Power network security knowledge ontology modeling method

Abstract

The invention belongs to the technical field of computer network security, and discloses a power network security knowledge ontology modeling method, which comprises the following steps of: firstly, collecting multi-mode heterogeneous data such as power monitoring, security equipment and threat intelligence in parallel; then, adopting a hybrid strategy, on one hand, constructing a top-layer seed ontology based on a domain standard, and on the other hand, automatically extracting an entity relationship from the text by utilizing a deep learning model; secondly, associating multi-source knowledge and solving conflicts through entity alignment and sequential logic fusion, and generating a consistent and credible global knowledge view; and finally, establishing an ontology self-evolution mechanism based on reinforcement learning, dynamically adjusting knowledge weight and automatically expanding a mode, realizing deep understanding, accurate prediction and self-adaptive evolution of network threats, and improving the active defense level of a power system. According to the method, the core problems of one-sided knowledge acquisition, poor fusion capability, static model evolution incapability and the like in the prior art are solved.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, particularly to the field of knowledge engineering and artificial intelligence security application technology, and more specifically to an ontology modeling method for dynamically constructing and optimizing a network security knowledge system for complex power cyber-physical systems. Background Technology

[0002] With the deepening of digital transformation and the construction of the energy internet, the modern power system has evolved into a highly complex cyber-physical system (CPS). Its control network carries massive amounts of monitoring commands and measurement data, and its stable operation is directly related to the national economy and people's livelihoods. However, the deep integration of information technology has also made the power system face increasingly severe and complex cybersecurity threats. Traditional cybersecurity protection systems, such as firewalls, intrusion detection systems (IDS), and security information and event management (SIEM) platforms, are gradually revealing their limitations in dealing with new types of attacks such as advanced persistent threats (APTs).

[0003] The main problems with these traditional technologies are: First, severe data silos exist. Different security devices and systems generate data in varying formats, isolating them and making effective correlation analysis difficult, resulting in a fragmented and localized security perspective. Second, weak knowledge representation capabilities. Threat detection largely relies on manually written, signature-based static rule bases, which struggle to describe the complex tactics, techniques, and processes (TTPs) of attackers, offering virtually no detection capability for unknown threats and zero-day vulnerability attacks. Third, a lack of intelligence and automation. Knowledge base updates heavily depend on manual input and maintenance by security experts, resulting in slow response times that cannot keep pace with the rapid iteration of threat intelligence, leading to outdated knowledge and lagging protection capabilities.

[0004] To address these issues, academia and industry have begun exploring the application of knowledge graphs or ontology technologies in the field of cybersecurity. Knowledge ontology can formally organize scattered and heterogeneous security data and information into a structured knowledge network containing entities, concepts, attributes, and relationships, thus providing a foundation for machine understanding and reasoning about security issues. However, existing cybersecurity ontology modeling methods still have many shortcomings.

[0005] First, regarding the construction methodology, most existing methods rely on security experts manually designing ontology schemas and inputting knowledge. This is an extremely time-consuming and labor-intensive process, and the experts' knowledge coverage is limited, making them prone to bias and oversight. Some automated construction methods can only handle structured or semi-structured data sources, such as logs and alert information, while ignoring highly valuable unstructured threat intelligence reports, technical analysis articles, and other data.

[0006] Secondly, at the knowledge fusion level, existing methods lack mature and effective solutions for handling the ambiguity, uncertainty, and conflicting knowledge from multi-source heterogeneous information. For example, different threat intelligence sources may name the same malware family differently or give conflicting reputation assessments of a certain IP address. Simple information merging can lead to a decline in the quality of the knowledge base or even logical errors.

[0007] Finally, regarding dynamic evolution, a significant characteristic of the cybersecurity field is the continuous confrontation and rapid evolution between attackers and defenders. New attack methods, new vulnerabilities, and new malware are constantly emerging. However, existing knowledge ontologies are mostly static models; once constructed, their patterns and content are relatively fixed, unable to dynamically adapt to changes in the external threat environment, and unable to achieve self-learning and iterative updates. This greatly limits their practical value in real-world attack and defense scenarios.

