Method for constructing relationship-driven network security knowledge graph

Abstract

This invention discloses a method for constructing a relationship-driven cybersecurity knowledge graph. This method, driven by relational semantics, sequentially executes the following steps: multi-source threat intelligence collection and preprocessing, relational semantic modeling, relationship-priority-driven knowledge extraction, entity alignment based on relational context, and knowledge graph construction. By constructing a relational system with entity type constraints and relational reasoning rules, it achieves complete attack chain modeling and implicit relational derivation; it employs a reverse extraction mechanism of relational identification → entity location to reduce error propagation; it introduces relational context to achieve accurate cross-source entity alignment; and finally, it establishes an indexed knowledge graph based on a graph database, supporting efficient querying and attack attribution.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method for constructing a relationship-driven network security knowledge graph. Background Technology

[0002] As cybersecurity threats continue to evolve, Advanced Persistent Threat (APT) attacks are increasingly exhibiting characteristics of organization, concealment, and long-term persistence. These attacks are characterized by complex attack methods, lengthy attack chains, and highly targeted objectives, posing serious security threats to critical information infrastructure, enterprise core network systems, and various important information platforms. Against this backdrop, Cyber ​​Threat Intelligence (CTI), with its integration and presentation of core information such as attackers, attack techniques, vulnerabilities, and targeted assets, has become a crucial data support for cybersecurity situational awareness, attack attribution and forensics, and proactive defense decision-making, occupying a central position in the cybersecurity protection system.

[0003] Currently, the main carriers of cyber threat intelligence are professional analysis reports from security vendors, official vulnerability announcements, professional security blogs, and information from industry security forums. The vast majority of this intelligence content is presented in natural language, exhibiting significant unstructured and multi-source heterogeneous characteristics. At the same time, threat intelligence encompasses multiple core entities, including attack organizations, malware samples, vulnerability exploitation tools, target network assets, and network node devices. Furthermore, there are complex logical relationships among these entities, such as attack invocation, vulnerability exploitation, target targeting, and behavioral correlations. Together, they constitute a dynamic attack behavior network with multiple entities and relationships deeply intertwined. Traditional data statistics and keyword retrieval methods are insufficient to achieve efficient integration and in-depth mining of threat information, thus failing to fully unleash the application value of threat intelligence.

[0004] Knowledge graph technology, as a core technology for achieving structured semantic association analysis in the field of artificial intelligence, can transform scattered and fragmented unstructured threat information into a structured semantic network with unified semantic specifications. This enables standardized representation of threat knowledge, cross-source association fusion, and deep association analysis, effectively solving the industry pain point of the difficulty in efficiently utilizing unstructured threat intelligence. It has now become an important research and application direction in the field of cybersecurity threat intelligence analysis, providing solid technical feasibility for the full-process tracing of APT attacks and the prediction of potential threats.

[0005] Currently, the industry generally adopts an "entity-first" modeling approach for constructing threat intelligence knowledge graphs. This approach relies on a traditional information extraction pipeline to complete text parsing and knowledge extraction. While this achieves a certain degree of structured transformation of threat intelligence, it suffers from many inherent flaws in practical applications and technical implementation, making it difficult to adapt to the refined analysis needs of complex APT attacks. Specifically: First, the modeling logic is entity-centric, treating relationships merely as subordinate connections between entities. This lacks a precise depiction of the dynamic relationship structure of attack behavior, failing to fully present the multi-stage, chain-like execution process of APT attacks, and hindering the analysis of multi-hop attacks. First, the ability to uniformly model and represent attack relationships is severely lacking. Second, multi-source threat intelligence exhibits significant differences in naming rules, description granularity, and semantic expression. Existing technologies lack effective semantic fusion and entity alignment mechanisms, making efficient fusion of cross-source knowledge difficult, and highlighting issues such as entity redundancy and alignment errors. Third, existing methods lack deep reasoning capabilities for attack relationships and cannot automatically complete potential attack paths and implicit connections from known threat information. This greatly restricts the application effectiveness of threat intelligence in automated security analysis and intelligent defense decision-making, becoming a key technical bottleneck for the further development and implementation of threat intelligence knowledge graph construction technology. Summary of the Invention

[0006] To address the aforementioned issues, the present invention aims to provide a method for constructing a relationship-driven cybersecurity knowledge graph. This method uses APT attack behavior relationships for structured modeling, and through relational semantic modeling, relation-priority extraction, and relation-driven entity fusion, it achieves a complete expression and automatic reasoning of complex APT attack behaviors. At the same time, it effectively reduces the propagation of information extraction errors, improves the quality of multi-source data fusion, and enhances the analytical capabilities and practical value of the knowledge graph.

