperbolic space as an example, given a point in hyperbolic space , whose logarithmic mapping transforms to the tangent space The formula is: here, express, 、 is a point in the current geometric space, that is, a point in the hyperbolic space or the hyperspherical space, is a given point in the current geometric space, , is the point set in the current space, for, represents the Möbius addition, is the curvature factor of the current geometric space.

[0029] The role of the logarithmic mapping is to transform points in the geometric space into vectors in the tangent space, so that the model can perform further geometric operations in the tangent space.

[0030] Furthermore, in step S2, the vector in the tangent space is mapped back to the corresponding geometric space through exponential mapping, specifically: in, Represents the vector in the tangent space Projected onto the curvature by exponential mapping The hypersphere space or curvature is On the hyperbolic space, is the vector in the tangent space, is a point in the corresponding target geometric space, that is, a point in the hyperbolic space or the hyperspherical space, represents the Möbius addition, is the curvature factor of the target geometric space.

[0031] The exponential map is the inverse operation of the logarithmic map, which maps the vector in the tangent space back to the geometric space. The formula is as follows: This formula converts the vector in the tangent space Mapping back to the point in hyperbolic space, and using the exponential function to ensure that the propagation of information remains consistent with the space.

[0032] Furthermore, the vector addition used in the exponential mapping and the logarithmic mapping is Möbius addition, and the Möbius addition is specifically: in, 、 is a point in geometric space, represents the Möbius addition, for 、 The inner product of is the curvature value of the projected target geometric space.

[0033] Traditional vector addition methods are inapplicable in hyperbolic and hyperspherical spaces. Due to their non-Euclidean geometry, their addition requires the use of Möbius addition. Möbius addition is a geometric addition method defined in hyperbolic and hyperspherical spaces that accounts for the effects of spatial curvature.

[0034] The formula for Möbius addition is as follows: here, 、 is a point in geometric space, represents the Möbius addition, for 、 The inner product of for.

[0035] In this way, Möbius addition effectively handles the curvature characteristics of space, ensuring that addition operations can be performed correctly in hyperbolic space or hyperspherical space.

[0036] In the model, the use of Möbius addition allows for the fusion and propagation of information between different geometric spaces. For example, the addition operation between an entity in hyperbolic space and an entity in hyperspherical space is performed using Möbius addition, which fully accounts for the impact of the curvature of non-Euclidean space on information propagation.

[0037] Furthermore, in step S3, the geometric information embedded in the tangent space is fused with the geometric information in the Euclidean space, specifically: in, 、 are the geometric information in tangent space and the geometric information in Euclidean space respectively, Represents the fused geometric information, 、 To control the attention factor of information dissemination, is the geometric information of the Euclidean space in the tangent space, It is the result of converting geometric space information into tangent space through logarithmic mapping.

[0038] Through logarithmic mapping, the model can interact the information in the hyperbolic space and the hypersphere. Specifically, assuming that there is an embedding in the hypersphere and embedding in hyperbolic space The model transforms the embedded information in the hyperbolic space into the tangent space through logarithmic mapping, and then fuses it with the information in the Euclidean space. The fused information is returned to the target geometric space through exponential mapping. The specific mathematical formula is as follows: in, 、 is the attention factor that controls the spread of information, This is the result of transforming hyperbolic space information into tangent space through logarithmic mapping. Through this interaction, the model can ensure that the embedded information of different geometric spaces is effectively propagated in the same model.

[0039] Möbius addition and exponential logarithmic mapping are excellent implementations of geometric information propagation mechanisms, enabling the model to efficiently transfer and fuse information between different geometric spaces, such as hyperbolic and hyperspherical spaces. This approach not only makes hybrid space embedding more flexible but also adapts to various relational structures within complex network security graphs, such as hierarchical and cyclic structures, significantly improving the accuracy and robustness of network security threat prediction.

