Knowledge graph processing method, device, electronic device and medium

Abstract

The present disclosure relates to a method, device, electronic device and medium for processing a knowledge graph; wherein the method comprises: obtaining original data of a knowledge graph, the original data comprising: at least two target entities and the structural relationship between at least two target entities; determining graph grid data based on at least two target entities and the structural relationship between at least two target entities, the graph grid data being obtained by gridding at least two target entities; based on the graph grid data, displaying a visualization view corresponding to the knowledge graph, the visualization view comprising: a visualization thumbnail view or a visualization partial view, the visualization partial view corresponding to the visualization thumbnail view. The embodiments of the present disclosure can display a large amount of graph data with a high degree of visualization, effectively improving user browsing.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method, device, electronic device and medium for processing a knowledge graph. Background Art

[0002] Knowledge graph, which can be called knowledge domain visualization or knowledge domain mapping map, can display a series of various graphics of knowledge development process and structural relationship, and can use visualization technology to describe knowledge resources and their carriers, and mine, analyze, construct, draw and display knowledge and their interrelationships.

[0003] In the prior art, the visualization display of knowledge graphs is mainly achieved through force-directed graphs, which are used to display the relationship nodes and connection relationships between each piece of knowledge.

[0004] However, for knowledge graphs with large amounts of data, the display of force-directed graphs appears visually cluttered and difficult to browse. Summary of the invention

[0005] In order to solve the above technical problems, the present disclosure provides a method, device, electronic device and medium for processing a knowledge graph.

[0006] In a first aspect, the present disclosure provides a method for processing structured data, comprising:

[0007] Obtaining raw data of the knowledge graph, the raw data including: at least two target entities and a structural relationship between at least two target entities;

[0008] Based on at least two target entities and a structural relationship between the at least two target entities, determining atlas grid data, where the atlas grid data is obtained by performing grid processing on the at least two target entities;

[0009] Based on the graph grid data, the visualization view corresponding to the knowledge graph is displayed. The visualization view includes: a visualization thumbnail view or a visualization partial view. The visualization partial view corresponds to the visualization thumbnail view.

[0010] Optionally, determining the atlas grid data based on at least two target entities and a structural relationship between at least two target entities includes:

[0011] Determine the position coordinates of at least two target entities in a coordinate area constructed by a preset coordinate system;

[0012] Divide the coordinate area into grids to obtain at least two first-level grids;

[0013] Based on the number of target entities in the at least two first-level grids, the at least two first-level grids are meshed to obtain at least two second-level grids;

[0014] The atlas grid data is determined based on the number of target entities in at least two first-level grids, the number of target entities in at least two second-level grids, the position coordinates of at least two target entities, the structural relationship between at least two target entities, and the label information of at least two target entities, where the label information is determined based on the attribute information of the target entity.

[0015] Optionally, before determining the atlas grid data, based on the number of target entities in at least two primary grids, the number of target entities in at least two secondary grids, the position coordinates of at least two target entities, the structural relationship between at least two target entities, and the label information of at least two target entities, the method further includes:

[0016] It is determined that the number of target entities in each secondary grid is less than a preset number threshold.

[0017] Optionally, based on the graph grid data, display the visualization view corresponding to the knowledge graph, including:

[0018] Based on the number of target entities in at least two first-level grids, a visual thumbnail view corresponding to the knowledge graph is displayed with the target entities corresponding to different label information in the first-level grids.

[0019] Optionally, also include:

[0020] In response to a trigger operation on a target position in the visual thumbnail view, a target grid corresponding to the target position is determined, where the target grid is: a primary grid or a secondary grid;

[0021] It is determined that the number of target entities in the target grid is less than a preset number threshold, and a visualization local view corresponding to the target grid is displayed based on all target entities included in the target grid and structural relationships between the target entities.

[0022] Optionally, also include:

[0023] In response to a sliding operation on the visualization partial view corresponding to the target grid, visualization partial views corresponding to other grids connected to the target grid are displayed.

[0024] Optionally, also include:

[0025] Update the atlas grid data based on the preset update rules.