[0008] Therefore, designing a power network security knowledge ontology modeling method that can automatically learn knowledge from multimodal heterogeneous data sources, intelligently integrate conflicting information, and self-evolve according to environmental changes is a key technical challenge that urgently needs to be solved in the field of power industry network security protection. Summary of the Invention

[0009] To address the shortcomings of the aforementioned technologies, this invention discloses a power network security knowledge ontology modeling method, aiming to construct a dynamic, adaptive, and highly reliable power network security knowledge center to enhance the ability to conduct in-depth analysis and proactive prediction of complex network attacks.

[0010] To achieve the above-mentioned technical effects, the present invention adopts the following technical solution: A knowledge ontology modeling method for power network security includes the following steps: Step 1: Multimodal data acquisition and preprocessing. Design and implement a scalable data access framework that can concurrently acquire information from multiple data sources.

[0011] These data sources cover the key information dimensions required for power network security analysis, including: Alarm logs and access control records from power secondary system security protection devices such as firewalls and IDS / IPS; operation logs and status data from power monitoring systems SCADA and energy management systems EMS; network session metadata from network traffic monitoring devices such as NetFlow collectors; structured vulnerability descriptions from publicly available vulnerability databases such as NVD and CNVD; and unstructured network threat intelligence reports and malware analysis documents released by professional security vendors and open source communities.

[0012] The collected raw data is processed by a normalization and cleaning module to remove noise and redundancy, and then converted into an intermediate representation that is easy for subsequent modules to process through format standardization.

[0013] Step 2, Hybrid Knowledge Extraction: This step innovatively combines top-down and bottom-up strategies to balance the structure and coverage of knowledge.

[0014] First, in the top-level ontology construction phase, based on the logical nodes and data objects in the power industry's de facto standards such as the IEC 61850 model, and mature standards in the cybersecurity field such as the ATT&CK framework, STIX language, and CVE vulnerability description specifications, domain experts predefine a core, stable seed ontology.

[0015] This seed ontology includes top-level concept classes such as "power equipment," "communication links," "security zones," "vulnerabilities," "attack patterns," and "malicious software," as well as the inheritance and relationships between them, providing the basic framework for the entire knowledge system. Next, in the underlying knowledge discovery stage, advanced deep learning natural language processing techniques are employed to handle massive amounts of unstructured text data.

[0016] Specifically, a model integrating a bidirectional long short-term memory network (BiLSTM) and a conditional random field (CRF), namely the BiLSTM-CRF model, is used to perform sequence labeling on the text, accurately identifying various security-related named entities mentioned within it. Subsequently, the identified entities are used as nodes to construct an entity co-occurrence graph at the sentence or document level, which is then input into a graph attention network (GAT) model. This model learns the deep semantic dependencies between nodes, automatically mining and determining implicit, predefined relationships between entities, such as "exploit" and "target," forming a large number of candidate knowledge triples.

[0017] Step 3: Cross-modal entity alignment and temporal logic fusion. This step aims to break down data silos and build a unified knowledge view.

[0018] For entities extracted from unstructured text in step 2, such as a malware name or an IP address, they need to be linked to corresponding entities from structured data sources, such as device ledgers or log records.

[0019] This invention employs a deep learning-based hybrid alignment method that comprehensively utilizes textual similarity of entity names, vector space model embedding similarity of entity description information, and some heuristic rules to calculate matching scores between entities from different sources, thereby achieving high-precision entity alignment.

[0020] After alignment, a key innovation of this method lies in the introduction of temporal logic. Each knowledge triple, whether extracted or native, is assigned a precise timestamp or valid time interval. For example, the knowledge that an IP address is flagged as malicious has an expiration date.

[0021] In this way, static knowledge graphs are transformed into dynamic time-series knowledge graphs, enabling them to describe and reason about the evolution of security events.

