Data detection method, device, electronic equipment and storage medium

Abstract

The present application discloses a data detection method, device, electronic device and storage medium. The data detection method includes: determining a first business type to which the received data to be detected belongs; if it is determined that a baseline subgraph of the first business type is matched from a constructed network security knowledge graph, extracting entities and relationships between entities in the data to be detected, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field; matching entities and relationships between entities in the data to be detected with the baseline subgraph of the first business type to obtain a first matching result; matching entities and relationships between entities in the data to be detected with baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type to obtain a second matching result; and determining a detection result of the data to be detected based on the first matching result and the second matching result.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a data detection method, device, electronic device and storage medium. Background Art

[0002] With the development of computer networks and the increasing complexity of network security environments, network attacks occur frequently. In order to ensure the security of cyberspace, network security protection devices such as firewalls and IPS (Intrusion Prevention System) are deployed to detect abnormal behaviors in network traffic. At present, rule matching is usually used to detect abnormal behaviors in network traffic data. An abnormal behavior detection model is constructed by pre-set fixed rules, and data detection is performed using the abnormal behavior detection model. However, this abnormal behavior detection model constructed by setting fixed rules cannot fully cover the detection of data of different business types, and the detection accuracy and efficiency are not high, and it is impossible to detect behavioral correlations in data of different business types. Summary of the invention

[0003] In order to solve the problems in the background technology, the embodiments of the present application provide a data detection method, device, electronic device and storage medium.

[0004] In a first aspect, an embodiment of the present application provides a data detection method, including:

[0005] Receiving data to be detected, and determining a first service type to which the data to be detected belongs;

[0006] If it is determined that the baseline subgraph of the first business type is matched from the constructed network security knowledge graph, then the entities and the relationships between the entities in the data to be detected are extracted, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field, and the baseline subgraph of any business type is a knowledge graph constructed based on the entities and the relationships between the entities extracted from the historical intelligence text data set of any business type, and the network security knowledge graph is generated by fusion of the association relationships of the entities in the baseline subgraphs of the at least two business types;

[0007] Matching the entities and the relationships between the entities in the data to be detected with the baseline subgraph of the first business type to obtain a first matching result; and

[0008] Matching the entities and the relationships between the entities in the data to be detected with the baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type to obtain a second matching result;

[0009] A detection result of the data to be detected is determined according to the first matching result and the second matching result.

[0010] In a possible implementation manner, after determining the first service type to which the to-be-detected data belongs, the method further includes:

[0011] If it is determined that the baseline subgraph of the first business type is not matched from the network security knowledge graph, obtaining a historical intelligence text dataset of the first business type;

[0012] constructing a baseline subgraph of the first business type based on entities and relationships between entities extracted from the historical intelligence text dataset of the first business type;

[0013] The baseline subgraph of the first business type is integrated into the network security knowledge graph according to the association relationship between the entities in the baseline subgraph of the first business type and the entities in the baseline subgraphs of each existing business type in the network security knowledge graph.

[0014] In a possible implementation manner, a baseline subgraph of any service type is constructed in the following manner:

[0015] Obtain a historical intelligence text dataset of any of the business types;

[0016] Extracting entities in each intelligence text in the historical intelligence text dataset according to a preset entity recognition model;

[0017] Extracting the relationship between entities in each intelligence text according to a preset relationship extraction rule;

[0018] A baseline subgraph of the business type is constructed according to the entities in each intelligence text and the relationships between the entities.

[0019] In a possible implementation, the preset entity recognition model includes a first pre-trained model, a second pre-trained model and a sequence labeling model;

[0020] Extracting entities in each intelligence text in the historical intelligence text dataset according to a preset entity recognition model specifically includes:

[0021] For each intelligence text in the historical intelligence text data set, perform word segmentation on the intelligence text, input each word obtained after word segmentation into the first pre-training model, and obtain corresponding word vectors;

[0022] Inputting each of the word vectors into the second pre-trained model to obtain entity type vectors corresponding to each of the words;

[0023] The entity type vectors corresponding to the respective words are input into the sequence labeling model to obtain entity recognition results corresponding to the respective words.

[0024] In a possible implementation, the first pre-trained model is an adaptive Bert model, and the adaptive Bert model uses the following formula to perform position encoding on the word vector of the current position word:

[0025]

[0026]

[0027] Wherein, AG-POSVEC(pos) represents the position encoding of the word vector of the current position word;

[0028] pos represents the position of the current position word in the current sentence;

[0029] α and β are balance factors;

[0030] d represents the dimension of the word vector;

[0031] LN(pos,θ) is the position encoding loss regularization term, represents the expected loss of the Bert model, λ is the step size, μ is the tolerance factor, represents the loss function of the Bert model, y represents the true label of the word at the current position, θ is the parameter of the Bert model, It represents the predicted value of the label of the word at the current position under the condition that the Bert model parameter is θ. represents the predicted value of the label of the corresponding word when entering λ positions from the current position, express and The sum of errors.

[0032] In a possible implementation, the sequence labeling model includes a CRF layer, and the CRF layer predicts the best path of the entity category to which the current position word belongs. The scoring formula is:

[0033]

[0034]

[0035] Wherein, score(k,v) is the score of the best path of the entity category to which the current position word belongs, k represents the annotation sequence of the i-th sub-block of the sentence to which the current position word belongs, and v represents the word vector of the current position word;

[0036] L(n i-1 ,ni ,v,t i ,b i ) represents two adjacent sub-blocks n i-1 and n i The label input word vector v of , the transfer score of the label between the starting position and the ending position of the i-th sub-block;

[0037] n i represents the i-th sub-block, n i-1 represents the i-1th sub-block; s i represents the position of the starting tag of the i-th sub-block in the sentence to which the current position word belongs, b i represents the position of the end tag of the i-th sub-block in the sentence to which the current position word belongs, and w represents the weight coefficient;

[0038] O i represents the normalized score corresponding to the i-th sub-block;

[0039] represents the transition score from the i-1th sub-block to the i-th sub-block, A weight parameter vector representing the word vector label.

