Method and Architecture for Constructing a Cyberspace Behavior Knowledge Graph Based on a Hypernetwork

Abstract

The present invention provides a method and architecture for constructing a cyber - space behavior knowledge graph based on a hyper - network. The method includes: Step 1: Define multi - dimensional observation elements of cyber - space behavior; Step 2: In the observation domain composed of the multi - dimensional observation elements, abstractly depict each observation element and the relationships between each observation element to construct a multi - layer network domain plane; wherein, each observation element corresponds to an entity in the network domain plane; Step 3: Obtain behavior knowledge information, extract entities and relationships between entities in the behavior knowledge information based on the defined multi - dimensional observation elements; based on the extracted entities and relationships between entities, establish edge associations between each entity in the same layer network domain plane and hyper - edge associations between different layer network domain planes based on the constructed multi - layer network domain plane, and a cyber - space behavior knowledge graph with a hyper - network structure can be formed. The present invention provides a new knowledge graph architecture for cyber - threat discovery.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace security and data analysis, and focuses on the construction of knowledge graphs for various behaviors in the Internet, mobile Internet, and telecommunications networks. In particular, it relates to a method and architecture for constructing a cyberspace behavior knowledge graph based on a hypernetwork. Background Art

[0002] With the rapid development of information technology, the cyberspace and the real space are constantly blending, and cyber security threats and public nuisances such as cyber fraud and spam have gradually emerged. They are carried by various new forms, new applications, new technologies, and new business forms, transmitted through the domestic and foreign cyberspaces, and mediated by online and offline public opinion exchanges, behavior intersections, and interest intersections. Their forms are complex and diverse, their activities are becoming increasingly frequent, and deliberate anonymous disguises are more common, posing a huge challenge to cyberspace security.

[0003] Currently, traditional methods generally construct a general knowledge graph based on features, single network domains, and single chains for threat discovery. The general knowledge graph has the following limitations in the governance of cyber public nuisances:

[0004] (1) Cyber security threats and public nuisance behaviors are characterized by multiple elements and multiple chains. Currently, the knowledge graph architecture lacks dynamics and is difficult to effectively represent and characterize the association of multiple behavior elements and the overlap of time-series behavior chains, making it passive in real-time dynamic reasoning to discover cyber public nuisances;

[0005] (2) The analysis and mining of diverse cyber threats and public nuisances involve comprehensive modeling in aspects such as knowledge relationships, network relationships, and behavior relationships. The existing knowledge graph architecture focuses on single relationship modeling and still has deficiencies in multi-relationship comprehensive modeling;

[0006] (3) The traditional triple-based representation method of knowledge graphs often overly simplifies the complexity of the data stored in the knowledge graph; especially for hyper-relationship data connecting two or more entities, the loss of high-order structural information therein will lead to limited knowledge hypergraph representation and reasoning capabilities.

[0007] Therefore, there is an urgent need for a research solution for constructing a knowledge graph centered on behaviors across network domains and multiple chains. Summary of the Invention

[0008] Aiming at the problem that the traditional general knowledge graph constructed only from specific network domains and specific features is no longer applicable to the discovery of threat behaviors in the current cyberspace, the present invention provides a method and architecture for constructing a cyberspace behavior knowledge graph based on a hypernetwork.

[0009] On the one hand, the present invention provides a method for constructing a cyberspace behavior knowledge graph based on a hypernetwork, including the following steps:

[0010] Step 1: Define multi-dimensional observation elements of cyberspace behavior, where the observation elements at least include actors, spatio-temporal environment, behavior interaction, and status;

[0011] Step 2: In the observation domain composed of the multi-dimensional observation elements, abstractly depict each observation element and the relationships between each observation element to construct a multi-layer network domain plane; among them, each observation element corresponds to an entity in the network domain plane; the network domain plane at least includes an actor domain containing various actors, an environmental information domain containing the virtual and real space environments and information where various actors are located, a behavior domain containing various behaviors in cyberspace, and a status domain containing actors of various network public hazards, information content circulation, and the status of behaviors;

[0012] Step 3: Obtain behavior knowledge information, extract entities and relationships between entities in the behavior knowledge information based on the defined multi-dimensional observation elements; based on the extracted entities and relationships between entities, establish edge associations between each entity in the same layer network domain plane and hyper-edge associations between different layer network domain planes, and a knowledge graph of cyberspace behavior with a hyper-network structure can be formed.

[0013] Further, the actor includes one or more of a terminal number, an account, and a website IP.