[0022] Step 4: Knowledge Conflict Resolution. Multi-source information fusion inevitably encounters knowledge conflict issues. This invention proposes a conflict resolution mechanism based on dynamic confidence.

[0023] First, each data source is assigned an initial confidence score based on its historical accuracy and authority. Then, in the temporal knowledge graph, a knowledge triple's confidence score increases if it can be repeatedly verified by multiple independent sources or at multiple points in time. When logical conflicts are detected between two or more knowledge triples, such as differing severity ratings for the same vulnerability, the system initiates an iterative algorithm based on confidence propagation. This algorithm treats the knowledge graph as a network, with knowledge triples as nodes and logical support or opposition relationships between them as edges.

[0024] By simulating the mutual influence and propagation of confidence levels between nodes, the algorithm eventually converges, allowing highly reliable and widely supported knowledge to obtain higher final confidence scores. This enables the algorithm to decide which knowledge to retain, eliminate conflicting low-confidence knowledge, and ensure the logical consistency and high reliability of the final ontology.

[0025] Step 5: Ontology self-evolution and optimization. In order to enable the knowledge ontology to have vitality and be able to improve and evolve itself, this invention designs a closed-loop self-evolution and optimization mechanism.

[0026] On one hand, there is the self-evolution of the schema layer. The system deploys an anomaly detection model based on a graph autoencoder. This model learns from the "normal" connection patterns in the existing knowledge graph and can monitor newly incorporated knowledge in real time. When a new attack path that is significantly different from known attack patterns or a completely new way of associating entities appears, the anomaly detection model will issue an alert. This alert will trigger a schema extension module, which attempts to summarize new relationship types or entity subclasses by performing cluster analysis on the anomaly subgraph and submits them to the security analyst for review, thereby realizing on-demand, semi-automatic extension of the ontology schema.

[0027] On the other hand, there is self-optimization at the knowledge layer. This invention introduces reinforcement learning techniques to dynamically adjust the strength of associations between knowledge points.

[0028] Specifically, a model based on a Deep Q-Network (DQN) is constructed, applying a knowledge ontology to a specific security task, such as predicting the next step in an APT attack. The model's agent "walks" across the knowledge graph, selecting the most probable attack path. If its prediction matches the subsequent actual security event, it receives a positive reward; otherwise, it receives a negative reward.

[0029] Through continuous trial and error learning, the DQN model learns which knowledge associations are more "useful" in predicting attacks, and updates the learned path probabilities back into the knowledge ontology in the form of relation weights, thereby making the knowledge on the ontology increasingly closer to actual combat and increasingly "intelligent".

[0030] Based on a deep understanding of the shortcomings of existing technologies, this invention provides a novel knowledge ontology modeling method for power network security. This method addresses core issues in existing technologies, such as incomplete knowledge acquisition, poor fusion capabilities, and static models that cannot evolve, resulting in significant positive and beneficial effects. 1. This invention, through a hybrid knowledge extraction strategy, not only ensures the structure of the ontology by utilizing prior knowledge, but also achieves for the first time the ability to automatically mine deep security knowledge from massive, multilingual, and unstructured threat intelligence through deep learning NLP technology. This greatly expands the coverage and timeliness of knowledge, freeing security experts from the heavy workload of knowledge entry.

[0031] 2. By introducing a conflict resolution mechanism based on confidence propagation and temporal logic, this method can intelligently handle the contradictions and uncertainties of multi-source information, retain the most reliable knowledge, and accurately depict the temporal dynamics of knowledge. The constructed knowledge ontology is of high quality and has strong logical consistency.

[0032] 3. This invention uniquely combines graph anomaly detection with reinforcement learning technology, endowing the knowledge ontology with unprecedented "learning" capabilities. It can automatically expand its cognitive boundaries and optimize the organization of its internal knowledge based on real-world attack and defense changes, enabling it to continuously adapt to the ever-changing network threat environment and achieve a "living" knowledge system.