[0007] This invention provides a method for constructing a relationship-driven cybersecurity knowledge graph, the method comprising:

[0008] After collecting and preprocessing multi-source heterogeneous network security data, a token semantic vector sequence is obtained;

[0009] The token semantic vector sequence is subjected to relation detection and classification based on a pre-trained relational semantic model to obtain relation vectors; wherein, the relational semantic model is a structured knowledge representation that includes explicit relations and implicit inference relations by constructing a unified framework of relational semantic system and relational reasoning rules.

[0010] The relationship vector and the token semantic vector sequence are weighted and fused to obtain an enhanced feature vector;

[0011] The label is predicted for each token of the enhanced feature vector using a sequence labeling model, and the entity boundary and entity type are parsed to construct an entity set.

[0012] Semantic embedding is performed on each entity in the entity set to obtain the corresponding relational semantic representation, and a similarity alignment mechanism is introduced to perform entity alignment and fusion;

[0013] Batch import entity-relation-entity triples after entity alignment into a graph database to construct a cybersecurity knowledge graph.

[0014] Preferably, the modeling process of the relational semantic model is as follows:

[0015] The entity space and relation space of network security data are formally defined, and a relational semantic system with entity type constraints is constructed through a type constraint mechanism.

[0016] Relational compound operations are performed through relational operation mechanisms, and a family of relational reasoning rules is established;

[0017] By performing relational closure operations, a structured knowledge representation containing explicit relations and implicit inference relations is output.

[0018] Preferably, after preprocessing the collected multi-source heterogeneous network security data, a token semantic vector sequence is obtained, specifically:

[0019] Data cleaning is performed on the collected multi-source heterogeneous network security data, including removing HTML tags, abnormal symbols, duplicate content, and low-information text; the cleaned data is then segmented into sentence-level input units.

[0020] Each sentence is standardized, including case unification, symbol normalization, and terminology standardization; the standardized sentences are then tokenized to obtain a sequence of token semantic vectors.

[0021] Preferably, multi-source heterogeneous network security data is collected, specifically:

[0022] By leveraging web crawling technology and open interfaces, threat intelligence data from various sources is automatically captured and integrated; these sources include APT attack reports, official announcements, security vendor intelligence platforms, and community and forum information.

[0023] Preferably, the pre-trained relational semantic model is used to perform relation detection and classification on the token semantic vector sequence to obtain a relation vector, specifically as follows:

[0024] The preprocessed token semantic vector sequence is input into the pre-trained relation semantic model. The model's linear classification layer calculates the multi-label relation score for the context semantic vector of each token, and then performs independent probability calculation for each type of relation, outputting the relation vector.

[0025] Furthermore, the weighted fusion of the relation vector and the token semantic vector sequence to obtain the enhanced feature vector specifically includes:

[0026] The relation vector is concatenated with the context semantic vector of each token to construct a concatenated feature vector;

[0027] The relation vector is mapped to a relation embedding vector, and dynamic weight allocation is performed through a gating mechanism. The relation embedding vector is then weighted and fused with the concatenated feature vector to obtain an enhanced feature vector.

[0028] Preferably, the step of predicting the label for each token of the enhanced feature vector using a sequence labeling model, parsing the entity boundary and entity type, and constructing an entity set specifically includes:

[0029] The enhanced feature vector is input into the linear mapping layer of the sequence labeling model to obtain the emission score of each token in the label space, and the emission score sequence is output.

[0030] By introducing a conditional random field layer, given a conditional probability distribution and the input emission score sequence, the optimal label sequence that maximizes the conditional probability is solved using the Viterbi algorithm.

[0031] Based on the optimal label sequence, the entity boundaries and entity types are parsed, and an entity set is constructed, where each entity is represented as a triplet of the entity's start position, end position, and entity type in the text.