[0040] In a second aspect, an embodiment of the present application provides a data detection device, including:

[0041] A receiving unit, configured to receive data to be detected and determine a first service type to which the data to be detected belongs;

[0042] An extraction unit, configured to extract entities and relationships between entities in the data to be detected if it is determined that a baseline subgraph of the first business type is matched from the constructed network security knowledge graph, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field, the baseline subgraph of any business type is a knowledge graph constructed based on entities and relationships between entities extracted from a historical intelligence text data set of any business type, and the network security knowledge graph is generated by fusion of association relationships between entities in the baseline subgraphs of the at least two business types;

[0043] A first matching unit is configured to match the entities and the relationships between the entities in the data to be detected with the baseline subgraph of the first business type to obtain a first matching result; and

[0044] A second matching unit is used to match the entities and the relationships between the entities in the data to be detected with the baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type to obtain a second matching result;

[0045] A determination unit is used to determine a detection result of the data to be detected according to the first matching result and the second matching result.

[0046] In a possible implementation manner, the device further includes:

[0047] An acquisition unit, configured to, after determining the first business type to which the data to be detected belongs, acquire a historical intelligence text data set of the first business type if it is determined that no baseline subgraph of the first business type is matched from the network security knowledge graph;

[0048] A construction unit, configured to construct a baseline subgraph of the first business type based on entities and relationships between entities extracted from a historical intelligence text dataset of the first business type;

[0049] A fusion unit is used to fuse the baseline subgraph of the first business type into the network security knowledge graph according to the association relationship between the entities in the baseline subgraph of the first business type and the entities in the baseline subgraphs of each business type already in the network security knowledge graph.

[0050] In a possible implementation, the extraction unit is specifically used to construct a baseline subgraph of any business type in the following manner: obtain a historical intelligence text data set of any business type; extract entities in each intelligence text in the historical intelligence text data set according to a preset entity recognition model; extract the relationship between the entities in each intelligence text according to preset relationship extraction rules; and construct a baseline subgraph of the business type based on the entities in each intelligence text and the relationship between the entities.

[0051] In a possible implementation, the preset entity recognition model includes a first pre-trained model, a second pre-trained model and a sequence labeling model;

[0052] The extraction unit is specifically used to perform word segmentation processing on each intelligence text in the historical intelligence text data set, input each word obtained after word segmentation into the first pre-training model to obtain corresponding word vectors; input each word vector into the second pre-training model to obtain the entity type vector corresponding to each word; input the entity type vector corresponding to each word into the sequence labeling model to obtain the entity recognition result corresponding to each word.

[0053] The technical effects of the data detection device provided in the present application can refer to the technical effects of the above-mentioned first aspect or each implementation method of the first aspect, and will not be repeated here.

[0054] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data detection method described in the present application when executing the program.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the data detection method described in the present application.

[0056] The beneficial effects of the embodiments of the present application are as follows:

[0057] The data detection method, device, electronic device and storage medium provided in the embodiments of the present application receive data to be detected, determine a first business type to which the data to be detected belongs, and if it is determined that a baseline subgraph of the first business type is matched from the constructed network security knowledge graph, extract the entities and the relationships between the entities in the data to be detected, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field, the baseline subgraph of any business type is a knowledge graph constructed based on the entities and the relationships between the entities extracted from the historical intelligence text data set of any business type, and the network security knowledge graph is generated by fusing the association relationships of the entities in the baseline subgraphs of the at least two business types, and then, match the entities and the relationships between the entities in the extracted data to be detected with the baseline subgraph of the first business type to obtain a first matching result, and match the entities and the relationships between the entities in the data to be detected with the baseline subgraph of the first business type except the baseline subgraph in the network security knowledge graph. The baseline subgraphs of other business types other than the baseline subgraph of the first business type are matched to obtain a second matching result, and the detection result of the data to be detected is determined based on the first matching result and the second matching result. The data detection method provided in the embodiment of the present application integrates the baseline subgraphs constructed in different fields (or scenarios) corresponding to multiple business types in the network security field to generate a network security knowledge graph covering multiple business types, and performs multi-scenario association analysis on abnormal behaviors in the data to be detected. Compared with the traditional detection method based on a single scenario and setting fixed rules, there is no need to set separate detection rules for scenarios corresponding to different business types. Therefore, the detection efficiency is higher. In addition, the baseline subgraphs of different business types in the embodiment of the present application are knowledge graphs constructed based on entities and relationships between entities extracted from corresponding historical intelligence text data sets. The detection accuracy is higher, and the detection of behavioral association relationships in data of different business types is realized.

[0058] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0060] Figure 1 A schematic diagram of the implementation process of the data detection method provided in the embodiment of the present application;

[0061] Figure 2 A schematic diagram of an implementation process for constructing a baseline subgraph of any business type provided in an embodiment of the present application;

[0062] Figure 3 A schematic diagram of an implementation process for extracting entities from each intelligence text in a historical intelligence text data set of any business type provided in an embodiment of the present application;

[0063] Figure 4 An example diagram of a baseline subgraph in the database field, which is a business type provided for an embodiment of the present application;

[0064] Figure 5 An example diagram of a baseline sub-graph with the business type of the email field provided in the embodiment of the present application;

[0065] Figure 6 A network security knowledge graph obtained by fusing a baseline subgraph in the database field with a baseline subgraph in the email field as a business type provided in an embodiment of the present application;

[0066] Figure 7 A schematic diagram of matching the data to be detected and the network security knowledge graph provided in the embodiment of the present application;

[0067] Figure 8 A schematic diagram of the structure of a data detection device provided in an embodiment of the present application;

[0068] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to solve the problems in the background technology, the embodiments of the present application provide a data detection method, device, electronic device and storage medium.

[0070] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0071] In this article, it is necessary to understand that the technical terms involved in this application are:

[0072] Network security knowledge graph: A knowledge graph is a semantic network that formally describes things and relationships in the real world. A knowledge graph is generally represented by triples. The basic relationship forms of triples are mainly <concept, attribute, attribute value> and <entity 1, relationship, entity 2>, etc.