[0040] Furthermore, the step S4 is specifically as follows: The attention vector obtained through training assigns corresponding weights to each geometric space based on the geometric distance; the weighted sum of the embeddings of each geometric space is calculated, and the training activation is performed through a nonlinear activation function.

[0041] Furthermore, the weighted sum of the embeddings of each geometric space is calculated, specifically: The embedding of the head entity node is weighted fused in each geometric space: in, represents the weighted fusion result of head entity, 、 They are the head entity embedding in hyperbolic space and the head entity embedding in hyperspherical space, It means that the vector in the tangent space is projected onto the curvature by exponential mapping. In the new mapping space, Indicates that the points on the Euclidean space are projected onto the curvature by logarithmic mapping. In the new mapping space, It means that the points on the hypersphere space will be projected onto the curvature of In the new mapping space, is the attention vector in the hypersphere space; The embedding of the tail entity node is weighted fused in each geometric space: in, represents the weighted fusion result of the tail entity, is the tail entity embedding in hyperbolic space, is the tail entity embedding of the hypersphere space, It means that the vector in the tangent space is projected onto the curvature by exponential mapping. In the new mapping space, Indicates that the points on the Euclidean space are projected onto the curvature by logarithmic mapping. In the new mapping space, It means that the points on the hypersphere space will be projected onto the curvature of In the new mapping space, is the attention weight of the tail entity in the hyperbolic space, is the attention weight of the tail entity in the hypersphere space.

[0042] To further improve the performance of the hybrid space embedding model, this embodiment introduces an attention mechanism based on the propagation of geometric information. The core function of the attention mechanism is to adaptively assign a weight to each space based on the geometric characteristics of different spaces to enhance the focus on key spatial information. The specific process is as follows: Adaptive weight allocation: In hybrid space geometric embedding, the information contained in the embedding representations in hyperbolic space and hyperspherical space has different importance. In order to enhance the expressiveness of the model, this paper introduces an adaptive weight allocation mechanism based on geometric distance to ensure that important geometric information can occupy a larger proportion in the fusion process. The attention vector obtained through training, such as and , the model can automatically adjust the influence of different spatial embeddings so that the fused representation is more in line with task requirements.

[0043] Fusion of geometric information from different spaces: During the information fusion phase, the model combines the geometric information of each space by calculating the weighted sum of the embeddings in each space. Specifically, the embeddings of the head entity and the tail entity are weighted and fused in their respective geometric spaces, and the representation power of the fusion is further improved through a nonlinear activation function. The formula is as follows: Embedding fusion of tail entities: Similar to the processing of head entities, the embedding of tail entities also undergoes transformation and weighted fusion in Euclidean space, hyperbolic space, and hyperspherical space. The embedding fusion formula of tail entities is as follows: in, represents the weighted fusion result of the tail entity, is the tail entity embedding in hyperbolic space, is the tail entity embedding of the hypersphere space, express, express, express, is the attention weight of the tail entity in the hyperbolic space, is the attention weight of the tail entity in the hypersphere space.

[0044] By introducing the attention mechanism, this embodiment can more flexibly learn important features in each geometric space, thereby retaining more useful geometric information in the embedded representation of the knowledge graph, further improving the performance of the system in network security tasks.

[0045] Compared to existing technologies, this embodiment improves prediction accuracy: It employs a knowledge graph construction method based on multi-space embedding fusion, combining hyperbolic and hyperspherical spaces. Compared to traditional single-space embedding methods, this method can more comprehensively capture the complex entity and relationship information in the cybersecurity knowledge graph. In multi-dimensional and multi-level cybersecurity threat prediction tasks, it can fully leverage the advantages of different spaces for different structural relationships, achieving higher accuracy and more precise prediction of attack paths, providing a powerful basis for proactively preventing cybersecurity threats.