[0032] Furthermore, the step of semantically embedding each entity in the entity set to obtain a corresponding relational semantic representation, and introducing a similarity alignment mechanism for entity alignment and fusion, specifically includes:

[0033] For each entity in the entity set, a corresponding set of relational contexts is defined, and each relational context is semantically encoded using the relational semantic model to obtain the relational semantic representation corresponding to each relational context;

[0034] A relation weighting mechanism is introduced to perform weighted aggregation of the relation semantic representations corresponding to each relation context, thereby obtaining the relation semantic representation of each entity.

[0035] The semantic similarity between cross-source entities is calculated through a similarity alignment mechanism, and entity alignment and fusion are performed based on the semantic similarity between entities.

[0036] This invention proposes a relation-driven method for constructing a cybersecurity knowledge graph. It introduces relation-priority-driven knowledge extraction, using relation semantic detection as the starting point. By constructing sentence-level relation vectors and injecting them into the entity recognition process, it achieves reverse guidance from "relationship to entity." Therefore, this invention reconstructs the modeling and extraction process with relations as the core. Relational semantic constraints significantly reduce the impact of entity recognition errors on the overall extraction results, effectively avoiding the problem of error amplification at each stage of the pipeline. Simultaneously, the relation-priority mechanism can prioritize the identification of key attack behavior semantics (such as use, exploit, target, etc.) in complex APT reports, giving the entity recognition process a clear semantic orientation. This ensures high consistency and accuracy even with diverse entity naming and non-standard expressions. Attached Figure Description

[0037] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart of a method for constructing a relationship-driven network security knowledge graph, as provided in an embodiment of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0041] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0042] This embodiment takes multi-source heterogeneous threat intelligence, such as APT attack reports, security vendor intelligence, vulnerability announcements, and security community texts, as input to fully realize the entire process of relational semantic modeling → relation-priority extraction → relational context fusion → knowledge graph construction, solving the three major problems of weak attack behavior modeling, pipeline error propagation, and difficulty in entity alignment in existing technologies.

[0043] To address the issues of insufficient relational semantic expression, lack of type constraints, and inability to support effective reasoning in existing threat intelligence modeling, this embodiment integrates pre-trained relational semantic models from relevant fields. By constructing a unified framework of "relational semantic system with entity type constraints + establishing relational compound operation and reasoning rules," it achieves structured expression and reasonable representation of attack behaviors.

[0044] First, the entity space and relation space of network security data are formally defined, and a relational semantic system with entity type constraints is constructed through a type constraint mechanism.

[0045] Define the entity type collection as:

[0046] E={ThreatActor, AttackPattern, Malware, Tool, Vulnerability, Asset,Indicator, Campaign, Impact, Location, CourseOfAction};

[0047] Define the set of relations as:

[0048] R={use, exploit, download, target, belong_to, indicate, located_at,mitigate};

[0049] And impose entity type constraints on each type of relationship, defined as:

[0050]

[0051] Thus, each type of relation is formalized as an ordered binary relation with entity type constraints;

[0052] Then, the semantic boundaries of the entity type mapping constraint relationship are explicitly defined, as shown below:

[0053] use ⊆ ThreatActor × {AttackPattern, Malware, Tool}

[0054] exploit ⊆ AttackPattern × Vulnerability

[0055] target ⊆ ThreatActor × Asset

[0056] download ⊆ {Malware, Tool} × {Tool, Malware}

[0057] belong_to ⊆ {Malware, Campaign, Impact} × {AttackPattern,ThreatActor, Vulnerability}

[0058] indicate ⊆ Indicator × {Malware, Tool}

[0059] located_at ⊆ {ThreatActor, Asset} × Location

[0060] mitigate ⊆ CourseOfAction × Vulnerability

[0061] The above constraints ensure that relational expressions satisfy semantic consistency and structural legality, providing a foundation for subsequent relational reasoning.

[0062] Then, relational compound operations are performed through relational operation mechanisms, and a family of relational reasoning rules is established;

[0063] Furthermore, rules for relational compound operations and inferences are established to enable automatic derivation of multi-hop attack chains:

[0064] The relational composition operation is defined as follows:

[0065]

[0066] The above definition indicates that the relationship Includes all ordered pairs that satisfy the following conditions : There exists an element , making belong ,and belong .

