Information security knowledge entity relationship connection prediction method, system and medium

Abstract

The present invention provides a method, system and medium for predicting the connection of information security knowledge entity relationships, including a data processing module: forming graph data and inputting it into a graph convolutional network representation module; preprocessing entity description text data and using the output as input to a Word2Vec representation module; a graph convolutional network representation module: receiving graph data, training a TextGCN model, and generating a graph convolutional network representation vector for the text; a Word2Vec representation module: training a Word2Vec model and generating a Word2Vec representation vector for the text; a twin network representation module: training a twin network model and generating a twin network representation vector; and a connection judgment module: calculating the Euclidean distance between the twin network representation vectors of the target entity and determining that there is a connection if the distance is less than a threshold. The present invention can accurately determine whether there is a connection between entities, ensure the accuracy of supplementary data, and reduce manual analysis costs.

Description

Technical Field

[0001] The present invention relates to the field of computer network security technology, and specifically to a method and system for predicting information security knowledge entity relationship connections based on graph convolution and word vector twin networks, providing a data basis for knowledge reasoning applications based on network security knowledge graphs, such as attack organization profiling, attack scenario construction, intranet threat analysis, vulnerability cause analysis, APT attack detection, etc., and especially to a method, system and medium for predicting information security knowledge entity relationship connections. Background Art

[0002] A knowledge graph is a collection of entities, concepts, and events in the objective world, as well as the connections between them. It presents data relationships in a structured form of a graph, making it easier to extract knowledge from data and empowering intelligent applications such as data fusion, data analysis, and data sharing. The cybersecurity knowledge graph is a knowledge graph built on the basis of the cybersecurity ontology. Its ontology mainly includes entities expressed by the following concepts and various relationships between entities: CVE (Common Vulnerabilities and Exposures), which represents discovered information security vulnerabilities; CWE (Common Weakness Enumeration), which represents the vulnerabilities that lead to vulnerabilities; CAPEC (Common Attack Pattern List), which represents the attack methods used when attacking vulnerabilities; ATT&CK (Common Knowledge Base of Attack Tactics and Techniques), which represents abstract tactics and techniques used in attacks. The construction of a cybersecurity knowledge graph is conducive to the completion of various downstream cybersecurity tasks:

[0003] 1. Attacker Organization Profiling: Attacker organization profiling involves modeling attackers and attack behaviors. The goal is to understand attack intent and predict attacks. The knowledge graph provides attributes and relationships of target attackers and behaviors, enabling a deeper understanding of the attack habits and capabilities of the attack organization.

[0004] 2. Attack scenario construction: Using the graph structure of the knowledge graph, we can visualize and analyze the attack target, attack process, and attack results. We can also extract attacker characteristics, construct an attribute graph describing the attacker's behavior, and obtain richer security semantics through correlation analysis.

[0005] 3. Intranet Threat Analysis: The knowledge graph can build relationships and conduct correlation analysis between target objects (such as target assets) and attack patterns (such as CAPEC and ATT&CK), thereby addressing the current lack of correlation between intranet detection components and reducing the manpower investment in security operations.

[0006] 4. Vulnerability Cause Analysis: CVE only identifies vulnerabilities that have been exposed in software and hardware, but does not clearly identify the cause of the vulnerability. CWE lists the vulnerabilities that lead to the vulnerability. Determining the relationship between the two helps security personnel analyze and fix the vulnerability in a timely manner.

[0007] 5. APT attack detection: APT (Advanced Persistent Threat) attacks consist of multi-step, multi-target, and highly persistent attacks. Knowledge graphs are helpful in associating these attacks and mapping low-level attacks to high-level tactical and technical matrices and kill chain models, thereby identifying APT attacks.

[0008] Various information security knowledge bases (such as the MITRE CVE, CWE, CAPEC, and ATT&CK databases) contain relationships between entities across multiple categories of concepts, such as the correspondence between CVE and CWE, and between CAPEC and ATT&CK. However, problems exist in graph construction and knowledge reasoning: As new security knowledge is added and updated, maintaining relationships between knowledge entities becomes increasingly labor-intensive. Lagging maintenance of relationship data between knowledge entities leads to numerous blind spots in the application of knowledge relationships, and the lack of connections significantly hinders knowledge reasoning. For example, some CVEs lack corresponding CWEs, making it difficult to determine the vulnerabilities exploited when certain vulnerabilities occur. There are also few connections between CAPEC and ATT&CK technologies, a critical path for analyzing low-level attack behaviors and high-level, abstract attack tactics and techniques.