[0026] In a second aspect, the present disclosure provides a knowledge graph processing device, including:

[0027] An acquisition module is used to acquire raw data of a knowledge graph, wherein the raw data includes: at least two target entities and a structural relationship between at least two target entities;

[0028] A determination module, used to determine atlas grid data based on at least two target entities and a structural relationship between the at least two target entities, where the atlas grid data is obtained by gridding the at least two target entities;

[0029] The display module is used to display the visualization view corresponding to the knowledge graph based on the graph grid data. The visualization view includes: a visualization thumbnail view or a visualization partial view. The visualization partial view corresponds to the visualization thumbnail view.

[0030] Optionally, determine the module, specifically for:

[0031] Determine the position coordinates of at least two target entities in a coordinate area constructed by a preset coordinate system;

[0032] Divide the coordinate area into grids to obtain at least two first-level grids;

[0033] Based on the number of target entities in the at least two first-level grids, the at least two first-level grids are meshed to obtain at least two second-level grids;

[0034] The atlas grid data is determined based on the number of target entities in at least two first-level grids, the number of target entities in at least two second-level grids, the position coordinates of at least two target entities, the structural relationship between at least two target entities, and the label information of at least two target entities, where the label information is determined based on the attribute information of the target entity.

[0035] Optionally, the determination module is further used to determine whether the number of target entities existing in each secondary grid is less than a preset number threshold.

[0036] Optional display module, specifically used for:

[0037] Based on the number of target entities in at least two first-level grids, a visual thumbnail view corresponding to the knowledge graph is displayed with the target entities corresponding to different label information in the first-level grids.

[0038] Optionally, the determination module is further configured to determine a target grid corresponding to the target position in response to a trigger operation on the target position in the visual thumbnail view, where the target grid is: a primary grid or a secondary grid;

[0039] The display module is also used to determine that the number of target entities in the target grid is less than a preset number threshold, and display a visual local view corresponding to the target grid based on all target entities included in the target grid and the structural relationship between the target entities.

[0040] Optionally, the display module is further configured to display the visualized partial views corresponding to other grids connected to the target grid in response to a sliding operation on the visualized partial view corresponding to the target grid.

[0041] Optionally, it also includes: an update module;

[0042] The update module is used to update the atlas grid data based on preset update rules.

[0043] In a third aspect, the present disclosure further provides an electronic device, including:

[0044] one or more processors;

[0045] a storage device for storing one or more programs,

[0046] When one or more programs are executed by one or more processors, the one or more processors implement any one of the knowledge graph processing methods in the embodiments of the present invention.

[0047] In a fourth aspect, the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any one of the knowledge graph processing methods in the embodiments of the present invention.

[0048] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0049] By acquiring at least two target entities in the knowledge graph and the structural relationship between at least two target entities, the target entities are gridded to obtain graph grid data, and based on the graph grid data, a visualization view corresponding to the knowledge graph is displayed, wherein the visualization view includes: a visualization thumbnail view or a visualization local view, and the visualization local view corresponds to the visualization thumbnail view, thereby being able to display a large amount of graph data with a high degree of visualization, effectively improving user browsing. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0052] Figure 1 It is a flowchart of a method for processing a knowledge graph provided by an embodiment of the present disclosure;

[0053] Figure 2 It is a schematic diagram of storing raw data of a knowledge graph provided by an embodiment of the present disclosure;

[0054] Figure 3 It is a schematic diagram of a graph grid storage provided by an embodiment of the present disclosure;

[0055] Figure 4 It is a structural schematic diagram of a knowledge graph processing device provided by an embodiment of the present disclosure;

[0056] Figure 5 It is a structural schematic diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0057] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0058] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0059] In related technologies, the visualization processing of knowledge graphs is mainly achieved through the following methods.

[0060] Related technology 1: Visualization of large-scale knowledge graphs is achieved through a label propagation algorithm (LPA), such as obtaining knowledge graph data, where the knowledge graph data includes entities and relationships between entities, marking each entity in the knowledge graph data with a unique label, traversing all entities in the knowledge graph data, and performing label propagation in all entities in the knowledge graph data until a termination condition is met. Based on the label results of each entity after the label propagation, a label set consisting of the labels of the entities is obtained, graph data is constructed according to the relationships between entities and the labels in the label set, and the graph data is visualized.