[0067] Based on this operational definition, a family of relational reasoning rules is constructed, including:

[0068] (1) Usage inheritance rules:

[0069] (ThreatActor, use, Malware) ∧ (Malware, belong_to, AttackPattern)⇒(ThreatActor, use, AttackPattern)

[0070] (ThreatActor, use, Tool) ∧ (Tool, belong_to, AttackPattern)⇒(ThreatActor, use, AttackPattern)

[0071] (2) Vulnerability exploitation propagation rules:

[0072] (ThreatActor, use, AttackPattern) ∧ (AttackPattern, exploit,Vulnerability)⇒ (ThreatActor, exploit, Vulnerability)

[0073] (3) Download chain propagation rules:

[0074] (Malware1, download, Tool) ∧ (Tool, download, Malware2)⇒ (Malware1,download, Malware2)

[0075] (Tool1, download, Malware) ∧ (Malware, download, Tool2)⇒ (Tool1,download, Tool2)

[0076] (4) Instructions for propagation:

[0077] (Indicator, indicate, Malware) ∧ (Malware, download, Tool)⇒(Indicator, indicate, Tool)

[0078] (Indicator, indicate, Tool) ∧ (Tool, download, Malware)⇒(Indicator, indicate, Malware)

[0079] (5) Rules for the propagation of defensive effects:

[0080] (CourseOfAction, mitigate, Vulnerability) ∧ (AttackPattern, exploit,Vulnerability)⇒ (CourseOfAction, mitigate, AttackPattern)

[0081] Finally, through relational closure operations, a structured knowledge representation containing explicit relations and implicit inference relations is output;

[0082] Under the constraints of the above rules, and further defined through relational closure operations:

[0083]

[0084] in, Let be the initial set of relations; the result of the operation includes explicit relations and implicit derivation relations, and satisfies:

[0085]

[0086] Finally, the output is a structured knowledge representation containing explicit relations and implicit inference relations, as shown below:

[0087]

[0088] The embodiments of the present invention construct a more complete semantic network of attack behavior through relational semantic modeling, providing a unified representation basis for subsequent relation-driven knowledge extraction and reasoning analysis.

[0089] Combination Figure 1 The technical solution of the relationship-driven network security knowledge graph construction method proposed in the embodiments of the present invention is described.

[0090] S10: Collect multi-source heterogeneous network security data and preprocess it to obtain a token semantic vector sequence;

[0091] Preferably, this embodiment uses web crawler technology and open API interfaces to automatically capture and integrate threat intelligence data from different sources, covering multiple data sources such as APT attack reports, official announcements, security vendor intelligence platforms, and community and forum information, thereby improving the comprehensiveness and timeliness of the data.

[0092] Specifically, based on web crawling technology and API interfaces, the following four main data sources are automatically collected:

[0093] APT Attack Reports: These reports collect publicly released APT attack analysis reports from major security vendors (such as Kaspersky, FireEye, and QiAnXin). This type of data possesses strong traceability and detailed technical descriptions, serving as a crucial basis for APT incident modeling.

[0094] Threat Announcements and Intelligence Bulletins: Obtain vulnerability and threat announcements from authoritative organizations such as CERT, CNCERT, US-CERT, and CISA to ensure timeliness and official credibility;

[0095] Security vendor intelligence platform: Integrates with online threat intelligence platforms such as VirusTotal, AlienVault OTX, and MITRE CTI to supplement IOC (Indicator of Compromise), tactical, and technical information;

[0096] Community and forum information: Dark web forums, technical communities, and security blogs active with APT groups;

[0097] The collected multi-source heterogeneous threat intelligence is formed into a unified text set:

[0098]

[0099] in, For the collection of all intelligence, For the first Item text, This represents the total number of texts.

[0100] The following steps are executed sequentially on the collected raw data:

[0101] 1. Data Cleaning: Define the cleaning function as follows:

[0102]

[0103] in, This includes removing HTML tags, unusual symbols, duplicate content, and low-information text. This is the cleaned and valid text.

[0104] 2. Sentence-level segmentation: Segmenting into sets of sentences based on semantic breakpoints:

[0105]

[0106] in, For the first A collection of sentences from a text. For the first The first in the text There are 10 sentences, where m is the number of sentences after segmenting a single text.

[0107] 3. Terminology Standardization: Standardize and unify cybersecurity terminology such as vulnerability numbers, malware names, and APT organization names, including unifying capitalization, standardizing symbols, and standardizing terminology.