[0009] Because information security knowledge contains textual descriptions of vulnerabilities and technologies, natural language processing (NLP) can be used to automatically predict relationships between these knowledge entities. For example, NLP involves calculating text similarity. By analyzing the descriptions of two entities in a graph, the relationship between them can be determined based on their textual similarity. Natural language processing technology is maturing thanks to the rapid development of deep learning. Language models trained on big data, such as BERT, have achieved excellent results in text similarity analysis.

[0010] However, there are different types of relationships between entities in information security knowledge. In addition, the relationships between entities do not simply depend on similarity. The relationships between entities are abstractions of various concepts of entities, such as different classification levels or technical abstraction types. Different relationship data cannot be shared and used. This has caused some difficulties in predicting entity relationships in information security knowledge. For example, some entities have a small number of relationships and the sample size for prediction is insufficient; some knowledge entities have a small amount of text overall, making many algorithms difficult to apply and the prediction accuracy is not high; there are many proper nouns, and word segmentation and word vector training require targeted processing processes. Summary of the Invention

[0011] In response to the deficiencies in the prior art, the present invention provides a method, system and medium for predicting information security knowledge entity relationship connections.

[0012] According to the present invention, a method, system, and medium for predicting information security knowledge entity relationship connections are provided as follows:

[0013] In a first aspect, a system for predicting information security knowledge entity relationship connections is provided, the system comprising:

[0014] Data processing module: Extract words from text data of information security knowledge, collect all text description data of information security knowledge and perform data preprocessing; use the relationship between words in the text description data of entities as the relationship between entity nodes and text vocabulary nodes to form graph data; output graph data, which serves as input to the graph convolutional network representation module; output preprocessed entity description text data, which serves as input to the Word2Vec representation module;

[0015] Graph Convolutional Network Representation Module: Receives graph data, trains the TextGCN model, and generates a graph convolutional network representation vector for the text;

[0016] Word2Vec representation module: receives preprocessed entity description text data, trains the Word2Vec model, and generates the Word2Vec representation vector of the text;

[0017] Connection judgment module: Based on the target entity’s respective twin network representation vectors, the Euclidean distance between the two is calculated. If the distance is less than the threshold, it is judged that there is a connection.

[0018] Preferably, the data processing module includes: taking words and sentences as graph nodes, PMI features and TF-IDF features as graph edges, forming graph data, and inputting the data into a graph convolutional network representation module;

[0019] Preprocessing of entity description text data includes: word segmentation based on spaces, stop word removal, and low-frequency word removal.

[0020] Preferably, the graph convolutional network representation module specifically includes: receiving graph data, dividing the training set, validation set and test set according to 7:2:1, training the TextGCN model, and generating a graph convolutional network representation vector of the text.

[0021] Preferably, in the Word2Vec representation module, the Skip-gram algorithm is used to train the Word2Vec model.

[0022] Preferably, the twin network representation module specifically includes: merging the graph convolutional network representation vector and the Word2Vec representation vector, dividing the training set, validation set and test set according to 7:2:1, training the twin network model, and generating the twin network representation vector.

[0023] In a second aspect, a method for predicting information security knowledge entity relationship connections is provided, the method comprising:

[0024] Step S1: Collect English description texts of entities in the information security knowledge base and save existing connections between entities in the database;

[0025] Step S2: Generate an information security corpus by segmenting words based on spaces, deleting stop words, and removing low-frequency words whose occurrence times are less than a threshold;

[0026] Step S3: Train the Word2Vec model to generate word vectors for each word;

[0027] Step S4: Given two categories of concepts and all entities corresponding to the concepts, all words and sentences are used as nodes of the graph, and the relationships between words in sentences are used as edges of the graph to construct graph data;

[0028] Step S5: The existing connections in step S1 are taken as positive samples, and the entity pairs without connections are taken as non-positive samples. Negative samples of the same number as the positive samples are randomly selected from the non-positive samples and divided into training sets, test sets and validation sets;

[0029] Step S6: Input the training set into the graph convolutional network, calculate the margin loss function of positive and negative samples in each training round, and update the network parameters;

[0030] Step S7: Output the vector of each node and save the vector of the sentence node as the graph convolutional network representation vector of each entity text;

[0031] Step S8: Calculate the Word2Vec representation vector of each entity text based on the word vector generated in step S3;

[0032] Step S9: For each entity text, merge the graph convolutional network representation vector and Word2Vec representation vector generated in steps S7 and S8, and divide the text into training set, test set and validation set;

[0033] Step S10: Input the training set into the Siamese network, calculate the contrast loss function of the sample pair in each training round, and use the Adam optimizer to update the network parameters;

[0034] Step S11: Input the test set sample pair into the twin network and output the vector of the two samples as the twin network representation vector.