[0046] Enhanced overall robustness: Faced with complex, hierarchical attack patterns and attack paths, traditional methods are often limited to modeling a single geometric space, and are prone to performance degradation when dealing with such complex structures. However, this embodiment fuses multiple spatial embeddings and introduces an attention mechanism to optimize the fusion learning of different spatial embeddings. This enables the model to exhibit greater stability and adaptability when dealing with diverse network security scenarios, resulting in greater robustness and less susceptible to large performance fluctuations caused by complex structures and changing attack patterns.

[0047] Optimize representation capabilities: Existing network security knowledge graphs have limitations in expressing multi-relational data, and it is difficult to take into account hierarchical, cyclical, and high-dimensional relational structures. The method proposed in this invention uses different geometric spaces to model appropriate relationship types, such as hyperbolic space to process hierarchical relationships and hyperspherical space to process cyclical structure relationships, thereby effectively improving the representation capabilities of network security knowledge graphs under multi-level attack modes and complex relational structures, allowing knowledge graphs to more completely and accurately reflect various entities and relationships in the field of network security. Print and process the specific embedded scatter matrix diagram, such as Figure 4 As shown, Figure 4 It can be seen from the figure that after mixed embedding, the distribution of the matrix can show obvious regional stratification.

[0048] Improved real-time update capabilities: Considering the ever-changing strategies and techniques of attackers in the cybersecurity field, and the difficulty in capturing the dynamic evolution of attack patterns, this embodiment designs a dynamic update mechanism based on geometric information interaction. Through this mechanism, the knowledge graph can promptly reflect the latest threat intelligence and remain relevant to the current cybersecurity situation. This solves the problem of existing knowledge graphs being unable to update in a timely manner when faced with dynamic threat intelligence, further enhancing the graph's real-time update capabilities for dynamic threat intelligence, ensuring that the defense system can make timely adjustments based on the latest developments.

[0049] Providing a Better Defense Strategy: By leveraging the advantages outlined above, this embodiment provides more efficient and precise support for network security defense systems. Not only can it more accurately detect potential threats, but it can also develop more advanced and realistic real-time network security defense strategies based on real-time intelligence updates and precise attack path predictions. Compared to traditional methods, this significantly improves overall network security defense effectiveness, enabling better responses to the increasingly complex and volatile network security environment.

[0050] Example 2 This embodiment provides a network security knowledge graph embedding device based on a hybrid space, including a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, it implements the network security knowledge graph embedding method based on a hybrid space described in Example 1.

[0051] The network security knowledge graph embedding device based on hybrid space provided in this embodiment is used to implement the network security knowledge graph embedding method based on hybrid space. Therefore, the technical effects possessed by the network security knowledge graph embedding method based on hybrid space are also possessed by the network security knowledge graph embedding device based on hybrid space, which will not be repeated here.

[0052] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed in the present invention should be covered by the present invention.

Claims

1. A network security knowledge graph embedding method based on hybrid space, characterized by: The following steps are involved: Step S1: Map the entities and relationships of the network security knowledge graph to the hyperbolic space and the hyperspherical space simultaneously to generate hyperbolic space embedding and hyperspherical space embedding; Step S2: Mapping the points in the hyperbolic space and the points in the hyperspherical space to the tangent space respectively through logarithmic mapping, and mapping the vectors in the tangent space back to the corresponding geometric space through exponential mapping, thereby realizing information propagation in the geometric space; Step S3: Switching the hyperbolic space embedding and the hyperspherical space embedding to the tangent space respectively through logarithmic mapping, fusing the geometric information embedded in the tangent space with the geometric information in the Euclidean space, and returning the fused geometric information to the target geometric space through exponential mapping; Step S4: Use the attention mechanism to perform weighted fusion of geometric information in different geometric spaces to embed the network security knowledge graph.