[0061] However, technology 1 can only display the relationship between communities formed by the fusion of entities, but fails to display the original entities and their original relationships, and cannot support in-depth and detailed analysis of original data in ultra-large-scale knowledge graphs.

[0062] Related technology 2: A method for realizing large-scale knowledge graph visualization through a particle system, including: rendering of massive knowledge graphs, particle systems, particle materials, proxy servers (Service Workers), and client performance optimization.

[0063] Among them, the rendering of massive knowledge graphs can provide users with a visual knowledge graph interface. When the user searches for a node, the related relationship nodes of the node can be rendered on the page, and the rendered graph can also be stored; the client enables asynchronous multi-threaded queues for loading and rendering to optimize performance; and the d3-force force-directed graph layout + WebGL rendering is selected.

[0064] The particle system uses the Points class. Points objects can only be rendered by the renderer. If the particles rendered by the renderer need to be implemented with Canvas, an extra step must be taken to convert the Canvas into a texture and then load it in through the Map property.

[0065] The creation of each particle material graphic is generally done by formatting the particle through Canvas drawing or by loading an image. A client uses Service Worker offline resource caching.

[0066] However, Technology 2 shows the visualization of a large amount of data compressed into particle object model data, which cannot fully reflect the original entities and their original relationships, and cannot support in-depth and detailed analysis of the original data in ultra-large-scale knowledge graphs.

[0067] Related technology three, realizes the visualization of knowledge graph through force guidance, such as knowledge graph data extraction, construction of graph data structure, force-directed algorithm layout, visual presentation, and visual interaction of operation process. Through the final knowledge graph, it can bind listening events to each node and relationship, allowing users to operate nodes and relationships with the mouse.

[0068] However, Technology 3 faces the massive growth of knowledge graph data. Simply displaying large-scale knowledge graph data with a force-directed graph will easily appear visually cluttered and browser performance will be difficult to support. It is impossible to support in-depth and detailed analysis of the original data in ultra-large-scale knowledge graphs.

[0069] Related technology 4: Realize knowledge graph storage and multi-granular visualization through large-scale operation and maintenance. For example, use the X-Engine engine as the core of historical data storage to complete the knowledge graph data storage of massive entities, attributes and relationships, cluster the knowledge graph data according to the LPA algorithm, merge entities with great similarity into groups or communities, and perform query processing and data request operations on the intelligent operation and maintenance knowledge graph on the server side according to the user's query conditions. Perform multi-granular graphics rendering based on the results on the terminal and display the results.

[0070] However, technology 4 either only displays the relationship between groups (or between communities) or only displays the relationship within groups (or within communities). Due to the randomness of the LPA algorithm's division results, the original relationship between entities that are mistakenly divided into different communities is not easy to reflect, and it is impossible to support in-depth and detailed analysis of the original data in ultra-large-scale knowledge graphs.

[0071] Figure 1 : is a flowchart of a method for processing a knowledge graph provided by an embodiment of the present disclosure. The method of this embodiment can be executed by a knowledge graph processing device, which can be implemented in hardware / software and can be configured in an electronic device. The method for processing a knowledge graph of any embodiment of the present application can be implemented. Figure 1 As shown, the method specifically includes the following:

[0072] S110. Obtaining original data of the knowledge graph, the original data including: at least two target entities and a structural relationship between at least two target entities.

[0073] Take the attack graph of massive security logs and intelligence data as an example. The original data can be the historical attack resources, victims and attack relationships extracted from the massive security logs within 1 year. The extracted information is stored in the graph database. The storage diagram of the original data of the knowledge graph can be seen in Figure 2 As shown in the example.

[0074] Among them, historical attack resources and victims are two target entities, and the attack relationship is the structural relationship between the two target entities.

[0075] Specifically, based on the information such as attack resource organization, attack resource relationship, victim unit, victim industry, etc., various entities of attack resources and victims (network protocol addresses, domain names, uniform resource locators, samples, email addresses, etc.) and the attack relationships between these entities (such as various attack relationships, domain name resolution relationships, etc.) can be formed.

[0076] S120. Determine the atlas grid data based on at least two target entities and the structural relationship between at least two target entities.