[0073] The network security knowledge graph targets knowledge in the field of network security, and the entities and relationships described are also mainly targeted at the field of network security.

[0074] like Figure 1 As shown, it is a schematic diagram of the implementation process of the data detection method provided in the embodiment of the present application. The data detection method can be applied to network security defense equipment, and specifically may include the following steps:

[0075] S11. Receive data to be detected, and determine a first service type to which the data to be detected belongs.

[0076] In specific implementation, the data to be detected can be structured data, semi-structured data or unstructured data, and the business type represents the field to which the data belongs, such as database field, email field, etc.

[0077] The network security defense device receives the data to be detected (ie, real-time network traffic data), and can match the business type of the data to be detected by regular matching to determine the business type of the data to be detected, which can be recorded as the first business type.

[0078] S12. If it is determined that a baseline subgraph of the first business type is matched from the constructed network security knowledge graph, entities in the data to be detected and the relationships between the entities are extracted.

[0079] Among them, entities and relationships between entities are the basic elements of the knowledge graph, and entities are data objects, such as: IP address, email address, URL, domain name, user name, database name, database table name, vulnerability number, etc. The relationship between entities represents the connection method between data objects. In the embodiment of the present application, the network security defense device pre-constructs a network security knowledge ontology based on relevant network security standards in the field of network security. The network security knowledge ontology defines the entities in the field of network security and the relationships between entities. In addition, the network security knowledge ontology can also include attribute types of entities (i.e., nodes).

[0080] The network security knowledge graph includes baseline subgraphs of at least two business types in the network security field. The baseline subgraph of any business type is a knowledge graph constructed based on entities and relationships between entities extracted from the historical intelligence text dataset of any business type. The network security knowledge graph is generated by fusion of the association relationships of entities in the baseline subgraphs of the at least two business types.

[0081] In specific implementation, the network security defense device pre-constructs baseline subgraphs for different fields (i.e., different business types) in the field of network security, and then integrates the association relationships between entities in the baseline subgraphs of different business types to generate a network security knowledge graph. If the baseline subgraphs of each different business type are recorded as baseline subgraphs of vertical fields, the generated network security knowledge graph containing the baseline subgraphs of each different business type can be recorded as: network security knowledge graph of general fields.

[0082] Specifically, you can follow the Figure 2 The process shown builds a baseline subgraph for any business type:

[0083] S21. Obtain a historical intelligence text dataset of any business type.

[0084] The network security defense device can use crawler technology to obtain unstructured data sets in the field of network security in advance. The data in the unstructured data set is text data. Since unstructured text data has different formats, special symbols (such as HTML (Hyper Text Markup Language) tags, XML (Extensible Markup Language) tags, illegal characters) and other problems, it is necessary to pre-process the text data in the unstructured data set (i.e., data cleaning). The pre-processing mainly includes: (1) sentence segmentation processing, which can be performed according to commonly used punctuation marks such as commas, periods, exclamation marks, semicolons, question marks, etc., (2) removing useless symbols, such as special symbols such as HTML tags and XML tags, characters such as brackets. In the implementation process, it is possible to obtain, but not limited to, historical intelligence text data sets, mainly network security research reports written by security researchers, such as APT (Advanced Persistent Threat) reports, malware special reports, etc., which are not limited to this embodiment of the present application. In the embodiment of the present application, the unstructured data used is only illustrated by intelligence text data as an example.

[0085] Specifically, the network security defense device uses crawler technology to obtain historical intelligence text data sets in the network security field, classifies the intelligence texts in the obtained historical intelligence text data sets according to the business type, and obtains historical intelligence text data sets of each business type. Data cleaning is performed on each historical intelligence text in the historical intelligence text data set of each business type, and each historical intelligence text is segmented and useless symbols are removed.

[0086] S22. Extract entities from each intelligence text in the historical intelligence text dataset according to a preset entity recognition model.

[0087] In a specific implementation, the preset entity recognition model may include a first pre-trained model, a second pre-trained model and a sequence labeling model, wherein the first pre-trained model may use a Bert (Bidirectional Encoder Representation from Transformers, based on a bidirectional encoder representation of a Transformer) model. In order to achieve a more accurate word vector representation in the embodiment of the present application, the conventional Bert model is improved, and an adaptive Bert model is proposed. The adaptive Bert model in the present application improves the conventional Bert pre-trained model as follows:

[0088] The adaptive BERT model in this application uses the following formula to positionally encode the word vector of the current position word:

[0089]

[0090]

[0091] Wherein, AG-POSVEC(pos) represents the position encoding of the word vector of the current position word;

[0092] pos represents the position of the current position word in the current sentence;

[0093] α and β are balance factors used to adjust the encoding representation of adjacent positions;

[0094] d represents the dimension of the word vector of the word at the current position;

[0095] LN(pos,θ) is the position encoding loss regularization term, represents the expected loss of the Bert model, λ is the step size, μ is the tolerance factor, represents the loss function of the Bert model, y represents the true label of the word at the current position, θ is the parameter of the Bert model, It represents the predicted value of the label of the word at the current position under the condition that the Bert model parameter is θ. represents the predicted value of the label of the corresponding word when entering λ positions from the current position, express and The sum of errors.

[0096] Among them, the position of the word vector of the current position word is the position of the current position word.

[0097] In the above formula, the setting of the smoothing term LN(pos,θ) utilizes the idea of ​​adversarial training, and takes the expectation of minimizing the loss of the Bert model as the smoothing term. The step size λ takes into account the contextual representation of the word vector of the word at the current position, and can be flexibly set according to the sentence length. The tolerance factor μ is used to adjust the maximum loss between the current position and the farthest position in the window (the loss value is the normalized loss value). According to the above formula, the contextual relationship of different sentence lengths can be adaptively adjusted, the overall flexibility of the Bert model can be changed, and the parameters can be adjusted according to the change of the error, which is conducive to the recognition of entity objects with similar semantics but distant locations in entity recognition tasks.