[0014] Further, the various behaviors in cyberspace include one or more of communication behaviors, network access behaviors, network social behaviors, financial interaction behaviors, and public hazard threat behaviors.

[0015] Further, Step 3 specifically includes:

[0016] Step A1: Perform knowledge extraction on each piece of knowledge in the audio, video, image, text, and interaction information in the multi-layer network domain plane to obtain the knowledge structure of each piece of knowledge;

[0017] Step A2: If the knowledge structure is <entity e i , relationship r i , entity e j > or <entity e i , attribute a i , attribute value v i >, then it is considered that the current piece of knowledge entered is general knowledge, and it is added to the knowledge graph of cyberspace behavior according to the general knowledge representation method;

[0018] Step A3: If the knowledge structure is <actor ac i , temporal relationship t i , <environmental information entity ei i , status entity st i , behavior entity bh i, other entity x i >>, it is considered that the currently entered knowledge is behavioral knowledge, and it is added to the network space behavioral knowledge graph according to the behavioral knowledge representation method;

[0019] Step A4: Process each piece of knowledge in the audio, video, image, text, and interaction information in the current batch of multi-domain planes according to Steps A2 to A3 until all the knowledge is added to the network space behavioral knowledge graph;

[0020] Step A5: Process the audio, video, image, text, and interaction information in the next batch of multi-domain planes according to Steps A1 to A4, and continuously update the network space behavioral knowledge graph.

[0021] Furthermore, adding it to the network space behavioral knowledge graph according to the general knowledge representation method specifically includes:

[0022] Taking entity e i as the matching object, respectively match it with the entity types of each domain plane to determine the domain plane to which the entity e i belongs;

[0023] In the determined domain plane, establish an edge according to the knowledge content. Specifically: if it is <entity e i , relationship r i , entity e j >>, then establish an edge relationship r i from e j to e i ; if it is <entity e i , attribute a i , attribute value v i >>, then establish an edge relationship a i from e i to v i , and store it in the network space behavioral knowledge graph.

[0024] Furthermore, adding it to the network space behavioral knowledge graph according to the behavioral knowledge representation method specifically includes:

[0025] Taking the actor ac i , environmental information entity ei i , state entity st i , and behavior entity bh i as the matching objects, perform entity matching in their respective corresponding domain planes; among them, if the matching object does not match any existing entity in its corresponding domain plane, a new entity is established for the matching object in the domain plane;

[0026] According to the multi-domain entity penetrated by the behavior, establish a connection between the actor aci 、Environmental information entity ei i 、Status entity st i 、Behavior entity bh i and other entity x i The hyperedge association relationship of and is stored in the graph database; wherein, the edge weight of the hyperedge includes the time sequence relationship t i 。

[0027] On the other hand, the present invention provides a cyber space behavior knowledge graph architecture based on a hypernetwork, which is constructed by using the above-mentioned method for constructing a cyber space behavior knowledge graph based on a hypernetwork.

[0028] Advantages of the present invention:

[0029] Aiming at the characteristics and requirements of multi-chain and multi-factor in cyber security threat and public hazard mining, the present invention uses the multi-level and multi-subgraph structure of the hypernetwork to model the behavior observation domain, depicts the multi-factor and multi-chain characteristics of actors in the network, and has great potential for multi-domain feature fusion, providing a new knowledge graph architecture and possible solution paths for diversified cyber threat discovery and public hazard governance. Compared with the existing knowledge graph architectures, the present invention has the following main advantages:

[0030] (1) Accommodates diversified knowledge in a multi-domain hierarchical manner of the hypernetwork, and conducts multi-relational fusion modeling - can conduct fusion modeling of knowledge relationships, network relationships, and behavior relationships to support the construction of a multi-chain network behavior knowledge graph;

[0031] (2) Realizes the characterization and association of the time sequence, multi-factor, and multi-chain of behaviors through the in-domain knowledge relationship and cross-domain hyperedge association - supports the time sequence behavior evolution analysis and prediction of cyber space actors, and supports the multi-factor association analysis and mining of the behaviors of cyber space actors;

[0032] (3) Through the knowledge graph constructed by the behavior knowledge hypernetwork, it is possible to detect, predict, and trace public hazard behaviors by using hypergraph calculation and reasoning on this basis - transforms a series of problems such as cyber space threat mining and the discovery and prediction of public hazard behaviors into hypergraph mining problems such as hyperedge and subgraph discovery and prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a schematic flow chart of the method for constructing a cyber space behavior knowledge graph based on a hypernetwork provided by an embodiment of the present invention;

[0034] Figure 2 is a schematic flow chart of adding each piece of knowledge to the cyber space behavior knowledge graph database provided by an embodiment of the present invention;