[0033] 4. The final constructed knowledge ontology serves as a highly intelligent "security brain," providing robust support for various upper-layer security applications. This includes enabling full-chain tracing and intent prediction of APT attacks, automatically generating targeted defense strategies, and intelligently assessing the risk exposure of critical power system assets. Consequently, the cybersecurity protection level of the power system is elevated from passive, rule-based defense to a new level of proactive, knowledge- and intelligence-based predictive defense. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein: Figure 1 This is a schematic diagram of the overall process of a power network security knowledge ontology modeling method according to the present invention; Figure 2 This is a schematic diagram of the internal structure and data flow of the hybrid knowledge extraction module in this invention; Figure 3 This is a schematic diagram illustrating the principle of cross-modal entity alignment and temporal logic fusion process in this invention; Figure 4 This is a flowchart of the closed-loop control mechanism for the ontology self-evolution and optimization mechanism based on reinforcement learning in this invention. Detailed Implementation

[0035] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0036] like Figure 1 As shown, a knowledge ontology modeling method for power network security includes the following steps: Step 1: Multimodal data acquisition and preprocessing.

[0037] In this embodiment, the data acquisition module is designed as a microservice-based distributed framework. For structured data, such as syslog logs from a certain brand of firewall, a dedicated Logstash parser is configured. This parser uses Grok expressions to extract fields such as source IP, destination IP, port, protocol, and operation behavior from unstructured log lines and converts them into JSON format.

[0038] For semi-structured data, such as CVE vulnerability information XML files obtained from NVD, a DOM-based XML parser is used to extract key information such as CVE-ID, release date, CVSS score, and a list of affected products. For unstructured data, such as threat intelligence reports in PDF format, the PDFplumber library is first used to convert the content into plain text while preserving its original paragraph structure.

[0039] All data that has undergone initial parsing is sent to a Kafka message queue, where it is consumed by the subsequent preprocessing module. The preprocessing module performs standardization operations such as removing HTML tags, converting character encoding to UTF-8, sentence segmentation, and tokenization.

[0040] The word segmentation process is specially loaded with a custom dictionary from the power industry and cybersecurity field to ensure that technical terms such as "differential protection" and "EternalBlue" can be correctly identified as a whole.

[0041] Step 2: Hybrid knowledge extraction.

[0042] This step is one of the core elements of this method, and its internal workflow is as follows: Figure 2 As shown.

[0043] On one hand, a top-level ontology was constructed. Using ontology editing tools such as Protégé, classes for primary and secondary power devices, such as Breaker circuit breakers and IED intelligent electronic devices, were defined according to the IEC 61850 standard. These classes inherit from a common Power Asset class. Simultaneously, security concept classes such as Threat Actor, Malware, Attack Pattern, and Vulnerability were defined according to the STIX 2.1 standard. These classes are related through Object Properties; for example, Attack Pattern uses Malware, and Malware exploits Vulnerability. This manually constructed seed ontology is saved as an OWL file, serving as the basic framework for knowledge extraction and fusion.

[0044] On the other hand, low-level knowledge discovery is performed. The preprocessed unstructured text is fed into a BiLSTM-CRF model implemented using TensorFlow. This model has been pre-trained on a large-scale annotated security corpus. For the input sentence, the BiLSTM layer learns the contextual dependency features of each word in both forward and backward directions, generating a high-dimensional feature sequence. The CRF layer, on top of the BiLSTM output, learns and applies transition constraints between labels. For example, a B-Malware label is more likely to be followed by an I-Malware label than a B-Vulnerability label. This effectively avoids illogical label sequences and improves the accuracy of entity recognition. For example, for the sentence "APT28 organization exploited the vulnerability CVE-2021-44228", the model can accurately label APT28 as a ThreatActor and CVE-2021-44228 as a Vulnerability.

[0045] Following named entity recognition, all entities identified within the same sentence or paragraph are used to construct a local fully connected graph, which is then input into a Graph Attention Network (GAT) model implemented using PyTorch Geometric. The GAT model, through a multi-head attention mechanism, assigns different importance weights to the neighbors of each node, thus focusing more on the context entities most relevant to the current relationship judgment when aggregating neighbor information. For example, when judging the relationship between APT28 and CVE-2021-44228, the model gives higher weight to the context of the verb "utilize" in its vicinity. After multi-layer GAT computation, the representation vector of each entity node incorporates rich neighborhood information.