[0098] The second pre-training model can be but is not limited to using the Transformer model, which is not limited in the embodiments of the present application; the sequence labeling model can use BiLSTM (Bi-directional Long Short-Term Memory) + CRF (Conditional Random Field), wherein the BiLSTM model is composed of a forward LSTM (Long Short-Term Memory) model and a backward LSTM model, and a layer of CRF model is added after the BiLSTM model to form a sequence labeling model. The sequence labeling model can also use BiLSTM + CRF (Conditional Random Field) and other arbitrary sequence labeling models that can be used for entity recognition tasks, which is not limited in the embodiments of the present application. Among them, BiLSTM + CRF is a sequence labeling model composed of a layer of CRF model (which can be recorded as a CRF layer) added after the BiLSTM model.

[0099] In one implementation, the preset entity recognition model uses an adaptive Bert model as the first pre-training model, a Transformer model as the second pre-training model, and a BiLSTM+CRF model as the sequence labeling model as an example. The entity recognition model training process is as follows:

[0100] The network security defense device uses crawler technology to obtain unstructured data sets in the field of network security. Specifically, it can obtain intelligence text data sets, and use each intelligence text in the obtained intelligence text data set as a training sample, wherein the intelligence text data set contains intelligence texts of different business types (i.e., fields), and pre-processes the data cleaning of each intelligence text according to the aforementioned data cleaning method, and performs word segmentation processing on each intelligence text sample after pre-processing. The main purpose of word segmentation is to build a vocabulary, and each intelligence text sample is segmented in combination with the business type (i.e., the field or scene to which the intelligence text sample belongs), and extracts characteristic words of different business types (or fields) to build a vocabulary, such as database name, database table name, user name and other information, and filters irrelevant information, such as msgtype, sip, app, app_proto, etc., wherein the word segmentation algorithm can be but not limited to the use of hidden Markov model, and the word segmentation tool can use jieba tool, and then, each word obtained after word segmentation is input as an input sequence into the adaptive Bert model to obtain the word corresponding to each word. The output sequence of the vector is obtained, and then, each word vector output is input into the Transform model to obtain the entity type vector corresponding to each word, that is, each word in the output sequence of the Transform model is labeled as a vector of a different entity type, and the entity type vector corresponding to each word output by the Transform model is respectively input into the BiLSTM+CRF model as the feature of the sequence labeling model BiLSTM+CRF model, and the label of each word is predicted according to the BiLSTM+CRF model and the entity category vector corresponding to each word, and the error between the actual label of each pre-labeled word and the predicted label of each word is calculated according to a preset loss function, wherein the loss function can be but not limited to the use of a cross entropy loss function, which is not limited to the embodiment of the present application, and then, according to the error of the label, the entity recognition model is iteratively machine trained, that is, each parameter in the adaptive Bert model, the Transform model and the BiLSTM+CRF model is adjusted until convergence to obtain a trained entity recognition model.

[0101] In the specific implementation, the entity type vectors corresponding to each word output by the Transform model are input into the BiLSTM+CRF model as the features of the sequence labeling model BiLSTM+CRF model. The CRF layer calculates the CRF features of each sub-block in the sentence (a sub-block refers to each word obtained by segmenting a sentence) according to the CRF features of each word and the actual label of the word, and further calculates the best score of each sub-block belonging to each label (that is, the score of the best path to predict which entity category each word vector belongs to). The CRF layer calculates the scores of all labeling paths in the feature transfer matrix through the forward propagation algorithm, and obtains the loss function of the CRF layer according to the best labeling path score and the scores of all labeling paths. The Adam optimizer can be used to update the parameters of the entire model by weighting the loss functions of each part of the CRF layer until convergence, and the final trained entity recognition model is obtained. Among them, the score formula of the best path for the CRF layer to predict the entity category to which the current position word belongs is as follows:

[0102]

[0103]

[0104] Wherein, score(k,v) is the score of the best path of the entity category to which the current position word belongs, k represents the annotation sequence of the i-th sub-block of the sentence to which the current position word belongs, and v represents the word vector of the current position word;

[0105] L(n i-1 ,n i ,v,t i ,b i ) is a likelihood function, indicating that two adjacent sub-blocks n i-1 and n i The label input word vector v of , the transfer score of the label between the starting position and the ending position of the i-th sub-block;

[0106] n i represents the i-th sub-block, n i-1 represents the i-1th sub-block; s i represents the position of the starting tag of the i-th sub-block in the sentence to which the current position word belongs, b i represents the position of the end tag of the i-th sub-block in the sentence to which the current position word belongs, and w represents the weight coefficient;

[0107] O i represents the normalized score corresponding to the i-th sub-block;

[0108] represents the transition score from the i-1th sub-block to the i-th sub-block, The weight parameter vector representing the word vector label of the current position word. The sentence vector is the sum of the corresponding positions of the vectors of different sub-blocks in the sentence (i.e., the word vectors in the sentence), and can also be formed by concatenating the vectors of different sub-blocks in the sentence.

[0109] In the specific implementation process, the following Figure 3 The process shown extracts entities in each intelligence text in the historical intelligence text data set of any business type, including the following steps:

[0110] S31. For each intelligence text in the historical intelligence text data set of any business type, the intelligence text is segmented, and each word obtained after the segmentation is input into the first pre-training model to obtain corresponding word vectors.

[0111] In the specific implementation, for each intelligence text in the historical intelligence text data set of any business type, the intelligence text is segmented, and each word obtained after the segmentation is input into the adaptive Bert model in the entity recognition model to obtain the word vector corresponding to each word.

[0112] S32. Input each word vector into the second pre-training model to obtain the entity type vector corresponding to each word.

[0113] In the specific implementation, each word vector is input into the Transform model in the entity recognition model to obtain the entity type vector corresponding to each word.

[0114] S33. Input the entity type vector corresponding to each word into the sequence labeling model to obtain the entity recognition result corresponding to each word.

[0115] During specific implementation, the entity type vectors corresponding to each word are input into a sequence labeling model in an entity recognition model to obtain entity recognition results corresponding to each word and to obtain each recognized entity.