2. The network security knowledge graph embedding method based on hybrid space according to claim 1 is characterized in that: The step S1 is specifically as follows: Obtaining triples of network security knowledge graph , the triplet includes the head entity node , tail entity node and relationship nodes , from the input triples, the relationship between entities is modeled through geometric transformation, and a hybrid space embedding is generated for the head entity node and the tail entity node of the network security knowledge graph, and the hybrid space embedding includes hyperbolic space embedding and hyperspherical space embedding.

3. The network security knowledge graph embedding method based on hybrid space according to claim 1 is characterized in that: In step S2, the points in the hyperbolic space and the points in the hyperspherical space are respectively mapped to the tangent space by logarithmic mapping, specifically: in, Indicates that the points on the embedding space By logarithmic mapping, it is projected onto the In the tangent space, is the curvature factor of the current geometric space, 、 is a point in the embedded space, that is, a point in the hyperbolic space or the hyperspherical space, For a given point in the embedding space, , is the point set in the embedding space, represents Möbius addition.

4. The network security knowledge graph embedding method based on hybrid space according to claim 1 is characterized in that: In step S2, the vector in the tangent space is mapped back to the corresponding geometric space through exponential mapping, specifically: in, Represents the vector in the tangent space Projected onto the curvature by exponential mapping The hypersphere space or curvature is On the hyperbolic space, is the vector in the tangent space, is a point in the corresponding target geometric space, that is, a point in the hyperbolic space or the hyperspherical space, represents the Möbius addition, is the curvature factor of the target geometric space.

5. The network security knowledge graph embedding method based on hybrid space according to claim 1 is characterized in that: The vector addition used in the exponential mapping and the logarithmic mapping is the Möbius addition method, which is specifically: in, 、 is a point in geometric space, represents the Möbius addition, for 、 The inner product of is the curvature value of the projected target geometric space.

6. The network security knowledge graph embedding method based on hybrid space according to claim 1 is characterized in that: In step S3, the geometric information embedded in the tangent space is fused with the geometric information in the Euclidean space, specifically: in, 、 are the geometric information in tangent space and the geometric information in Euclidean space respectively, Represents the fused geometric information, 、 To control the attention factor of information dissemination, is the geometric information of the Euclidean space in the tangent space, It is the result of converting geometric space information into tangent space through logarithmic mapping.

7. The network security knowledge graph embedding method based on hybrid space according to claim 1 is characterized in that: The step S4 is specifically as follows: The attention vector obtained through training assigns corresponding weights to each geometric space based on the geometric distance; the weighted sum of the embeddings of each geometric space is calculated, and the training activation is performed through a nonlinear activation function.

8. The network security knowledge graph embedding method based on hybrid space according to claim 7 is characterized in that: Calculate the weighted sum of the embeddings of each geometric space, specifically: The embedding of the head entity node is weighted fused in each geometric space: in, represents the weighted fusion result of head entity, 、 They are the head entity embedding in hyperbolic space and the head entity embedding in hyperspherical space, It means that the vector in the tangent space is projected onto the curvature by exponential mapping. In the new mapping space, Indicates that the points on the Euclidean space are projected onto the curvature by logarithmic mapping. In the new mapping space, It means that the points on the hypersphere space will be projected onto the curvature of In the new mapping space, is the attention vector in the hypersphere space; The embedding of the tail entity node is weighted fused in each geometric space: in, represents the weighted fusion result of the tail entity, is the tail entity embedding in hyperbolic space, is the tail entity embedding of the hypersphere space, It means that the vector in the tangent space is projected onto the curvature by exponential mapping. In the new mapping space, Indicates that the points on the Euclidean space are projected onto the curvature by logarithmic mapping. In the new mapping space, It means that the points on the hypersphere space will be projected onto the curvature of In the new mapping space, is the attention weight of the tail entity in the hyperbolic space, is the attention weight of the tail entity in the hypersphere space.

9. A network security knowledge graph embedding device based on hybrid space, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, a network security knowledge graph embedding method based on a hybrid space as described in any one of claims 1 to 8 is implemented.

Images