[0046] Finally, the final vector representations of the two target entities are concatenated and fed into a fully connected classifier, which outputs the predefined relationship type between them, such as "exploitation". This forms a candidate knowledge triple: (APT28, exploits, CVE-2021-44228).

[0047] Step 3: Cross-modal entity alignment and temporal logic fusion.

[0048] like Figure 3 As shown, the goal of this step is to correlate the "unstructured knowledge" extracted from the text in step 2 with the "structured knowledge" from logs and databases. Suppose we have a record in the logs showing that IP address 192.168.1.10 accessed a server at 10:00:00 on 2024-10-26. Simultaneously, from a threat intelligence report, we extract the knowledge triple (Conti ransomware, uses_C2, 192.168.1.10), and from the metadata of the intelligence report, we know that the intelligence was published on 2024-10-25.

[0049] The entity alignment module first attempts to perform a direct string match between 192.168.1.10 in the text and 192.168.1.10 in the log. For more complex cases, such as aligning the malware name "EternalBlue" in the text with MS17-010 in the vulnerability database, the system uses a pre-trained SciBERT model to calculate the sentence embedding vectors of the contextual description of "EternalBlue" and the official description of MS17-010. If their cosine similarity exceeds 0.9, it is considered an alignment.

[0050] After successful alignment, the system proceeds to the temporal logic fusion stage. The system will attach two time attributes to each knowledge triple: valid_from and valid_to. For log records, valid_from and valid_to represent the exact time the event occurred.

[0051] For knowledge extracted from intelligence, `valid_from` represents the intelligence's publication time, while `valid_to` may be a default, longer time period, or it may be corrected by subsequent updates. For example, when new intelligence indicates that the C2 address 192.168.1.10 has been deprecated, the system will update the `valid_to` of the previous triple to the publication time of the new intelligence. In this way, all knowledge is managed on a unified timeline.

[0052] Step 4: Resolving knowledge conflicts.

[0053] Suppose source A reports that IP address X belongs to Botnet Y, while source B reports that IP address X belongs to Botnet Z, which creates a knowledge conflict. In this embodiment, we set an initial confidence level for each data source, such as security vendor A and security community B, for example, 0.9 for A and 0.7 for B.

[0054] When these two conflicting triples enter the knowledge graph, the system initiates a conflict resolution algorithm based on confidence propagation.

[0055] The mathematical expression for this algorithm is: .

[0056] in, It is a column vector containing all triples at the 1st... Confidence level during round iteration. This is the initial confidence vector, and the corresponding element value is the confidence level of the source. It is a normalized adjacency matrix, if the triples and They are logically mutually supportive; for example, they both describe different aspects of the same attack event. It is a positive value; if they conflict with each other, then It is a negative value. It is a damping coefficient, usually taken as 0.85.

[0057] After several iterations, the algorithm Vectors converge. In the example above, because source A has a higher initial confidence, its corresponding triple (X, belongs_to, BotnetY) will gain more cumulative confidence during the iteration process, and its final confidence score will be significantly higher than that of the conflicting term. The system then retains the former and marks the latter as a "resolved conflict," thereby maintaining the purity of the knowledge base.

[0058] Step 5: Ontology self-evolution and optimization. For example... Figure 4As shown, this is a continuously running closed-loop process. The knowledge graph data is periodically fed into a Graph Autoencoder (GAE) model implemented in PyTorch. The GAE compresses the graph structure into low-dimensional vectors using an encoder, and then attempts to reconstruct the original adjacency matrix from the vectors using a decoder. The goal of model training is to minimize the reconstruction error.

[0059] After training, any newly added knowledge subgraph whose reconstruction error is significantly greater than the average level is considered "anomaly." For example, a short, previously unseen path directly from a SCADA protocol to a data breach might be identified as an anomaly. This anomaly triggers a pattern expansion suggestion, prompting analysts to consider creating a new relation type named `exploits_SCADA_protocol`.