[0116] In a preferred embodiment, after obtaining each entity identified in each intelligence text, the similarity between the word vector corresponding to each identified entity and the word vector corresponding to other entities can be calculated respectively, and the entities whose word vector similarity values ​​are greater than a preset threshold are determined to be the same type of entities, and one of the entity names can be used to uniformly replace the other entities.

[0117] S23. Extract the relationship between entities in each intelligence text according to preset relationship extraction rules.

[0118] In the specific implementation, after extracting the entities in each intelligence text in the historical intelligence text data set according to the entity recognition model, the relationship between different entities in each intelligence text is extracted according to the entities and relationships between entities in the network security field defined by the network security knowledge ontology.

[0119] Furthermore, after extracting each group of entities and the relationships between entities (that is, each triple) in each intelligence text in the historical intelligence text data set of each business type, each business type and the corresponding group of entities and the relationships between entities (each triple) can be stored in a graph database (such as Neo4j, Hugegraph, OrientDB or ElasticSearch, etc.). When constructing the network security knowledge graph later, it can be directly extracted from the graph database. Compared with storage in traditional databases, the retrieval speed and retrieval efficiency are higher when querying the entities and the relationships between entities corresponding to different business types from the graph database.

[0120] S24. Construct a baseline subgraph of any business type based on the entities in each intelligence text and the relationships between the entities.

[0121] In the specific implementation, for each business type, all entities and relationships between entities corresponding to the business type are searched from the graph database, and nodes are established in the graph database, including node names and node labels. The node name indicates the meaning of the specific entity, and the node label indicates the category corresponding to the entity, that is, the attribute of the entity. According to the created nodes, edges between nodes are established. The establishment of edges depends on triples. The triples include entities and the relationships between entities. Each node corresponds to an entity, and the edge between each two nodes corresponds to the relationship between two entities. For example, when the business type is the database field, "User1" and "DbBase" are two different entities in the same database log. "User1" and "DbBase" are node names. The node label corresponding to "User1" is "user", and the node label corresponding to "DbBase" is "database". The relationship between "User1" and "DbBase" is "access". The label of the relationship can be defined according to different business types. The nodes corresponding to the entities are connected through the edges corresponding to the relationships between the entities to construct the knowledge graph corresponding to each business type, that is, the baseline subgraph corresponding to each business type. Then, the baseline subgraphs corresponding to each business type are fused to obtain the network security knowledge graph. The fusion method is as follows: according to the common nodes (i.e. entities) in the baseline subgraph corresponding to each business type, these nodes (entities) are directly migrated to the baseline subgraph corresponding to another business type, and each baseline subgraph is fused by traversing each node. When visualizing the network security knowledge graph, entities with different labels (i.e. entities of different categories) and relationships can be displayed in different colors.

[0122] The domain corresponding to each business type may include multiple sub-domains. For example, the database domain may include sub-scenarios such as abnormal client access to the database, abnormal client access to the database table, and abnormal client access to the database user. The email domain may include logging in to the same email account from different IP addresses, logging in to multiple email accounts from the same IP address, etc.

[0123] Let's take an example to illustrate this. Assume that the business type is the baseline subgraph in the database field. Figure 4 As shown, the baseline subgraph for the business type of the email domain is as follows Figure 5 As shown, Figure 4 The baseline subgraph of the database domain shown includes the following entities: "Place1", "User1", "141.1.1.5", "User1@163.com", "DbBase" and "TbBase", where the label of "Place1" is: place name, the label of "User1" is: user, the label of "141.1.1.5" is: IP, the label of "User1@163.com" is: email account, the label of "DbBase" is: database, and the label of "TbBase" is: database table. The relationship between "User1" and "Place1" is: locate, which means: "User1" is located at "Place1"; the relationship between "User1" and "141.1.1.5" is: has-a, which means: "User1"'s IP is "141.1.1.5"; the relationship between "User1" and "User1@163.com" is: has-a, which means: "User1"'s email account is "User1@163.com"; the relationship between "User1" and "DbBase" is: access, which means: "User1" accesses the database "DbBase"; the relationship between "User1" and "TbBase" is: access, which means: "User1" accesses the database table "TbBase". Figure 5The baseline subgraph of the mail domain shown in the figure contains the following entities: "User1@163.com", "Place1", "141.1.1.5", and "User1". The relationship between "User1@163.com" and "Place1" is: login, which means: "User1@163.com" logged into "Place1". The relationship between "User1@163.com" and "141.1.1.5" is: login, which means: IP "141.1.1.5" logged into the mailbox "User1@163.com". The relationship between "User1@163.com" and "User1" is: has-a, which means: "User1"'s mailbox account is "User1@163.com". Then Figure 4 The baseline subgraph shown in Figure 5 The network security knowledge graph obtained by fusing the baseline subgraphs shown in Figure 6 shown.

[0124] After determining the first business type to which the data to be detected belongs, if it is determined that the baseline subgraph of the first business type is not matched from the network security knowledge graph, then obtain the historical intelligence text data set of the first business type; construct the baseline subgraph of the first business type based on the entities extracted from the historical intelligence text data set of the first business type and the relationships between the entities; merge the baseline subgraph of the first business type into the network security knowledge graph based on the association relationship between the entities in the baseline subgraph of the first business type and the entities in the baseline subgraphs of each business type already in the network security knowledge graph, and then execute step S13. In this way, the business subgraphs of different business types contained in the network security knowledge graph can be continuously improved during the data detection process, and the universality of the established network security knowledge graph can be improved.

[0125] S13: Match the entities and the relationships between the entities in the data to be detected with the baseline subgraph of the first business type to obtain a first matching result.

[0126] In specific implementation, the entities and the relationships between entities in the data to be detected are matched with the baseline subgraph of the first business type. If the baseline subgraph of the first business type contains the entities in the data to be detected, it is determined whether the entities and the relationships between entities in the data to be detected are consistent with the corresponding entities and the relationships between entities in the baseline subgraph of the first business type. If they are consistent, it is determined that the behavioral events constituted by the relationships between entities in the data to be detected are normal; otherwise, it is determined that the behavioral events constituted by the relationships between entities in the data to be detected are abnormal, and an abnormal alarm is triggered.