[0035] Preferably, step S3 specifically includes: using Python's gensim library, selecting the Skip-gram algorithm to train the Word2Vec model, and generating a word vector for each word.

[0036] Preferably, step S5 comprises: randomly selecting negative samples of equal quantity to positive samples from the non-positive samples, and dividing the negative samples into a training set, a test set and a validation set in a ratio of 7:2:1.

[0037] Preferably, step S9 includes: for each entity text, merging the graph convolutional network representation vector and the Word2Vec representation vector, and dividing the training set, test set and validation set into a ratio of 7:2:1.

[0038] According to a third aspect, a computer-readable storage medium storing a computer program is provided, wherein the computer program implements the steps of the method when executed by a processor.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] 1. The present invention can accurately determine whether there are connections between entities in existing network security entity data. In the existing CAPEC and ATT&CK relationships, 500 entities of each type and 400 existing relationship pairs were collected. The system achieved a prediction accuracy of 87.7% on this dataset, with 88.1% of related entity pairs correctly classified and 86.4% of negative samples correctly classified. In the existing CVE and CWE relationships, approximately 150,000 CVE entities, 922 CWE entities, and 300,000 existing relationship pairs were collected. The system achieved a prediction accuracy of 89.8%, correctly classifying 91.9% of related entity pairs and 88.9% of unrelated entity pairs.

[0041] 2. The system of the present invention significantly improves detection accuracy in small sample prediction scenarios (such as CAPEC and ATT&CK data). Existing methods (such as BERT) have an accuracy of 78.5% on this dataset, and an accuracy of 75% on CVE and CWE data with a positive sample size reduced to 2‰. However, the system of the present invention can still achieve an accuracy of over 87% on small sample datasets.

[0042] 3. The high prediction accuracy of the present invention reduces the cost of manual judgment; it uses a graph neural network and randomly selects negative samples during training to ensure the generalization of the system and the ability to discover new connections; the model training is completed on the CPU, and the computing and storage requirements are lower than the current language model. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0044] Figure 1 Schematic diagram of the information security entity knowledge completion system based on graph convolution and word vector twin network

[0045] Figure 2 Flowchart of the information security entity knowledge completion system based on graph convolution and word vector twin network;

[0046] Figure 3 Schematic diagram of Word2Vec representation vector generation method;

[0047] Figure 4 This is the Word2Vec Skip-gram network structure diagram;

[0048] Figure 5 Schematic diagram of the vector generation method for graph convolutional networks;

[0049] Figure 6 This is the graph convolutional network structure diagram;

[0050] Figure 7 Schematic diagram of the vector generation method for the twin network representation;

[0051] Figure 8 This is the structure diagram of the twin network. DETAILED DESCRIPTION

[0052] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0053] The embodiment of the present invention provides an information security knowledge entity relationship connection prediction system, which consists of a text data processing module, a graph convolutional network representation module, a Word2Vec representation module, a twin network representation module and a connection judgment module. According to the results of the connection judgment module, new connections are added to the network security knowledge graph. The system of the present invention uses entity text description information as the original input, and after representation learning of the graph convolutional network and the twin network, it predicts whether there is a specific connection between two entities, and adds the existing and highly confident connections to the knowledge graph. Figure 1 As shown, the system specifically includes:

[0054] Data Processing Module: Entities in information security knowledge generally have natural language textual descriptions. This module processes this textual data by extracting words, collecting all textual descriptions of information security knowledge, and performing data preprocessing. This module also constructs graph data by representing the relationships between words in the textual descriptions of entities, representing the relationships between entity nodes and textual vocabulary nodes. This module outputs the graph data, which serves as input to the graph convolutional network representation module. It also outputs the preprocessed textual entity description data, which serves as input to the Word2Vec representation module.