[0077] Among them, the atlas grid data is obtained by gridding at least two target entities, which can effectively represent the location information of each entity, the result relationship between each entity, and the number of entities in the grid division.

[0078] In this embodiment, optionally, determining the atlas grid data based on at least two target entities and a structural relationship between at least two target entities includes:

[0079] Determine the position coordinates of at least two target entities in a coordinate area constructed by a preset coordinate system;

[0080] Divide the coordinate area into grids to obtain at least two first-level grids;

[0081] Based on the number of target entities in the at least two first-level grids, the at least two first-level grids are meshed to obtain at least two second-level grids;

[0082] The atlas grid data is determined based on the number of target entities in at least two first-level grids, the number of target entities in at least two second-level grids, the position coordinates of at least two target entities, the structural relationship between at least two target entities, and the label information of at least two target entities, where the label information is determined based on the attribute information of the target entity.

[0083] The coordinate area can be determined by four points (0,0), (X,0), (X,Y), and (0,Y) in the coordinate system, and the position coordinates of each target entity are randomly initialized in the coordinate area and stored in the graph database.

[0084] Before dividing at least two primary grids into grids to obtain at least two secondary grids based on the number of target entities in at least two primary grids, the method further includes: determining that the number of target entities in the primary grid is greater than a preset number threshold.

[0085] Based on the position coordinates of each target entity in the graph database, the coordinate area determined by the four points (0,0), (X,0), (X,Y), and (0,Y) in the coordinate system can be divided into N×N top-level grids (first-level grids), and the number of target entities contained in each first-level grid can be calculated. If the number of target entities in the first-level grid exceeds M, the first-level grid can be further divided into lower levels to obtain multiple second-level grids.

[0086] In combination with the above example, based on the position coordinates of the target entity initialized in the graph database, the coordinate area determined by the four points (0,0), (1000,0), (1000,1000), and (0,1000) in the coordinate system is divided into 10×10 first-level grids, and the number of target entities in each first-level grid is calculated. If there is a first-level grid with more than 500 target entities (such as the value of M mentioned above), continue to divide the sub-area corresponding to the first-level grid into 10×10 second-level grids and calculate the number of target entities in each second-level grid until the number of target entities in the newly divided grid does not exceed 500. The number of target entities in each grid (including the first-level grid and the second-level grid), the number of target entities contained in the sub-labels, the first-level grid, the regional coordinates, the center coordinates and other gridded data are calculated and stored in the database.

[0087] The number of target entities in at least two primary grids, the number of target entities in at least two secondary grids, the location coordinates of at least two target entities, the structural relationship between at least two target entities, and the label information and center coordinates of at least two target entities can be stored in the graph database to realize the grid storage of the graph. The schematic diagram of the grid storage can be seen in Figure 3 As shown in the example.

[0088] It should be noted that based on the stored multi-level grid data, it can provide the total number of target entities in each divided grid (first-level grid or second-level grid) and the number of entities of various labels, support the display of thumbnails at all levels of large-scale maps, and provide the relationship between upper and lower grids. It supports drilling down from the top-level grid to the lower-level grids, provides the coordinate information of each grid, supports the display of the original entities and relationships in the bottom-level grid in the local original graph, and combines the coordinates of the original entities to display nearby entities and their relationships through smooth movement of the local original graph.

[0089] In this embodiment, optionally, before determining the atlas grid data, the following steps may also be included:

[0090] It is determined that the number of target entities in each secondary grid is less than a preset number threshold.

[0091] Among them, when it is determined that the number of target entities in each secondary grid is less than a preset number threshold, the secondary grid may no longer be divided, thereby achieving multi-level effective division of the atlas data.

[0092] In addition, when it is determined that the number of target entities in the secondary grid is greater than or equal to the preset number threshold, the secondary grid can be further divided to obtain multiple third-level grids until the number of target entities included in each third-level grid is less than the preset number threshold.

[0093] Optionally, after determining the atlas grid data, the following may also be included:

[0094] Update the atlas grid data based on the preset update rules.

[0095] Among them, the coordinates of the expanded entity are set for the existing data, the labels of the expanded entity are supplemented, and the refined grid data are appended.