[0127] S14. Match the entities and the relationships between the entities in the data to be detected with the baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type to obtain a second matching result.

[0128] In specific implementation, after matching the entities and the relationships between entities in the data to be detected with the baseline subgraph of the first business type, the entities and the relationships between entities in the data to be detected are further matched with the baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type, to obtain other behavioral events between the entities in the data to be detected and the entities in the subgraphs of other business types.

[0129] S15. Determine a detection result of the to-be-detected data according to the first matching result and the second matching result.

[0130] In specific implementation, the matching results of the entities and inter-entity relationships in the data to be detected with the baseline subgraph of the first business type to which they belong, as well as the matching results of the entities and inter-entity relationships in the data to be detected with baseline subgraphs of other types except the baseline subgraph of the first business type, are determined as the final detection results of the data to be detected.

[0131] Continuing with the above example, assuming that the business type of the data to be detected is the email field, the entities extracted from the data to be detected include: email accounts "User1@163.com" and "User2@outlook.com", IP "192.4.3.5", user "User2", and place name "Place2", among which the relationship between "User1@163.com" and "192.4.3.5" is: login (i.e. login), the relationship between "User1@163.com" and "User2" is: login, the relationship between "User2" and "192.4.3.5" is: has-a, the relationship between "User2" and "Place2" is: locate, the relationship between "User2" and "User2@outlook.com" is: has-a, and the relationship between "User2" and "User1" is: hostile (hostile). The above entities extracted from the data to be detected can be added according to the relationship between the entities. Figure 6 The network knowledge graph shown in FIG. 1 shows the matching results of each entity in the data to be detected and its business type, that is, the baseline subgraph of the email field, as well as the matching results of each entity in the data to be detected and the baseline subgraph of the database field. Specifically, Figure 7 As shown, in Figure 7In the example, entities of the same type are displayed in the same color, and entities of different types are displayed in different colors. The behavior events that occurred can be derived from the entities and the relationships between them. Figure 7 As can be seen from the figure, the matching results include the following abnormal behavior events: abnormal client access to the database, abnormal client access to the database table, abnormal client access to the database user, remote IP login to the same email account, and the same IP login to multiple email accounts. Figure 6 and Figure 7 It can be seen that "User2" and "192.4.3.5" are not in Figure 4 In the baseline subgraph shown, Figure 5 In the baseline subgraph shown, the existing baseline subgraph can be used to retrieve behavior events that do not conform to the baseline. For example, IP "192.4.3.5" logged into the mailboxes "User1@163.com" and "User2@outlook.com". It can be analyzed that the user "User2" with IP "192.4.3.5" had an abnormal behavior event of logging into multiple mailbox accounts with the same IP, and IP "192.4.3.5" and "141.1.1.5" logged into the mailbox "User1@163.com" at the same time. It can be analyzed that the user "User2" with IP "192.4.3.5" had an abnormal behavior event of logging into the same mailbox account with a different IP. User "User2" is an illegal user and has abnormal behaviors in multiple other scenarios (such as abnormal client access to the database, abnormal client access to the database table, etc.). User "User2" should be blocked in time to avoid security risks.

[0132] In the data detection method provided by the embodiment of the present application, a network security defense device receives data to be detected, determines a first business type to which the data to be detected belongs, and if it is determined that a baseline subgraph of the first business type is matched from the constructed network security knowledge graph, then entities in the data to be detected and relationships between entities are extracted, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field, and the baseline subgraph of any business type is a knowledge graph constructed based on entities and relationships between entities extracted from a historical intelligence text data set of any business type, and the network security knowledge graph is generated by fusing the association relationships of entities in the baseline subgraphs of the at least two business types, and then, the entities and relationships between entities in the extracted data to be detected are matched with the baseline subgraph of the first business type to obtain a first matching result, and the entities and relationships between entities in the data to be detected are matched with the baseline subgraph of the first business type except the first matching result in the network security knowledge graph. The baseline subgraphs of other business types other than the baseline subgraph of the business type are matched to obtain a second matching result, and the detection result of the data to be detected is determined according to the first matching result and the second matching result. The data detection method provided in the embodiment of the present application integrates the baseline subgraphs constructed in different fields (or scenarios) corresponding to multiple business types in the network security field to generate a network security knowledge graph covering multiple business types, and performs multi-scenario association analysis on abnormal behaviors in the data to be detected. Compared with the traditional detection method based on a single scenario and setting fixed rules, there is no need to set separate detection rules for scenarios corresponding to different business types. Therefore, the detection efficiency is higher. In addition, the baseline subgraphs of different business types in the embodiment of the present application are knowledge graphs constructed based on entities and relationships between entities extracted from corresponding historical intelligence text data sets. The detection accuracy is higher, and the detection of behavioral association relationships in data of different business types is realized.

[0133] Based on the same inventive concept, an embodiment of the present application also provides a data detection device. Since the principle of solving the problem by the above-mentioned data detection device is similar to that of the data detection method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0134] like Figure 8 As shown, it is a schematic diagram of the structure of the data detection device provided in an embodiment of the present application, which may include:

[0135] A receiving unit 41 is used to receive data to be detected and determine a first service type to which the data to be detected belongs;

[0136] An extraction unit 42 is used to extract entities and relationships between entities in the data to be detected if it is determined that a baseline subgraph of the first business type is matched from the constructed network security knowledge graph, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field, and the baseline subgraph of any business type is a knowledge graph constructed based on entities and relationships between entities extracted from a historical intelligence text data set of any business type, and the network security knowledge graph is generated by fusion of association relationships between entities in the baseline subgraphs of the at least two business types;

[0137] A first matching unit 43 is configured to match the entities and the relationships between the entities in the data to be detected with the baseline subgraph of the first business type to obtain a first matching result; and

[0138] A second matching unit 44 is used to match the entities and the relationships between the entities in the data to be detected with the baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type to obtain a second matching result;

[0139] The determination unit 45 is configured to determine a detection result of the to-be-detected data according to the first matching result and the second matching result.