[0035] Figure 3Schematic diagram of the cyber - space behavior knowledge graph architecture based on the hyper - network provided by the embodiments of the present invention. Detailed implementation manners

[0036] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0037] Embodiment 1

[0038] As Figure 1 shown, the embodiments of the present invention provide a method for constructing a cyber - space behavior knowledge graph based on a hyper - network, including the following steps:

[0039] S101: Define multi - dimensional observation elements of cyber - space behavior, where the observation elements at least include actors, spatio - temporal environment, behavior interaction, and state;

[0040] S102: In the observation domain composed of multi - dimensional observation elements, abstractly depict each observation element and the relationships between each observation element to construct a multi - layer network domain plane; where each observation element corresponds to an entity in the network domain plane; the network domain plane at least includes an actor domain (referred to as AC for short) containing various actors, an environmental information domain (referred to as EI for short) containing the virtual and real space environments and information where various actors are located, a behavior domain (referred to as BH for short) containing various behaviors in cyber - space, and a state domain (referred to as ST for short) containing actors of various network public nuisances, information content circulation, and states of behaviors.

[0041] S103: Obtain behavior knowledge information, extract entities and relationships between entities in the behavior knowledge information based on the defined multi - dimensional observation elements; based on the extracted entities and relationships between entities, establish edge associations between each entity in the same - layer network domain plane and hyper - edge associations between different - layer network domain planes, thus forming a cyber - space behavior knowledge graph with a hyper - network structure.

[0042] Specifically, this step mainly includes the following sub - steps:

[0043] Step A1: Perform knowledge extraction on each piece of knowledge in the audio, video, image, text, and interaction information in the multi - layer network domain plane to obtain the knowledge structure of each piece of knowledge;

[0044] The embodiments of the present invention do not limit the specific extraction method, and general knowledge can be extracted based on traditional content processing; behavioral knowledge is extracted through interaction information, and the extraction structure is: <actor ac i , temporal relationship t i , <environmental information entity ei i , status entity st i , behavioral entity bh i , other entity x i >>.

[0045] Step A2: If the knowledge structure is <entity e i , relationship r i , entity e j > or <entity e i , attribute a i , attribute value v i >, then it is considered that the current piece of knowledge entered is general knowledge, and it is added to the cyber - space behavior knowledge graph according to the general knowledge representation method;

[0046] As an implementable manner, adding it to the cyber - space behavior knowledge graph according to the general knowledge representation method specifically includes: taking entity e i as the matching object, respectively matching it with the entity types of each domain plane to determine the domain plane to which entity e i belongs (that is, one of the output final domain planes {AC, EI, BH, ST}); within the determined domain plane, establish edges according to the knowledge content. Specifically: if it is <entity e i , relationship r i , entity e j >, then establish the edge relationship r i from e j to e i ; if it is <entity e i , attribute a i , attribute value v i >, then establish the edge relationship a i from e i to v i , and store it in the cyber - space behavior knowledge graph.

[0047] Step A3: If the knowledge structure is <actor ac i , temporal relationship t i , <environmental information entity ei i , status entity st i , behavioral entity bh i , other entity x i>>, then it is considered that the currently entered knowledge is behavioral knowledge, and it is added to the cyber - space behavior knowledge graph according to the behavioral knowledge representation method;

[0048] As an implementable manner, adding it to the cyber - space behavior knowledge graph according to the behavioral knowledge representation method specifically includes: respectively using the actor ac i , the environmental information entity ei i , the state entity st i , and the behavior entity bh i as matching objects, and performing entity matching in their respective corresponding domain planes; among them, if the matching object does not match any existing entity in its corresponding domain plane, a new entity is established for the matching object in the domain plane; according to the multi - domain entities penetrated by the behavior, establish the hyper - edge association relationship connecting the actor ac i , the environmental information entity ei i , the state entity st i , the behavior entity bh i and other entities x i , and store it in the graph database; among them, the connection weight value of the hyper - edge includes the time - series relationship t i .

[0049] Step A4: Process each piece of knowledge in the audio, video, image, text, and interaction information in the current batch of multi - layer domain planes according to Steps A2 to A3 until all knowledge is added to the cyber - space behavior knowledge graph; Figure 2 It is the process of adding a piece of knowledge to the knowledge graph database.

[0050] Step A5: Process the audio, video, image, text, and interaction information in the next batch of multi - layer domain planes according to Steps A1 to A4, and continuously update the cyber - space behavior knowledge graph.