[0096] Among them, the newly expanded knowledge graph data can be obtained, the main attribute values ​​of the newly expanded entity can be extracted to form entity labels, and stored together in the graph database. Based on the relationship between entities in the knowledge graph, the coordinates of the newly expanded entity are initialized to the geometric center of the associated existing entity coordinates. For the newly expanded entity that is not associated with the existing entity, the entity coordinates are randomly initialized in the area determined by the four points (0,0), (X,0), (X,Y), and (0,Y) in the coordinate system.

[0097] In the area determined by the four points (0,0), (X,0), (X,Y), and (0,Y) in the coordinate system, the force-directed algorithm is used to calculate the coordinates of the newly expanded entity and update them to the graph database. Based on the coordinates of the expanded entity in the graph database, the existing grid data of the atlas is updated. If there is a grid whose number of entities exceeds a certain threshold M, the sub-area corresponding to the grid is continued to be divided into N×N subordinate grids and the number of entities in the new grid is calculated until the number of entities in the newly divided grid does not exceed M. Finally, the number of entities at each level of the grid, the number of entities included in the sub-label, the upper grid, the regional coordinates, the center coordinates and other grid data are calculated and stored in the database to realize the grid storage of the atlas.

[0098] In combination with the above example, attack resources, victims, and attack relationships are extracted from the security log of the previous day at a fixed time every day. Based on the information such as attack resource gangs, attack resource relationships, victim units, and victim industries, various entities and their relationships of attack resources and victims are formed. The main attribute values ​​such as attack resource organization, attack event year, attack event type, entity type, victim unit, and victim industry are extracted to form entity labels, which are stored together in the graph database. Based on the relationship between entities in the graph database, the coordinates of the new entities in these daily added data are set to the geometric center of the associated existing entity coordinates. For the daily added entities that are not associated with existing entities, the coordinates of the daily added entities are randomly initialized in the area determined by the four points (0,0), (1000,0), (1000,1000), and (0,1000) in the coordinate system.

[0099] Among them, after the new entities and relationships are saved to the graph database every day, the force-directed algorithm is used to calculate the coordinates of the new entities every day in the area determined by the four points (0,0), (1000,0), (1000,1000), and (0,1000) in the coordinate system and update them to the graph database. After the coordinate information of the new entities is updated to the graph database every day, the existing grid data of the graph is updated every day. If there is a grid with more than 500 entities, the sub-area corresponding to the grid is divided into 10×10 subordinate grids and the number of entities in the new grid is calculated until the number of entities in the newly divided grid does not exceed 500, and the new grid data of the graph is stored in the database.

[0100] S130. Based on the graph grid data, display the visualization view corresponding to the knowledge graph.

[0101] The visualization view includes: a visualization thumbnail view or a visualization partial view, and the visualization partial view corresponds to the visualization thumbnail view.

[0102] Among them, the visual thumbnail view corresponding to the knowledge graph or the visual local view corresponding to the visual thumbnail view can be displayed on the front-end interface. The overall view can be displayed through the visual thumbnail, and the original entities and their original relationships in the knowledge graph in the local area can be displayed based on the visual local view based on the coordinate position positioning, so as to carry out in-depth and detailed analysis of the original data in the ultra-large-scale knowledge graph.

[0103] Specifically, for a visual thumbnail view, the search and display can be performed based on the graph grid data. For a visual local view, the knowledge graph in the local area can be displayed in the local original image based on the positioning coordinates in the visual thumbnail.

[0104] The knowledge graph processing method provided in this embodiment grids the target entities by acquiring at least two target entities in the knowledge graph and the structural relationship between at least two target entities to obtain graph grid data, and displays a visualization view corresponding to the knowledge graph based on the graph grid data, wherein the visualization view includes: a visualization thumbnail view or a visualization local view, and the visualization local view corresponds to the visualization thumbnail view, thereby being able to display a large amount of graph data with a high degree of visualization, effectively improving user browsing.

[0105] Based on the description of the above embodiment, in this embodiment, optionally, based on the graph grid data, a visualization view corresponding to the knowledge graph is displayed, including:

[0106] Based on the number of target entities in at least two first-level grids, a visual thumbnail view corresponding to the knowledge graph is displayed with the target entities corresponding to different label information in the first-level grids.