[0140] In a possible implementation manner, the device further includes:

[0141] An acquisition unit, configured to, after determining the first business type to which the data to be detected belongs, acquire a historical intelligence text data set of the first business type if it is determined that no baseline subgraph of the first business type is matched from the network security knowledge graph;

[0142] A construction unit, configured to construct a baseline subgraph of the first business type based on entities and relationships between entities extracted from a historical intelligence text dataset of the first business type;

[0143] A fusion unit is used to fuse the baseline subgraph of the first business type into the network security knowledge graph according to the association relationship between the entities in the baseline subgraph of the first business type and the entities in the baseline subgraphs of each business type already in the network security knowledge graph.

[0144] In a possible implementation, the extraction unit 42 is specifically used to construct a baseline subgraph of any business type in the following manner: obtain a historical intelligence text data set of any business type; extract entities in each intelligence text in the historical intelligence text data set according to a preset entity recognition model; extract the relationship between the entities in each intelligence text according to preset relationship extraction rules; and construct a baseline subgraph of the business type based on the entities in each intelligence text and the relationship between the entities.

[0145] In a possible implementation, the preset entity recognition model includes a first pre-trained model, a second pre-trained model and a sequence labeling model;

[0146] The extraction unit 42 is specifically used to perform word segmentation processing on each intelligence text in the historical intelligence text data set, input each word obtained after word segmentation into the first pre-trained model to obtain corresponding word vectors; input each word vector into the second pre-trained model to obtain the entity type vector corresponding to each word; input the entity type vector corresponding to each word into the sequence labeling model to obtain the entity recognition result corresponding to each word.

[0147] In a possible implementation, the first pre-trained model is an adaptive Bert model, and the adaptive Bert model uses the following formula to perform position encoding on the word vector of the current position word:

[0148]

[0149]

[0150] Wherein, AG-POSVEC(pos) represents the position encoding of the word vector of the current position word;

[0151] pos represents the position of the current position word in the current sentence;

[0152] α and β are balance factors;

[0153] d represents the dimension of the word vector;

[0154] LN(pos,θ) is the position encoding loss regularization term, represents the expected loss of the Bert model, λ is the step size, μ is the tolerance factor, represents the loss function of the Bert model, y represents the true label of the word at the current position, θ is the parameter of the Bert model, It represents the predicted value of the label of the word at the current position under the condition that the Bert model parameter is θ. represents the predicted value of the label of the corresponding word when entering λ positions from the current position, express and The sum of errors.

[0155] In a possible implementation, the sequence labeling model includes a CRF layer, and the CRF layer predicts the best path of the entity category to which the current position word belongs. The scoring formula is:

[0156]

[0157]

[0158] Wherein, score(k,v) is the score of the best path of the entity category to which the current position word belongs, k represents the annotation sequence of the i-th sub-block of the sentence to which the current position word belongs, and v represents the word vector of the current position word;

[0159] L(n i-1 ,n i ,v,t i ,b i ) represents two adjacent sub-blocks n i-1 and n i The label input word vector v of , the transfer score of the label between the starting position and the ending position of the i-th sub-block;

[0160] n i represents the i-th sub-block, n i-1 represents the i-1th sub-block; s i represents the position of the starting tag of the i-th sub-block in the sentence to which the current position word belongs, b i represents the position of the end tag of the i-th sub-block in the sentence to which the current position word belongs, and w represents the weight coefficient;

[0161] O i represents the normalized score corresponding to the i-th sub-block;

[0162] represents the transition score from the i-1th sub-block to the i-th sub-block, A weight parameter vector representing the word vector label.

[0163] Based on the same technical concept, the embodiment of the present application also provides an electronic device 500, referring to Fig. 9As shown, the electronic device 500 is used to implement the data detection method described in the above method embodiment. The electronic device 500 of this embodiment may include: a memory 501, a processor 502, and a computer program stored in the memory and executable on the processor, such as a data detection program. When the processor executes the computer program, the steps in the above data detection method embodiments are implemented, such as Figure 2 Alternatively, the processor implements the functions of each module / unit in the above-mentioned device embodiments when executing the computer program, such as step 41.

[0164] The specific connection medium between the memory 501 and the processor 502 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 501 and the processor 502 are connected via a bus 503. The bus 503 is connected to the processor 502 via a bus 503. Fig. 9 The connection between other components is shown by bold lines, which is only for schematic illustration and is not intended to be limiting. The bus 503 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0165] The memory 501 may be a volatile memory, such as a random-access memory (RAM); the memory 501 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 501 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 501 may be a combination of the above memories.

[0166] The processor 502 is used to call the computer program stored in the memory 501 to execute the following Figure 2 The data detection method shown in .

[0167] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0168] In some possible implementations, various aspects of the data detection method provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the data detection method according to various exemplary implementations of the present application described above in this specification.

[0169] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0170] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0171] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0172] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0173] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0174] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data detection method, characterized in that: include: Receiving data to be detected, and determining a first service type to which the data to be detected belongs; If it is determined that the baseline subgraph of the first business type is matched from the constructed network security knowledge graph, then the entities and the relationships between the entities in the data to be detected are extracted, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field, and the baseline subgraph of any business type is a knowledge graph constructed based on the entities and the relationships between the entities extracted from the historical intelligence text data set of any business type, and the network security knowledge graph is generated by fusion of the association relationships of the entities in the baseline subgraphs of the at least two business types; Matching the entities and the relationships between the entities in the data to be detected with the baseline subgraph of the first business type to obtain a first matching result; and Matching the entities and the relationships between the entities in the data to be detected with the baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type to obtain a second matching result; A detection result of the data to be detected is determined according to the first matching result and the second matching result.