[0051] The method for constructing a cyber - space behavior knowledge graph based on a hyper - network provided by the embodiment of the present invention first defines the multi - dimensional observation elements of cyber - space behavior: actors (including behavior subjects and behavior objects), spatio - temporal environment, behavior interaction, state, etc. Then, starting from the observation domain composed of multi - dimensional observation elements, it abstractly depicts the entities and relationships in each domain, constructs expandable multi - layer domain planes such as the actor domain, environmental information domain, behavior domain, state domain, etc. Then, based on the above - mentioned multi - dimensional observation element information of behavioral knowledge, it extracts entities and relationships, establishes intra - domain entity connections and hyper - edge associations of multi - node penetrations between domains, and forms a behavior knowledge graph architecture with a hyper - network structure that can reflect the development and evolution law of behaviors, that is, a behavior knowledge hyper - network, thereby providing a basis for association, calculation, and reasoning for threat and public nuisance behavior detection.

[0052] Embodiment 2

[0053] Using the method for constructing a knowledge graph of cyber - space behavior provided in the above - mentioned embodiments, an embodiment of the present invention provides a knowledge graph architecture of cyber - space behavior - a behavior knowledge hyper - network, and its specific framework is as Figure 3 shown. This knowledge graph architecture is divided into multiple extensible domain planes, including extensible multi - layer domain planes such as the actor domain, environmental information domain, behavior domain, state domain, event domain, etc., denoted as {AC, EI, BH, ST}.

[0054] The behavior knowledge graph architecture - the behavior knowledge hyper - network constructed in the embodiment of the present invention forms a multi - layer observation domain plane according to the observation elements of each dimension, including extensible multi - layer domain planes such as the actor domain, environmental information domain, behavior domain, state domain, etc.; among them, the actor domain (abbreviated as AC) covers various actors such as terminal numbers, accounts, website IPs, etc.; the environmental information domain (abbreviated as EI) mainly contains the virtual and real space environments and information where various actors are located, covering basic attributes, information carriers, content information, virtual and real positions, etc.; the behavior domain (abbreviated as BH) mainly contains various behaviors in the cyber - space, covering call communication behaviors, network access behaviors, network social behaviors, financial interaction behaviors, public hazard threat behaviors, etc.; the state domain (abbreviated as ST) mainly contains the states of actors, information content circulation, and behaviors of various network public hazards.

[0055] The core of the cyber - space behavior knowledge graph proposed in the present invention lies in using a hyper - network to organize the knowledge structure in layers and domains, thereby forming a behavior knowledge graph architecture of multiple domain planes - a knowledge hyper - network; the knowledge graph architecture constructed in the present invention covers general knowledge and behavior knowledge, with both triple and multi - tuple structures, and contains multiple - angle observation domains of behaviors (actors, environmental information, behavior interactions, states, etc.); among them, the behavior knowledge <actor aci, temporal relationship ti, <environmental information entity eii, state entity sti, behavior entity bhi, other entity xi>> is a multi - tuple structure, and the edges formed by the connection relationships can penetrate multiple entity nodes in multiple domains.

[0056] The present invention breaks through the traditional triple structure of knowledge graphs and the general knowledge organization mode, and proposes a method and architecture for constructing a knowledge graph of cyberspace behavior based on a hypernetwork with the characteristics of multi-layer and multi-dimensionality. Starting from the observation domains of multiple dimensions involved in behaviors, a knowledge graph architecture based on a hypernetwork is established on the basis of the observation domains of each dimension. A new knowledge organizational structure is formed by combining triples and multi-tuples to accommodate high-order structural information and reflect multi-dimensional relationships, and the different types of entities and relationship structures are reflected by the multi-layer domain structure of the hypernetwork. Single-layer domain plane analysis and cross-domain coupling analysis can be carried out through the behavior knowledge graph of the hypernetwork, such as abnormal behavior mining in the behavior domain and propagation state analysis in the state domain, providing a knowledge representation and analysis basis for the discovery of cross-domain threat behaviors in cyberspace.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features. However, such modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing a knowledge graph of cyberspace behavior based on a hypernetwork, characterized in that Including: Step 1: Define multi-dimensional observation elements of cyberspace behavior, where the observation elements at least include actors, spatio-temporal environment, behavior interaction, and state; Step 2: In the observation domain composed of the multi-dimensional observation elements, abstractly depict each observation element and the relationships between each observation element to construct a multi-layer network domain plane; among them, each observation element corresponds to an entity in the network domain plane; the network domain plane at least includes an actor domain containing various actors, an environmental information domain containing the virtual and real space environments and information where various actors are located, a behavior domain containing various behaviors in cyberspace, and a state domain containing actors of various network public hazards, information content circulation, and states of behaviors; Step 3: Obtain behavior knowledge information, extract entities and relationships between entities in the behavior knowledge information based on the defined multi-dimensional observation elements; based on the extracted entities and relationships between entities, establish edge associations between each entity in the same layer of the network domain plane and hyper-edge associations between different layers of the network domain plane, and a knowledge graph of cyberspace behavior with a hyper-network structure can be formed; Among them, based on the extracted entities and the relationships between entities, establish the edge associations between various entities within the same domain plane and the hyper-edge associations between different domain planes based on the constructed multi-layer domain plane. Specifically, it includes: within the determined domain plane, establish edges according to the knowledge content. Specifically: if it is <entity e i , relationship r i , entity e j >, then establish the edge relationship r i from e j to e i ; if it is <entity e i , attribute a i , attribute value v i >, then establish the edge relationship a i from e i to v i ; Establish a connection actor ac based on multi-domain entities throughout the behavior i , environmental information entity ei i , status entity st i , behavior entity bh i and other entity x i of the hyper-edge relationship.