[0108] 4. Token Encoding: After word segmentation and vector mapping, the sentence is transformed into a standardized token sequence, whose semantic vector sequence is represented as follows:

[0109]

[0110] in, This is a sequence of contextual semantic vectors for the entire sentence. For the first The context semantic vector of each token, This represents the total number of tokens for the sentence. is the dimension of the hidden layer of the pre-trained model.

[0111] This vector sequence fully integrates the local and global contextual information of the token, providing standardized feature inputs for subsequent relational semantic detection and entity recognition.

[0112] S20, perform relation detection and classification on the token semantic vector sequence based on the pre-trained relation semantic model to obtain the relation vector;

[0113] In a preferred embodiment of the present invention, the steps of relation detection and classification are specifically as follows:

[0114] First, the preprocessed token semantic vector sequence Input a pre-trained relational semantic model. The model calculates a multi-label relation score for each token's contextual semantic vector using a linear classification layer, and its output is represented as follows:

[0115]

[0116] in, This is the weight matrix. For offset top, It is a sentence-level semantic vector.

[0117] Then, the Sigmoid activation function is used. The score for each type of relation is mapped independently, and its expression is:

[0118]

[0119] in, For the first The raw output score of the class relationship. The predicted probability of the corresponding relationship is denoted by (0,1). This function nonlinearly maps the original score output by the linear classification layer to a probability value, enabling parallel detection of multiple attack relationships.

[0120] Finally, the output is a relation vector representing the semantics of sentence-level relations. , is represented as:

[0121]

[0122] in, This represents the predicted probability of the use relationship. This represents the predicted probability of an exploit relationship. The total number of predefined network security relationship types, preferably defined in this embodiment. =15 types of network security attack relationships. This vector fully integrates the global attack semantics of sentences, and can stably characterize the attack behavior semantics in sentences in complex contexts. It provides accurate semantic constraints and guidance for subsequent relationship-entity feature fusion and entity recognition, effectively improving the accuracy and consistency of knowledge extraction.

[0123] S30, the relation vector and the token semantic vector sequence are weighted and fused to obtain an enhanced feature vector;

[0124] In a preferred embodiment of the present invention, in the relationship-entity feature fusion step, in order to guide entity localization using global relationship semantics, this embodiment adopts a feature concatenation strategy, specifically:

[0125] The relation vector With the context semantic vector of each token Perform vertical concatenation to construct a concatenated feature vector. Its mathematical expression is defined as:

[0126]

[0127] in, This indicates a vertical splicing operation. The dimension of the fused feature space is . .

[0128] Through this concatenation operation, the original features of each token are injected with global attack semantic information, ensuring that the entity recognition process strictly follows relational semantic constraints, effectively avoiding misidentification and missed identification, and significantly improving the overall accuracy of knowledge extraction.

[0129] Furthermore, to avoid excessive interference from relational information with the original semantics, a gating mechanism is introduced to dynamically control the fusion process, specifically:

[0130] First, for the relation vector Perform a linear mapping transformation;

[0131] Given the relation vector With token context semantic vector To address the differences in feature space and dimension, this embodiment introduces a linear transformation layer to preprocess the relational semantics. The specific transformation formula is as follows:

[0132]

[0133] in, Used to map the original relation vector to a feature space compatible with the token vector. Used to adjust feature offset.

[0134] Transformed relation embedding vector It fully preserves the semantic information of global attack behavior and adjusts the distribution and dimensionality of features through parameter learning.

[0135] Then, a gating mechanism is introduced to dynamically allocate feature weights, embedding the relationship into the vector. With the concatenated feature vector Weighted fusion is performed to obtain the enhanced feature vector, specifically:

[0136] Based on concatenated feature vectors Generate gate weight vector Its expression is:

[0137]

[0138] in, and These are learnable parameters for the gating layer. Using the Sigmoid activation function ensures the gated weight vector Each element takes a value in the interval (0, 1).

[0139] Finally, the relation embedding vector is subjected to gating weights. With the concatenated feature vector Weighted fusion is performed to generate the final enhanced feature vector for entity recognition. , is represented as:

[0140]

[0141] in, This represents the Hadamard product.

[0142] Compared to fixed-ratio fusion or simple splicing, the gating mechanism learns weights autonomously through the model, and can adaptively adjust the fusion ratio of the two types of features according to the semantic importance of different tokens and the relational strength of different sentences. This effectively strengthens the guiding role of relational semantics in entity localization, significantly improves the robustness and accuracy of entity recognition, and solves the technical problems of insufficient utilization of relational information and poor fusion effect in traditional methods.