[0055] This module preprocesses entity description text data, including: word segmentation based on spaces, stop word removal, and low-frequency word removal, and uses the output as the input of the Word2Vec representation module; using words and sentences as graph nodes, PMI features and TF-IDF features as graph edges to construct graph data, which is input into the graph convolutional network representation module.

[0056] Graph Convolutional Network Representation Module: Receives graph data, divides the training set, validation set, and test set into a 7:2:1 ratio, trains the TextGCN model, and generates a graph convolutional network representation vector for the text.

[0057] Word2Vec representation module: Receives preprocessed entity description text data, trains the Word2Vec model using the Skip-gram algorithm, and generates a Word2Vec representation vector for the text.

[0058] Twin network representation module: Merge the graph convolutional network representation vector and the Word2Vec representation vector, divide the training set, validation set, and test set into a 7:2:1 ratio, train the twin network model, and generate the twin network representation vector.

[0059] Connection judgment module: Based on the target entity’s respective twin network representation vectors, the Euclidean distance between the two is calculated. If the distance is less than the threshold, it is judged that there is a connection.

[0060] The present invention also provides an information security knowledge entity relationship connection prediction method, referring to Figure 2 Shown, including:

[0061] Step S1: Collect English description texts of entities in the information security knowledge base and save existing connections between entities in the database.

[0062] Step S2: Generate an information security corpus by segmenting words based on spaces, deleting stop words, and eliminating low-frequency words whose occurrence times are less than a threshold.

[0063] Step S3: Use Python's gensim library and the Skip-gram algorithm to train the Word2Vec model and generate word vectors for each word.

[0064] Step S4: Given two categories of concepts and all entities corresponding to the concepts, all words and sentences are used as nodes of the graph. The edge weights between words are the PMI (pointwise mutual information) features, and the edge weights between words and sentences are the TF-IDF (term frequency-inverse document frequency index) features, thereby forming graph data.

[0065] Step S5: The existing connections in step S1 are taken as positive samples, and the entity pairs without connections are taken as non-positive samples. Negative samples equal to the positive samples are randomly selected from the non-positive samples, and the training set, test set and validation set are divided into the ratio of 7:2:1.

[0066] Step S6: Input the training set into the graph convolutional network, calculate the margin loss function of positive and negative samples in each training round, and update the network parameters.

[0067] Step S7: Output the vector of each node and save the vector of the sentence node as the graph convolutional network representation vector of each entity text.

[0068] Step S8: Based on the word vector generated in step S3, calculate the Word2Vec representation vector of each entity text.

[0069] Step S9: For each entity text, merge the graph convolutional network representation vector and Word2Vec representation vector generated in steps S7 and S8, and divide the training set, test set, and validation set into a ratio of 7:2:1.

[0070] Step S10: Input the training set into the Siamese network, calculate the contrast loss function of the sample pair in each training round, and use the Adam optimizer to update the network parameters.

[0071] Step S11: Input the test set sample pair into the twin network and output the vector of the two samples as the twin network representation vector.

[0072] Next, the present invention will be described in more detail.

[0073] An embodiment of the present invention provides an information security knowledge entity relationship connection prediction system, which is composed of a text data processing module, a graph convolutional network representation module, a Word2Vec representation module, a twin network representation module and a connection judgment module. New connections are added to the network security knowledge graph according to the results of the connection judgment module. The system of the present invention uses the entity description information of existing CVE, CWE, CAPEC, and ATT&CK technologies as original input, and after learning the representation of the graph convolutional network and the twin network, it outputs whether there is a connection between CVE and CWE or CAPEC and ATT&CK entities. The connections that exist and have high confidence are added to the knowledge graph. The system is as follows Figure 1 As shown, it consists of the following modules, including:

[0074] Data processing module: Preprocesses entity description text data of CVE, CWE, CAPEC, and ATT&CK technologies, including: word segmentation based on spaces, stop word removal, and low-frequency word removal. The output of this module is directly used as input to the Word2Vec representation module; words and sentences are used as graph nodes, PMI features and TF-IDF features are used as graph edges to form graph data, which is input into the graph convolutional network representation module.

[0075] Graph Convolutional Network Representation Module: Receives graph data, divides it into training, validation, and test sets in a 7:2:1 ratio, trains the TextGCN model using the Adam optimizer based on the margin loss function, and generates a graph convolutional network representation vector for the text.