[0107] Among them, based on the first-level grid data (and the labels selected by the user), the number of target entities contained in each label in each first-level grid can be obtained, and the different label information in each first-level grid can be displayed in the form of entities in the visual thumbnail view. The number of target entities contained in the label represents the size of the entity in the visual thumbnail view.

[0108] In combination with the above example, the attack map that can be displayed on the front-end interface includes a visual thumbnail view and a visual local view (local original map). Based on the first-level grid data (and user-selected labels, such as attack resource organization, attack event year, attack event type, entity type, victim unit, victim industry, etc.), the number of target entities contained in each label in each first-level grid is obtained, and the different labels in each first-level grid are displayed in the form of entities in the visual thumbnail view. The number of target entities contained in the label represents the size of the entity target in the visual thumbnail view.

[0109] Therefore, based on multi-level gridded data, multi-level visualization thumbnails are provided to solve the problem that a single thumbnail "cannot display too many entities in a certain area of ​​the knowledge graph" when there are "too many local entities in a super-large-scale knowledge graph".

[0110] In this embodiment, optionally, the following may also be included:

[0111] In response to a trigger operation on a target position in the visual thumbnail view, a target grid corresponding to the target position is determined, where the target grid is: a primary grid or a secondary grid;

[0112] It is determined that the number of target entities in the target grid is less than a preset number threshold, and a visualization local view corresponding to the target grid is displayed based on all target entities included in the target grid and structural relationships between the target entities.

[0113] The user can click on any coordinate position in the visual thumbnail view to trigger the display of the visual partial view corresponding to the coordinate position, so that the user can view detailed data.

[0114] Specifically, with the help of the regional coordinates of the target grid, all eligible entities and their relationships in the area can be screened out from the graph database, and all eligible entities and their relationships in the area covered by the grid can be displayed in a visual local view.

[0115] In addition, when it is determined that the number of target entities in the target grid is greater than or equal to a preset number threshold, the subordinate grids of the first-level grid (such as the second-level grid, the third-level grid, etc.) can be drilled down to obtain the number of target entities contained in each label in each subordinate grid, and the different labels in each subordinate grid are displayed in the form of entities in the map in the visual thumbnail view until it is found that the number of target entities in the subordinate grid is less than the preset number threshold.

[0116] In this embodiment, optionally, the following may also be included:

[0117] In response to a sliding operation on the visualization partial view corresponding to the target grid, visualization partial views corresponding to other grids connected to the target grid are displayed.

[0118] Among them, in the visual local view corresponding to the target grid, it can support sliding to view other entities and structural relationships near the target grid, and can gradually and smoothly display nearby entities and their relationships, realizing the detailed analysis capability of the original map across different grids.

[0119] Therefore, in the visualized local view, based on the coordinate information of the grid and the entity, nearby entities and their relationships are gradually displayed through the smooth movement of the visualized local view, supporting graph analysis of original entities and their relationships across different grids, and facilitating in-depth and detailed analysis of original data in ultra-large-scale knowledge graphs.

[0120] The disclosed embodiments can divide the grid into multiple levels based on the coordinates of each entity and calculate the number of entities in each grid (including the upper grid and the lower grid), label the grid data including the number of entities, the upper grid, the regional coordinates, the center coordinates, etc. and store them in a database, thereby realizing the grid storage of the graph.

[0121] In addition, based on the stored multi-level grid data, it can provide the total number of entities in each grid and the number of entities of each type of label, realize the display of thumbnails at all levels of large-scale graphs, and support drilling down from the top-level grid to the lower-level grids by providing the relationship between the upper and lower grids. By providing the coordinate information of each grid, it can realize the display of the original entities and relationships in the bottom grid in the local original graph, and combine the coordinates of the original entities to display nearby entities and their relationships through the smooth movement of the local original graph. Based on the "multi-level thumbnails generated by grid data", it depicts the overall situation and determines the analysis focus, relies on the "local original graph limited by a single grid coordinate area" to display the original entities and relationships, supports the smooth movement of the local knowledge graph based on the coordinate position, and quickly and effectively supports the in-depth and detailed analysis of the knowledge graph.