[0143] S40, predict the label for each token of the enhanced feature vector using a sequence labeling model, parse out the entity boundary and entity type, and construct an entity set;

[0144] In a preferred embodiment of the present invention, in the entity recognition step, the enhanced feature vector is... Inputting a BiLSTM-CRF sequence labeling model, and combining the label transition constraints of the Conditional Random Field (CRF) layer with the Viterbi algorithm to solve for the optimal label sequence, the system completes entity boundary identification and type determination, specifically as follows:

[0145] First, the tag emission score for each token is calculated using a linear emission layer, and its mathematical expression is as follows:

[0146]

[0147] in, Here is the emitter layer weight matrix. This is the bias term. This operation maps the fused features to the entity label space, generating the first... Each token corresponds to the original emission score of various entity tags. Output emission fraction sequence This provides a foundation for solving the global optimal label in the subsequent CRF layer.

[0148] Then, to model the dependencies between entity tags, this embodiment introduces a CRF layer to perform global modeling of the tag sequence, specifically including:

[0149] 1. Tag sequence definition:

[0150] Define the label sequence corresponding to the input sequence as: ,in, For the first The entity label of a token. The total number of tokens in the input sequence;

[0151] 2. Overall score of the label sequence (scoring function):

[0152] Given an input emission fraction sequence At that time, the label sequence The overall score is:

[0153]

[0154] in, Represented as the first Each token was predicted as a label. The launch score, The label transition matrix, Indicates from the label Move to label The scores are used to model the dependency constraints between tags.

[0155] 3. Definition of conditional probability (global Softmax normalization):

[0156] Based on this scoring function, the conditional probability is defined as:

[0157]

[0158] in, Represents the set of all possible label sequences. Let represent any candidate label sequence, with the denominator being the global Softmax normalization term. The scores of all candidate label sequences are exponentially summed, mapping the output to a valid probability distribution, ensuring... .

[0159] 4. Model training objective (maximizing log-likelihood):

[0160] The goal of model training is to maximize the log-likelihood of the true label sequence, i.e., minimize the negative log-likelihood loss.

[0161]

[0162] in, This represents all learnable parameters of the model (including the emission layer). , CRF transition matrix wait), The total number of training samples, Indicates the first The input sequence of each training sample and the real label sequence.

[0163] The training process updates parameters through the backpropagation algorithm to maximize the conditional probability of the real label sequence, thereby learning the label transfer constraints and feature mapping relationship that conform to the entity annotation rules.

[0164] 5. Solving for the optimal label sequence during the inference phase:

[0165] After training, the Viterbi algorithm is used to find the globally optimal label sequence during the inference phase.

[0166]

[0167] This algorithm quickly finds the globally optimal sequence with the highest score among all candidate label sequences, completes entity boundary identification and type determination, and fundamentally avoids entity labeling errors caused by local optima.

[0168] Through the above process, high-precision entity recognition guided by relational semantics is achieved, so that the extracted entities not only have accurate boundaries, but also maintain semantic consistency with the identified relations, thus providing reliable input for the subsequent construction of relation triples.

[0169] Guided by relational semantics, the model can dynamically adjust the entity recognition strategy according to the current relation type. For example, when the "use" relation is detected, the representation of ThreatActor and Tool / Malware related tokens is enhanced first, thereby ensuring the consistency of the extracted entities in terms of semantic roles.

[0170] Finally, construct the entity collection: , where each entity Represented as a triple: , respectively, represent the start position, end position, and entity type of the entity in the text.

[0171] S50, semantic embedding is performed on each entity in the entity set to obtain the corresponding relational semantic representation, and a similarity alignment mechanism is introduced to perform entity alignment and fusion;

[0172] In a preferred embodiment of the present invention, to address the difficulty in fusion caused by numerous and inconsistent naming of multi-source entity aliases, this embodiment employs an entity alignment step based on relational context, specifically as follows:

[0173] First, for the entity set Each entity in Define the corresponding relational context set Furthermore, the relation semantic model is used to encode the relation semantics of each relation context to obtain the relation semantic representation corresponding to each relation context;

[0174] In practice, for any entity Define its relational context set as:

[0175]

[0176] in, Representing entities The first Class relationship, Representation and entity Related neighboring entities.