[0060] Meanwhile, the reinforcement learning optimization module is also running. We defined an attack intent prediction task. For example, given an initial intrusion behavior, such as "phishing email successful," which corresponds to a node in the knowledge graph, it serves as the initial state s of the reinforcement learning agent.

[0061] The agent's action 'a' starts from the current node and selects an edge to connect to the next node, representing the predicted next step in the attack. This agent is implemented using a Deep Q-Network (DQN). Whenever the agent completes a full attack path prediction, the system compares it to records in a database of real security events. If the predicted path has a high degree of overlap with the actual path, a large positive reward R is awarded. The goal of DQN is to learn a policy to maximize long-term cumulative rewards.

[0062] During training, the Q(s,a) value learned by DQN actually reflects the probability of transitioning from state s (an attack phase) to the next phase a. This probability value is used to update the weights of the corresponding edges in the knowledge graph. For example, if the model discovers that "exploiting an Office vulnerability" is highly likely to be followed by "executing a PowerShell script," then the weight of the edge (Vulnerability, leads_to, PowerShell_Execution) will be increased.

[0063] Through prolonged online learning, the relation weights in the knowledge graph will increasingly accurately reflect real-world attack patterns, making it more precise in reasoning and prediction.

[0064] Finally, this invention also provides services to the outside world through standard API interfaces for the final, continuously optimized power network security knowledge ontology. For example, it provides a SPARQL endpoint, allowing upper-layer applications to perform complex graph queries using the SPARQL language, such as "querying all vulnerabilities affecting Siemens S7-1200 series PLCs that are associated with the APT38 organization and have a CVSS score higher than 9.0". This powerful knowledge service capability is unmatched by traditional security systems.

[0065] While specific embodiments of the present invention have been described above, those skilled in the art should understand that these specific embodiments are merely illustrative. Those skilled in the art can omit, substitute, and modify the details of the above methods and systems in various ways without departing from the principles and essence of the present invention. For example, combining the above method steps to perform substantially the same function and achieve substantially the same result according to substantially the same method falls within the scope of the present invention. Therefore, the scope of the present invention is defined only by the appended claims.

Claims

1. A method for modeling a knowledge ontology for power network security, characterized in that: Includes the following steps: Step 1: Multimodal data acquisition and preprocessing. Set up multiple concurrent data acquisition channels to obtain structured, semi-structured and unstructured data from power secondary system security protection equipment, power monitoring system SCADA, network traffic monitoring equipment, public vulnerability databases and unstructured network threat intelligence reports, and perform normalization cleaning and format unification on the data. Step 2, Hybrid Knowledge Extraction: This step includes the construction of the top-level ontology based on domain prior knowledge and the discovery of the underlying knowledge based on deep learning. The construction of the top-level ontology is based on the International Electrotechnical Commission (IEC) standards IEC 61850, IEC 62351, and the Common Vulnerability Disclosure (CVE) standard. It predefines core concept classes and their hierarchical structures such as power assets, network protocols, security vulnerabilities, and threat behaviors to form a seed ontology. The underlying knowledge discovery employs a BiLSTM-CRF model, which combines a bidirectional long short-term memory network with a conditional random field, to perform named entity recognition on the unstructured data, extract potential safe entities, and uses a GAT model based on a graph attention network to mine the semantic relationships between the identified entities, forming candidate knowledge triples. Step 3: Cross-modal entity alignment and temporal logic fusion. The entities extracted from the underlying knowledge discovery are aligned with the entity records in the structured data, such as IP addresses and device IDs, based on vector embedding similarity and rule matching to achieve the association of multi-source information. Timestamps and time intervals are assigned to all fused knowledge triples to construct a temporal knowledge graph. Step 4: Knowledge conflict resolution. An initial confidence level is set for each knowledge source, and its confidence score is dynamically updated according to the frequency of verification of the knowledge triple in the time-series knowledge graph. An algorithm based on confidence propagation is used to iteratively calculate among conflicting knowledge triples, select the knowledge triple with the highest confidence score to retain, and remove conflicting items to ensure the consistency of ontology knowledge. Step 5: Ontology self-evolution and optimization. The anomaly detection model based on graph autoencoder is used to continuously analyze the structure of the time-series knowledge graph. When an attack path or entity association that cannot be explained by the existing ontology pattern is detected, ontology pattern expansion is triggered to automatically generate new relation types or entity subclasses. Meanwhile, a reinforcement learning model based on deep Q-network (DQN) is constructed, using the accuracy of the ontology in specific security tasks, such as attack intent prediction, as a reward signal. Through continuous learning, the relation weights between knowledge triples are adjusted to achieve self-optimization of ontology knowledge.