[0122] Figure 4 : is a schematic diagram of the structure of a knowledge graph processing device provided in an embodiment of the present disclosure; the device is configured in an electronic device and can implement the knowledge graph processing method of any embodiment of the present application. The device specifically includes the following:

[0123] An acquisition module 410 is used to acquire raw data of a knowledge graph, where the raw data includes: at least two target entities and a structural relationship between at least two target entities;

[0124] A determination module 420, configured to determine atlas grid data based on at least two target entities and a structural relationship between the at least two target entities, wherein the atlas grid data is obtained by performing gridding processing on the at least two target entities;

[0125] The display module 430 is used to display the visualization view corresponding to the knowledge graph based on the graph grid data. The visualization view includes: a visualization thumbnail view or a visualization partial view. The visualization partial view corresponds to the visualization thumbnail view.

[0126] In this embodiment, optionally, the determination module 420 is specifically configured to:

[0127] Determine the position coordinates of at least two target entities in a coordinate area constructed by a preset coordinate system;

[0128] Divide the coordinate area into grids to obtain at least two first-level grids;

[0129] Based on the number of target entities in the at least two first-level grids, the at least two first-level grids are meshed to obtain at least two second-level grids;

[0130] The atlas grid data is determined based on the number of target entities in at least two first-level grids, the number of target entities in at least two second-level grids, the position coordinates of at least two target entities, the structural relationship between at least two target entities, and the label information of at least two target entities, where the label information is determined based on the attribute information of the target entity.

[0131] In this embodiment, optionally, the determination module 420 is further configured to determine whether the number of target entities in each secondary grid is less than a preset number threshold.

[0132] In this embodiment, optionally, the display module 430 is specifically used for:

[0133] Based on the number of target entities in at least two first-level grids, a visual thumbnail view corresponding to the knowledge graph is displayed with the target entities corresponding to different label information in the first-level grids.

[0134] In this embodiment, optionally, the determination module 420 is further configured to determine a target grid corresponding to the target position in response to a trigger operation on the target position in the visual thumbnail view, where the target grid is: a primary grid or a secondary grid;

[0135] The display module 430 is further used to determine that the number of target entities in the target grid is less than a preset number threshold, and display a visual local view corresponding to the target grid based on all target entities included in the target grid and the structural relationship between the target entities.

[0136] In this embodiment, optionally, the display module 430 is further configured to display the visualized partial views corresponding to other grids connected to the target grid in response to a sliding operation on the visualized partial view corresponding to the target grid.

[0137] In this embodiment, optionally, the device of this embodiment further includes: an updating module;

[0138] The update module is used to update the atlas grid data based on preset update rules.

[0139] The knowledge graph processing device of the embodiment of the present invention grids the target entities by acquiring at least two target entities in the knowledge graph and the structural relationship between at least two target entities to obtain graph grid data, and displays a visualization view corresponding to the knowledge graph based on the graph grid data, wherein the visualization view includes: a visualization thumbnail view or a visualization local view, and the visualization local view corresponds to the visualization thumbnail view, thereby being able to display a large amount of graph data with a high degree of visualization, effectively improving user browsing.

[0140] The knowledge graph processing device provided in the embodiment of the present invention can execute the knowledge graph processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0141] The present disclosure also provides an electronic device, including: a processor, the processor is used to execute a computer program stored in a memory, and the computer program implements the steps of the above method embodiment when executed by the processor.

[0142] Figure 5 A schematic diagram of the structure of an electronic device provided by the present disclosure is shown in FIG. Figure 5 A block diagram of an exemplary electronic device suitable for implementing an exemplary embodiment of the present invention is shown. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0143] like Figure 5 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processor 16).

[0144] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0145] The electronic device 12 typically includes a variety of computer system readable media. These media can be any media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0146] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as "hard drives"). A disk drive for reading and writing removable non-volatile disks (such as "floppy disks"), and an optical disk drive for reading and writing removable non-volatile optical disks (such as CD-ROMs, DVD-ROMs, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data media interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the embodiments of the present invention.

[0147] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described in the embodiments of the present invention.