[0177] For each relation context, construct a local relation semantic representation:

[0178]

[0179] Among them, the function It is a relational semantic encoding function that reuses the relation-aware representation learned in the relation-driven extraction stage without introducing an additional model.

[0180] Define the token index set corresponding to the entity as follows Its relational semantic representation is obtained through pooling:

[0181]

[0182] in, It is a parameterless aggregation function, which can be either average pooling or max pooling.

[0183] Then, a relation weighting mechanism is introduced to perform weighted aggregation of the relation semantic representations corresponding to each relation context, so as to obtain the relation semantic representation of each entity;

[0184] In practical implementation, a relational weight coefficient is introduced. To characterize the importance of relationships, the overall relational semantics of entities are represented as follows:

[0185]

[0186] in, Normalization can ensure the consistency of the representation space.

[0187] Finally, the semantic similarity between cross-source entities is calculated through a similarity alignment mechanism, and entity alignment and fusion are performed based on the semantic similarity between entities.

[0188] In practice, for two entities from different data sources and Semantic similarity is defined as:

[0189]

[0190] in, For vector dot product, It is a 2-norm.

[0191] Set threshold When the following conditions are met:

[0192]

[0193] Then determine and Semantic consistency is ensured, and entity alignment and merging are performed.

[0194] S60 imports entity-relation-entity triples after entity alignment into a graph database in batches to construct a cybersecurity knowledge graph.

[0195] In practice, the entity-relation-entity triples after entity alignment are imported into the graph database to construct an indexed knowledge graph:

[0196]

[0197] in, For a set of entity nodes, Let be the set of relation edges, satisfying .

[0198] To improve query efficiency, this embodiment establishes an indexing mechanism for entity identifiers and relation types, defining the entity indexing function as follows:

[0199]

[0200] in, Representing entities Unique identifiers in graph databases are generated through hashing or encoding to ensure that entities are uniquely locatable globally. Relationship indexes are based on relation types. Establish a categorized index to accelerate relationship queries, path searches, and attack chain reasoning, significantly improving the access efficiency and response speed of knowledge graphs under large-scale threat intelligence.

[0201] The embodiments of this invention use a dataset containing 5,000 APT attack reports for verification. The experimental environment is a general deep learning framework, with F1 score for relation extraction and F1 score for entity recognition as the core evaluation indicators.

[0202] Experimental results show that:

[0203] 1. The relational semantic model used in this invention can achieve an F1 score of up to 99% for extracting attack relations such as use, exploit, target, located_at, download, and belong_to, and can stably and accurately identify attack behavior semantics in text.

[0204] 2. Guided by relational semantics, the entity recognition F1 score is improved by 3%–5% compared to the traditional "entity first, relation later" pipeline method, effectively suppressing the propagation of entity recognition errors to the relation extraction stage and significantly reducing entity boundary misjudgment, type misclassification, and omissions.

[0205] 3. The entity alignment method based on relational context can effectively solve the problem of multiple aliases for entities such as APT organizations, malware, and vulnerabilities, significantly improve the accuracy of cross-source intelligence fusion, and significantly reduce entity redundancy and mismatch rates.

[0206] 4. The constructed knowledge graph can completely reconstruct the APT attack chain, clearly presenting the multi-hop relationships between threat actors, tools, vulnerabilities, assets, and attack behaviors. It supports automatic completion of attack paths and rapid source tracing. In real APT cases, it can completely extract key information such as attack organizations, attack tools, C2 addresses, victims, and attack methods.

[0207] In summary, this embodiment can achieve high-precision, high-robustness, and high-efficiency construction of network security knowledge graphs, which can meet the practical engineering needs of complex APT threat analysis, multi-source intelligence fusion, and intelligent security decision-making.