2. The method according to claim 1, characterized in that After determining the first service type to which the to-be-detected data belongs, the method further includes: If it is determined that the baseline subgraph of the first business type is not matched from the network security knowledge graph, obtaining a historical intelligence text dataset of the first business type; constructing a baseline subgraph of the first business type based on entities and relationships between entities extracted from the historical intelligence text dataset of the first business type; The baseline subgraph of the first business type is integrated into the network security knowledge graph according to the association relationship between the entities in the baseline subgraph of the first business type and the entities in the baseline subgraphs of each existing business type in the network security knowledge graph.

3. The method according to claim 1, characterized in that The baseline subgraph of any of the business types is constructed in the following way: Obtain a historical intelligence text dataset of any of the business types; Extracting entities in each intelligence text in the historical intelligence text dataset according to a preset entity recognition model; Extracting the relationship between entities in each intelligence text according to a preset relationship extraction rule; A baseline subgraph of the business type is constructed according to the entities in each intelligence text and the relationships between the entities.

4. The method according to claim 3, characterized in that The preset entity recognition model includes a first pre-training model, a second pre-training model and a sequence labeling model; Extracting entities in each intelligence text in the historical intelligence text dataset according to a preset entity recognition model specifically includes: For each intelligence text in the historical intelligence text data set, perform word segmentation on the intelligence text, input each word obtained after word segmentation into the first pre-training model, and obtain corresponding word vectors; Inputting each of the word vectors into the second pre-trained model to obtain entity type vectors corresponding to each of the words; The entity type vectors corresponding to the respective words are input into the sequence labeling model to obtain entity recognition results corresponding to the respective words.

5. The method according to claim 4, characterized in that The first pre-trained model is an adaptive Bert model, and the adaptive Bert model uses the following formula to positionally encode the word vector of the current position word: Wherein, AG-POSVEC(pos) represents the position encoding of the word vector of the current position word; pos represents the position of the current position word in the current sentence; α and β are balance factors; d represents the dimension of the word vector; LN(pos,θ) is the position encoding loss regularization term, represents the expected loss of the Bert model, λ is the step size, μ is the tolerance factor, represents the loss function of the Bert model, y represents the true label of the word at the current position, θ is the parameter of the Bert model, It represents the predicted value of the label of the word at the current position under the condition that the Bert model parameter is θ. represents the predicted value of the label of the corresponding word when entering λ positions from the current position, express and The sum of errors.

6. The method according to claim 4, characterized in that The sequence labeling model includes a CRF layer, and the CRF layer predicts the best path of the entity category to which the current position word belongs. The scoring formula is: Wherein, score(k,v) is the score of the best path of the entity category to which the current position word belongs, k represents the annotation sequence of the i-th sub-block of the sentence to which the current position word belongs, and v represents the word vector of the current position word; L(n i-1 ,n i ,v,t i ,b i ) represents two adjacent sub-blocks n i-1 and n i The label input word vector v of , the transfer score of the label between the starting position and the ending position of the i-th sub-block; n i represents the i-th sub-block, n i-1 represents the i-1th sub-block; s i represents the position of the starting tag of the i-th sub-block in the sentence to which the current position word belongs, b i represents the position of the end tag of the i-th sub-block in the sentence to which the current position word belongs, and w represents the weight coefficient; O i represents the normalized score corresponding to the i-th sub-block; represents the transition score from the i-1th sub-block to the i-th sub-block, A weight parameter vector representing the word vector label.

7. A data detection device, characterized in that: include: A receiving unit, configured to receive data to be detected and determine a first service type to which the data to be detected belongs; An extraction unit, configured to extract entities and relationships between entities in the data to be detected if it is determined that a baseline subgraph of the first business type is matched from the constructed network security knowledge graph, wherein the network security knowledge graph includes baseline subgraphs of at least two business types in the network security field, the baseline subgraph of any business type is a knowledge graph constructed based on entities and relationships between entities extracted from a historical intelligence text data set of any business type, and the network security knowledge graph is generated by fusion of association relationships between entities in the baseline subgraphs of the at least two business types; A first matching unit is configured to match the entities and the relationships between the entities in the data to be detected with the baseline subgraph of the first business type to obtain a first matching result; and A second matching unit is used to match the entities and the relationships between the entities in the data to be detected with the baseline subgraphs of other business types in the network security knowledge graph except the baseline subgraph of the first business type to obtain a second matching result; A determination unit is used to determine a detection result of the data to be detected according to the first matching result and the second matching result.

8. The device according to claim 7, characterized in that Also includes: An acquisition unit, configured to, after determining the first business type to which the data to be detected belongs, acquire a historical intelligence text data set of the first business type if it is determined that no baseline subgraph of the first business type is matched from the network security knowledge graph; A construction unit, configured to construct a baseline subgraph of the first business type based on entities and relationships between entities extracted from a historical intelligence text dataset of the first business type; A fusion unit is used to fuse the baseline subgraph of the first business type into the network security knowledge graph according to the association relationship between the entities in the baseline subgraph of the first business type and the entities in the baseline subgraphs of each business type already in the network security knowledge graph.

9. The device according to claim 7, characterized in that The extraction unit is specifically used to construct a baseline subgraph of any business type in the following manner: obtain a historical intelligence text data set of any business type; extract entities in each intelligence text in the historical intelligence text data set according to a preset entity recognition model; extract the relationship between the entities in each intelligence text according to preset relationship extraction rules; and construct a baseline subgraph of the business type based on the entities in each intelligence text and the relationship between the entities.

10. The device according to claim 9, characterized in that The preset entity recognition model includes a first pre-training model, a second pre-training model and a sequence labeling model; The extraction unit is specifically used to perform word segmentation processing on each intelligence text in the historical intelligence text data set, input each word obtained after word segmentation into the first pre-training model to obtain corresponding word vectors; input each word vector into the second pre-training model to obtain the entity type vector corresponding to each word; input the entity type vector corresponding to each word into the sequence labeling model to obtain the entity recognition result corresponding to each word.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the data detection method according to any one of claims 1 to 6 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the data detection method according to any one of claims 1 to 6 are implemented.

Images