2. The method for constructing a knowledge graph of cyberspace behavior based on a hypernetwork according to claim 1, characterized in that The actor includes one or more of a terminal number, an account number, and a website IP.

3. The method for constructing a knowledge graph of cyberspace behavior based on a hypernetwork according to claim 1, characterized in that The various behaviors in cyberspace include one or more of communication behaviors, network access behaviors, network social behaviors, financial interaction behaviors, and public hazard threat behaviors.

4. The method for constructing a knowledge graph of cyberspace behavior based on a hypernetwork according to claim 1, characterized in that Step 3 specifically includes: Step A1: Perform knowledge extraction on each piece of knowledge in the audio, video, image, text, and interaction information in the multi-layer network domain plane to obtain the knowledge structure of each piece of knowledge; Step A2: If the knowledge structure is <entity e i , relation r i , entity e j > or <entity e i , attribute a i , attribute value v i >, then it is considered that the current piece of knowledge entered is general knowledge, and it is added to the knowledge graph of cyber space behavior according to the general knowledge representation method; Step A3: If the knowledge structure is <actor ac i , temporal relationship t i , <environmental information entity ei i , status entity st i , behavior entity bh i , other entity x i >>, then it is considered that the currently entered knowledge is behavior knowledge, and it is added to the cyber - space behavior knowledge graph according to the behavior knowledge representation method; Step A4: Process each piece of knowledge in the audio, video, image, text, and interaction information in the current batch of multi-layer network domain planes according to Steps A2 to A3 until all knowledge is added to the knowledge graph of cyberspace behavior; Step A5: Process the audio, video, image, text, and interaction information in the next batch of multi-layer network domain planes according to Steps A1 to A4, and continuously update the knowledge graph of cyberspace behavior.

5. The method for constructing a knowledge graph of cyberspace behavior based on a hypernetwork according to claim 4, characterized in that The adding it to the knowledge graph of cyberspace behavior according to the general knowledge representation method specifically includes: Taking entity e i as the matching object, respectively match it with the entity types of each domain plane to determine the domain plane i to which the entity e belongs; Within the determined domain plane, establish connection edges according to the knowledge content, specifically: If it is <entity e i , relationship r i , entity e j >, then establish the connection edge relationship r i from e i to e j i ; If it is <entity e i , attribute a i , attribute value v i >, then establish the connection edge relationship a i from e i to v i i , and store it in the network space behavior knowledge graph.

6. The method for constructing a knowledge graph of cyberspace behavior based on a hypernetwork according to claim 4, characterized in that The adding it to the knowledge graph of cyberspace behavior according to the behavior knowledge representation method specifically includes: Take the actor ac i 、the environmental information entity ei i 、the status entity st i 、the behavior entity bh i as the matching objects, and perform entity matching in their respective corresponding domain planes; among them, if the matching object does not match an existing entity in its corresponding domain plane, a new entity is established for the matching object in the said domain plane; Establish a connection actor ac according to the multi-domain entity penetrated by the behavior i , environmental information entity ei i , status entity st i , behavior entity bh i and other entity x i of the hyperedge relationship, and store it in the graph database; wherein, the edge weight of the hyperedge includes the timing relationship t i .

7. A knowledge graph system of cyberspace behavior based on a hypernetwork, characterized in that It is constructed by using the method for constructing a knowledge graph of cyberspace behavior based on a hyper-network described in any one of Claims 1 to 6.

Images