2. The power network security knowledge ontology modeling method according to claim 1, characterized in that: In step 2, in the named entity recognition process based on the BiLSTM-CRF model, unstructured text is first input into the BiLSTM network to learn the contextual bidirectional features of the text sequence. Then, the output feature vector of the BiLSTM is input into the CRF layer to learn the constraint relationship between entity labels, thereby improving the accuracy of entity boundary recognition. The entity categories identified by the named entity include: malware, attack groups, network assets, software vulnerabilities, network protocols, geographical locations, and industry sectors.

3. The power network security knowledge ontology modeling method according to claim 1, characterized in that: In step 2, the input of the GAT model based on graph attention network is a local graph consisting of all entities in the sentence or document after named entity recognition. Nodes in the graph are entities, and edges are the co-occurrence relationships of entities in the text. The GAT model assigns different weights to neighboring nodes through an attention mechanism, aggregates neighbor information to update the representation of the central node, and finally uses a classifier to determine whether there is a predefined relationship type between two entity nodes. The relationship types include: exploit, belong, located, attack, target, and originate from.

4. The power network security knowledge ontology modeling method according to claim 1, characterized in that: In step 3, the vector embedding similarity calculation method used for cross-modal entity alignment is as follows: First, a pre-trained BERT model is used to encode the entity context in unstructured text and the entity description field in structured data to obtain high-dimensional feature vectors. Then, the cosine similarity between the two vectors is calculated. When the similarity is higher than a preset threshold, they are determined to be the same entity.

5. The power network security knowledge ontology modeling method according to claim 1, characterized in that: In step 4, the update expression for the confidence propagation algorithm for knowledge conflict resolution is: In the above expression, For the first The confidence vector of all knowledge triples in the knowledge graph at the next iteration. Given an incidence matrix, its elements Representing knowledge triples Knowledge Triples The degree of support or opposition For each knowledge triple, an initial confidence vector is generated based on its source. This is the damping coefficient, used to balance the relationship between the current iteration calculation and the initial value.

6. The power network security knowledge ontology modeling method according to claim 1, characterized in that: In step 5, based on depth The specific configuration of the network's reinforcement learning model is as follows: state space : Defined as the current attack path to be evaluated, represented as a series of interconnected knowledge triples; Action Space Defined as a chain of all possible next knowledge triples starting from the end node of the current attack path; reward function. R A positive reward is given when the model's chosen action makes the predicted attack path match the path recorded in the actual security incident; a negative reward is given when the predicted path deviates from the actual path; the DQN model learns a... function To approach the state Take action below The future cumulative rewards, and based on The optimal action is selected to optimize the prediction of the entire attack path, and the learned path probability is updated in reverse to the relation weights of the corresponding knowledge triples in the ontology.

7. The power network security knowledge ontology modeling method according to claim 1, characterized in that: The method further includes step 6, providing a knowledge service interface, which encapsulates the final generated power network security knowledge ontology into a service interface that supports the SPARQL query language, or provides a Graph QL API interface for upper-layer security applications, such as security situation awareness platforms, threat hunting systems, and automated response orchestration systems, to call upon, thereby enabling knowledge querying, reasoning, and visualization.

Images