[0076] Word2Vec representation module: Receives text data, uses Python's gensim library, trains a Word2Vec model using the Skip-gram algorithm, and generates a Word2Vec representation vector for the text.

[0077] Twin network representation module: Merge the graph convolutional network representation vector and the Word2Vec representation vector, divide the training set, validation set, and test set into a 7:2:1 ratio, use the Adam optimizer to train the twin network model, and generate the twin network representation vector.

[0078] Connection judgment module: Based on the target entity’s respective twin network representation vectors, the Euclidean distance between the two is calculated. If the distance is less than the threshold, it is judged that there is a connection.

[0079] Reference Figure 3 As shown in the figure, we first collected all entity text descriptions of CVE, CWE, CAPEC, and ATT&CK technologies from the database. Data processing included tokenization based on spaces, removal of stop words, removal of special non-English characters and numbers, and removal of low-frequency words with an occurrence frequency of less than 5. Stop words were English stop words from the natural language processing toolkit NLTK. After data processing, all entity descriptions of the four concepts (CVE, CWE, CAPEC, and ATT&CK technologies) formed the information security entity description corpus and were saved as a txt file with one entity description per line. The Word2Vec model was trained using the Python gensim library, using the Skip-gram algorithm. The model output was a 100-dimensional word vector. Figure 4The Skip-gram network structure of Word2Vec is shown in the figure. Its principle is to predict the n-1 words Y1 to Yn-1 around the central word Xj. After training, input a word and the model will output the corresponding word vector. For each entity, its Word2Vec representation vector is the mean of all word vectors in the description. The Word2Vec word vector corresponding to the i-th word in the entity description is There are n words in the description, and the representation vector of the entity description is S v :

[0080]

[0081] Reference Figure 5 As shown, the data source and data processing flow are the same as the Word2Vec representation vector generation method flow. After data processing, all entity descriptions of the target concept pair (CVE and CWE, or CAPEC and ATT&CK) constitute a description corpus and are saved as a txt file in the format of one entity description per line, that is, {entity number + entity English description}. For all descriptions, sentences and words serve as sentence nodes and word nodes in the graph. TF-IDF (term frequency-inverse text frequency index) is used to evaluate the importance of words to documents or corpora. TF represents the number of times a word appears in a document, and IDF represents the number of times a word appears in all documents. The more times the word appears in a document and the fewer times the word appears in the corpus, the stronger its ability to represent a document. Word t i For document d j The TF-IDF calculation formula is:

[0082]

[0083] Among them, i, j represent the i-th word and j-th document respectively; k represents the k-th word; n k,j represents the frequency of the k-th word in the j-th document; D represents the total number of documents.

[0084] Calculate the TF-IDF between the sentence node and the word node as the weight of the edge between them. PMI (pointwise mutual information) is used in text processing to calculate the degree of association between two words, that is, the frequency of two words appearing together in a specified window. p(x,y) represents the frequency of words x and y appearing together, and p(x) represents the frequency of word x appearing. The calculation formula is:

[0085]

[0086] Calculate the PMI between word nodes as the weight of the edge between them. Construct an adjacency matrix based on the relationship between nodes and edges, and use one-hot encoding to construct a feature matrix for the nodes. The feature matrix corresponding to n nodes is an n*n unit matrix. The adjacency matrix and feature matrix are input into the graph convolutional neural network. Figure 6 Figure 1 shows a graph convolutional neural network diagram, where nodes D represent sentences and nodes W represent words. Black nodes indicate that a node is activated and convolved with its neighboring nodes in the graph convolution layer. The network consists of two graph convolution layers. The first layer receives the feature matrix and outputs a 200-dimensional vector. The second layer receives the 200-dimensional vector and outputs a 100-dimensional vector as the model's final representation vector. The feedforward calculation formula for the first graph convolution layer is:

[0087]

[0088] Among them, A is the sum of the adjacency matrix and the identity matrix, D is the degree matrix of A, and H (l) is the output matrix of the lth layer, W (l) is the weight vector of the lth layer, the relu function is max(0,x), and the output of the l+1th layer can be calculated from the output of the lth layer, the weight vector of the lth layer, and the adjacency matrix. When the network is trained, the training set is input into the network, and the sample error is calculated according to the margin loss function:

[0089]

[0090] Where T represents positive samples, T′ represents negative samples, S(v1, v2) represents the distance between positive samples, and S(v1′, v2′) represents the distance between negative samples. Positive samples refer to connected entity pairs in the database, and the distance between the entity pairs is the Euclidean distance between the two entity representation vectors. Negative samples are generated by randomly replacing one entity in a positive sample entity pair with one that is no longer in the positive sample set. After calculating the loss function, the Adam optimizer is used to update the model parameters. After training, the vectors of all entities are obtained and used as the graph convolutional network representation vectors for each entity.