[0148] The processor 16 executes various functional applications and information processing by running at least one program among a plurality of programs stored in the system memory 28 , such as implementing the method embodiment provided by the embodiment of the present invention.

[0149] The present disclosure also provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the steps of the above method embodiment when executed by a processor.

[0150] Any combination of one or more computer-readable media can be used. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0151] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0152] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0153] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN) domain, or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0154] The present disclosure also provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the steps of implementing the above method embodiments.

[0155] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0156] The above are only specific embodiments of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to these embodiments herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing a knowledge graph, characterized in that: include: Obtaining raw data of the knowledge graph, the raw data including: at least two target entities and a structural relationship between at least two of the target entities, wherein at least two of the target entities include a historical attack resource and a victim, and the structural relationship between the two target entities is an attack relationship; Based on at least two of the target entities and the structural relationship between at least two of the target entities, determine the atlas grid data, the atlas grid data is obtained by gridding at least two of the target entities, and the atlas grid data is used to represent the location information of each of the target entities, the result relationship between each of the target entities, and the number of each of the target entities in the network partition; Based on the graph grid data, a visualization view corresponding to the knowledge graph is displayed, and the visualization view includes: a visualization thumbnail view or a visualization partial view, and the visualization partial view corresponds to the visualization thumbnail view.

2. The method according to claim 1, characterized in that Determining atlas grid data based on at least two target entities and a structural relationship between at least two of the target entities includes: Determining the position coordinates of at least two target entities in a coordinate area constructed by a preset coordinate system; Divide the coordinate area into grids to obtain at least two first-level grids; Based on the number of target entities in at least two primary grids, the at least two primary grids are divided into grids to obtain at least two secondary grids; The atlas grid data is determined based on the number of target entities existing in at least two first-level grids, the number of target entities existing in at least two second-level grids, the position coordinates of at least two target entities, the structural relationship between at least two target entities, and label information of at least two target entities, where the label information is determined based on the attribute information of the target entity.

3. The method according to claim 2, characterized in that Before determining the atlas grid data based on the number of target entities in at least two primary grids, the number of target entities in at least two secondary grids, the position coordinates of at least two target entities, the structural relationship between at least two target entities, and the label information of at least two target entities, the method further includes: It is determined that the number of the target entities in each secondary grid is less than a preset number threshold.

4. The method according to claim 3, characterized in that Based on the graph grid data, the corresponding visualization view of the knowledge graph is displayed, including: Based on the number of target entities in at least two first-level grids, a visual thumbnail view corresponding to the knowledge graph is displayed with the target entities corresponding to different label information in the first-level grids.

5. The method according to claim 4, characterized in that Also includes: In response to a triggering operation on a target position in the visual thumbnail view, determining a target grid corresponding to the target position, where the target grid is: a primary grid or a secondary grid; It is determined that the number of target entities in the target grid is less than a preset number threshold, and a visualized local view corresponding to the target grid is displayed based on all target entities included in the target grid and structural relationships between the target entities.

6. The method according to claim 5, characterized in that Also includes: In response to a sliding operation on the visualized partial view corresponding to the target grid, visualized partial views corresponding to other grids connected to the target grid are displayed.

7. The method according to claim 2, characterized in that: Also includes: Based on preset update rules, the atlas grid data is updated.

8. A knowledge graph processing device, characterized in that: include: An acquisition module is used to acquire raw data of a knowledge graph, wherein the raw data includes: at least two target entities and a structural relationship between at least two of the target entities, wherein at least two of the target entities include a historical attack resource and a victim, and the structural relationship between the two target entities is an attack relationship; A determination module, used to determine atlas grid data based on at least two target entities and the structural relationship between at least two target entities, wherein the atlas grid data is obtained by gridding at least two target entities, and the atlas grid data is used to represent the location information of each target entity, the result relationship between each target entity, and the number of each target entity in the network partition; A display module is used to display a visualization view corresponding to a knowledge graph based on graph grid data, wherein the visualization view includes: a visualization thumbnail view or a visualization partial view, and the visualization partial view corresponds to the visualization thumbnail view.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When one or more programs are executed by one or more processors, the one or more processors implement the knowledge graph processing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the knowledge graph processing method as described in any one of claims 1 to 7.

Images