[0208] The above description discloses only one preferred embodiment of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art will understand that all or part of the processes of the above embodiments can be implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

[0209] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

Claims

1. A method for constructing a relationship-driven cybersecurity knowledge graph, characterized in that, Includes the following steps: After collecting and preprocessing multi-source heterogeneous network security data, a token semantic vector sequence is obtained; The token semantic vector sequence is subjected to relation detection and classification based on a pre-trained relational semantic model to obtain relation vectors; wherein, the relational semantic model is a structured knowledge representation that includes explicit relations and implicit inference relations by constructing a unified framework of relational semantic system and relational reasoning rules. The relationship vector and the token semantic vector sequence are weighted and fused to obtain an enhanced feature vector; The label is predicted for each token of the enhanced feature vector using a sequence labeling model, and the entity boundary and entity type are parsed to construct an entity set. Semantic embedding is performed on each entity in the entity set to obtain the corresponding relational semantic representation, and a similarity alignment mechanism is introduced to perform entity alignment and fusion; Batch import entity-relation-entity triples after entity alignment into a graph database to construct a cybersecurity knowledge graph.

2. The method for constructing a relationship-driven network security knowledge graph as described in claim 1, characterized in that, The modeling process of the relational semantic model is as follows: The entity space and relation space of network security data are formally defined, and a relational semantic system with entity type constraints is constructed through a type constraint mechanism. Relational compound operations are performed using relational operation mechanisms, and a family of relational reasoning rules is established. By performing relational closure operations, a structured knowledge representation containing explicit relations and implicit inference relations is output.

3. The method for constructing a relationship-driven network security knowledge graph as described in claim 1, characterized in that, After preprocessing the collected multi-source heterogeneous network security data, a token semantic vector sequence is obtained, specifically: Data cleaning is performed on the collected multi-source heterogeneous network security data, including removing HTML tags, abnormal symbols, duplicate content, and low-information text; the cleaned data is then segmented into sentence-level input units. Each sentence is standardized, including case unification, symbol normalization, and terminology standardization; the standardized sentences are then tokenized to obtain a sequence of token semantic vectors.

4. The method for constructing a relationship-driven network security knowledge graph as described in claim 1, characterized in that, Collecting multi-source heterogeneous network security data, specifically: By leveraging web crawling technology and open interfaces, threat intelligence data from various sources is automatically captured and integrated; these sources include APT attack reports, official announcements, security vendor intelligence platforms, and community and forum information.

5. The method for constructing a relationship-driven network security knowledge graph as described in claim 1, characterized in that, The pre-trained relational semantic model performs relation detection and classification on the token semantic vector sequence to obtain relation vectors, specifically as follows: The preprocessed token semantic vector sequence is input into the pre-trained relation semantic model. The model's linear classification layer calculates the multi-label relation score for the context semantic vector of each token, and then performs independent probability calculation for each type of relation, outputting the relation vector.

6. The method for constructing a relationship-driven network security knowledge graph as described in claim 1, characterized in that, The step of weightedly fusing the relation vector with the token semantic vector sequence to obtain the enhanced feature vector specifically includes: The relation vector is concatenated with the context semantic vector of each token to construct a concatenated feature vector; The relation vector is mapped to a relation embedding vector, and dynamic weight allocation is performed through a gating mechanism. The relation embedding vector is then weighted and fused with the concatenated feature vector to obtain an enhanced feature vector.

7. The method for constructing a relationship-driven network security knowledge graph as described in claim 1, characterized in that, The step of predicting the label for each token in the enhanced feature vector using a sequence labeling model, parsing the entity boundary and entity type, and constructing an entity set specifically includes: The enhanced feature vector is input into the linear mapping layer of the sequence labeling model to obtain the emission score of each token in the label space, and the emission score sequence is output. By introducing a conditional random field layer, given a conditional probability distribution and the input emission score sequence, the optimal label sequence that maximizes the conditional probability is solved using the Viterbi algorithm. Based on the optimal label sequence, the entity boundaries and entity types are parsed, and an entity set is constructed, where each entity is represented as a triplet of the entity's start position, end position, and entity type in the text.

8. The method for constructing a relationship-driven network security knowledge graph as described in claim 1, characterized in that, The process of semantically embedding each entity in the entity set to obtain a corresponding relational semantic representation, and introducing a similarity alignment mechanism for entity alignment and fusion, specifically includes: For each entity in the entity set, a corresponding set of relational contexts is defined, and each relational context is semantically encoded using the relational semantic model to obtain the relational semantic representation corresponding to each relational context; A relation weighting mechanism is introduced to perform weighted aggregation of the relation semantic representations corresponding to each relation context, thereby obtaining the relation semantic representation of each entity. The semantic similarity between cross-source entities is calculated through a similarity alignment mechanism, and entity alignment and fusion are performed based on the semantic similarity between entities.

Images