[0091] Reference Figure 7 As shown in the figure, the Word2Vec representation vectors and graph neural network representation vectors of the two target entities are extracted, directly merged into 200-dimensional vectors, and input into the twin networks respectively.

[0092] Reference Figure 8 Figure 1 shows the structure of a twin network. The twin network consists of two identical models, each consisting of two fully connected layers with dimensions of 100 and 50, respectively. The two models share parameters during training. During training, the training set is fed into the network, and the positive and negative sample collection method is the same as for graph convolutional networks. The sample error is calculated using the contrastive loss function:

[0093]

[0094] Where Y represents the label indicating whether a pair of samples is related, Dw is the Euclidean distance between the two vectors of the sample pair, and N represents the total number of positive and negative samples. After calculating the loss function, the Adam optimizer is used to update the model parameters. During the testing phase, the Word2Vec representation vector and the graph neural network representation vector of the target entity pair are input, and each outputs a 50-dimensional twin network sentence vector representation.

[0095] When training the Siamese network, the average Euclidean distance of the final positive samples is recorded. The threshold of the connection judgment module is set to twice this average Euclidean distance. For entity pairs to be determined whether they are connected, the Euclidean distance between them is calculated based on the Siamese network representation vector. If it is less than the threshold, it is determined to be connected and added to the knowledge graph.

[0096] The embodiments of the present invention provide a method, system and medium for predicting the connection between information security knowledge entity relationships. By processing the graph, a graphical expression of the entity description in the network security knowledge graph is established. According to the established relationships between the entities, a model between the entity text description and the relationship is established. According to the entity text description, the possible connections between the entities are supplemented to complete the knowledge supplement. It provides a data basis for knowledge reasoning applications based on the network security knowledge graph, such as attack organization profiling, attack scenario construction, intranet threat analysis, vulnerability cause analysis, APT attack detection, etc., and ensures the correctness of the supplemented data and reduces the cost of manual analysis.

[0097] Those skilled in the art will appreciate that, in addition to implementing the system and its various devices, modules, and units provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same functions of the system and its various devices, modules, and units provided by the present invention in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; the devices, modules, and units for implementing various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0098] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. An information security knowledge entity relationship connection prediction system, characterized by: include: Data processing module: Extract words from text data of information security knowledge, collect all text description data of information security knowledge and perform data preprocessing; use the relationship between words in the text description data of entities as the relationship between entity nodes and text vocabulary nodes to form graph data; output graph data, which serves as input to the graph convolutional network representation module; output preprocessed entity description text data, which serves as input to the Word2Vec representation module; Graph Convolutional Network Representation Module: Receives graph data, trains the TextGCN model, and generates a graph convolutional network representation vector for the text; Word2Vec representation module: receives preprocessed entity description text data, trains the Word2Vec model, and generates the Word2Vec representation vector of the text; Twin network representation module: merges graph convolutional network representation vectors and Word2Vec representation vectors, trains the twin network model, and generates twin network representation vectors; Connection judgment module: Calculate the Euclidean distance between the target entity and its respective twin network representation vector. If the distance is less than the threshold, it is judged that there is a connection. Among them, the graph convolutional network representation module includes: after data processing, all entity descriptions of the target concept pair CVE and CWE, or CAPEC and ATT&CK form a description corpus, which is saved as a txt file with one entity description per line, that is, entity number + entity English description; for all descriptions, sentences and words are used as sentence nodes and word nodes in the graph, the PMI between word nodes is calculated, and used as the weight of the edge between the two, an adjacency matrix is constructed according to the relationship between nodes and edges, and a feature matrix is constructed for the nodes using one-hot encoding. The adjacency matrix and the feature matrix are input into the graph convolutional neural network; positive samples refer to entity pairs that are already connected in the database, and the distance between the entity pairs is the Euclidean distance between the two entity representation vectors; the negative sample generation method is to randomly replace one entity in the positive sample entity pair, and the entity after replacement is not in the positive sample set. After calculating the loss function, the model parameters are updated using the Adam optimizer. After training, the vectors of all entities are obtained as the graph convolutional network representation vectors of each entity; In the twin network representation module, the twin network consists of two identical models, and a single model consists of two fully connected layers. During training, the training set is input into the network, and the positive and negative sample collection method is the same as that of the graph convolutional network. The Word2Vec representation vector and the graph neural network representation vector of the target entity pair are input, and each outputs a 50-dimensional twin network sentence vector representation.

2. The information security knowledge entity relationship connection prediction system according to claim 1 is characterized in that: The data processing module includes: taking words and sentences as graph nodes, PMI features and TF-IDF features as graph edges, forming graph data, and inputting the data into a graph convolutional network representation module; Preprocessing of entity description text data includes: word segmentation based on spaces, stop word removal, and low-frequency word removal.

3. The information security knowledge entity relationship connection prediction system according to claim 1 is characterized in that: The graph convolutional network representation module specifically includes: receiving graph data, dividing the training set, validation set and test set according to 7:2:1, training the TextGCN model, and generating a graph convolutional network representation vector of the text.

4. The information security knowledge entity relationship connection prediction system according to claim 1 is characterized in that: In the Word2Vec representation module, the Skip-gram algorithm is used to train the Word2Vec model.

5. The information security knowledge entity relationship connection prediction system according to claim 1 is characterized in that: The twin network representation module specifically includes: merging the graph convolutional network representation vector and the Word2Vec representation vector, dividing the training set, validation set and test set according to 7:2:1, training the twin network model, and generating the twin network representation vector.

6. A method for predicting the relationship between information security knowledge entities, characterized in that: include: Step S1: Collect English description texts of entities in the information security knowledge base and save existing connections between entities in the database; Step S2: Generate an information security corpus by segmenting words based on spaces, deleting stop words, and removing low-frequency words whose occurrence times are less than a threshold; Step S3: Train the Word2Vec model to generate word vectors for each word; Step S4: Given two categories of concepts and all entities corresponding to the concepts, all words and sentences are used as nodes of the graph, and the relationships between words in sentences are used as edges of the graph to construct graph data. The two categories of concepts refer to the target concept pairs CVE and CWE, or CAPEC and ATT&CK after data processing. Step S5: The existing connections in step S1 are taken as positive samples, and the entity pairs without connections are taken as non-positive samples. Negative samples of the same number as the positive samples are randomly selected from the non-positive samples and divided into training sets, test sets and validation sets; Step S6: Input the training set into the graph convolutional network, calculate the margin loss function of positive and negative samples in each training round, and update the network parameters; Step S7: Output the vector of each node and save the vector of the sentence node as the graph convolutional network representation vector of each entity text; Step S8: Calculate the Word2Vec representation vector of each entity text based on the word vector generated in step S3; Step S9: For each entity text, merge the graph convolutional network representation vector and Word2Vec representation vector generated in steps S7 and S8, and divide the text into training set, test set and validation set; Step S10: Input the training set into the Siamese network, calculate the contrast loss function of the sample pair in each training round, and use the Adam optimizer to update the network parameters; Step S11: Input the test set sample pairs into the twin network, output the vectors of the two samples as the twin network representation vector, and calculate the Euclidean distance between the entity pairs that need to be judged whether there is a connection based on the twin network representation vector. If it is less than the threshold, it is judged that there is a connection and added to the knowledge graph.

7. The information security knowledge entity relationship connection prediction method according to claim 6 is characterized in that: The step S3 specifically includes: using Python's gensim library and selecting the Skip-gram algorithm to train the Word2Vec model to generate a word vector for each word.

8. The information security knowledge entity relationship connection prediction method according to claim 6 is characterized in that: The step S5 includes randomly selecting negative samples of equal number to positive samples from the non-positive samples, and dividing the samples into a training set, a test set, and a validation set in a ratio of 7:2:

1.

9. The information security knowledge entity relationship connection prediction method according to claim 6, characterized in that: The step S9 includes: for each entity text, merging the graph convolutional network representation vector and the Word2Vec representation vector, and dividing the training set, test set and validation set into a ratio of 7:2:

1.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 6 to 9 are implemented.

Images