Methods for constructing cybersecurity spatial knowledge graphs

Abstract

This invention discloses a method for constructing a cybersecurity spatial knowledge graph, comprising: acquiring and processing data to be processed to obtain triple instance data; wherein, structured data in the data to be processed is crawled and processed, and unstructured data in the data to be processed is processed using natural language processing; based on the triple instance data, a cybersecurity OWL ontology is constructed using Protégé; and through a divide-and-conquer replication instance matching method, a cybersecurity OWL ontology after instance fusion is obtained, forming a cybersecurity spatial knowledge graph, and realizing reasoning in the cybersecurity spatial knowledge graph. On the one hand, distinguishing between structured and unstructured data to determine data sources separately improves data processing efficiency to a certain extent; on the other hand, using Protégé to construct the cybersecurity OWL ontology makes the semantics of the resulting cybersecurity OWL ontology richer.

Description

Technical Field

[0001] This invention relates to a method for constructing knowledge graphs for cybersecurity space, belonging to the field of knowledge graph technology. Background Technology

[0002] In recent years, cyberattacks have occurred frequently and with diverse methods, posing a severe challenge to network security. The internet contains a vast amount of network security-related data, such as network security alerts from firewalls and intrusion detection systems, vulnerability databases established by network security research institutions or vendors, and security announcements issued by internet security forums and vendors. This data is characterized by its massive volume, discreteness, fragmentation, and concealed relationships. Therefore, timely and accurate analysis and processing of this massive data to extract key elements and correlations, and to formulate security intelligence and cyberspace security situational awareness strategies, is of paramount importance.

[0003] For knowledge graph expert systems in many implemented projects, graph databases such as Neo4j or Nebulagraph are mostly used to construct the graph data. However, the Neo4j community edition's node count and concurrency support fall far short of production requirements. The professional edition, on the other hand, requires an expensive subscription. Furthermore, the data modeling for Neo4j and Nebulagraph is relatively simplistic, merely satisfying the entity-relationship-entity relationship structure. While complex library queries can meet complex business needs, their execution efficiency is low.

[0004] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method for constructing a cybersecurity spatial knowledge graph. On the one hand, it distinguishes between structured and unstructured data and determines the data source separately, which improves the efficiency of data processing to a certain extent. On the other hand, it uses Protégé to construct the cybersecurity OWL ontology, making the semantics of the resulting cybersecurity OWL ontology richer.

[0006] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0007] This invention discloses a method for constructing a cybersecurity spatial knowledge graph, including:

[0008] Acquire and process the data to be processed to obtain triplet instance data; wherein, the structured data in the data to be processed is crawled and processed, and the unstructured data in the data to be processed is processed by natural language processing;

[0009] Based on the triplet instance data, a cybersecurity OWL ontology is constructed using Protégé; and through the divide-and-conquer replication instance matching method, the fused cybersecurity OWL ontology is obtained, forming a cybersecurity spatial knowledge graph, and reasoning of the cybersecurity spatial knowledge graph is realized.

[0010] Furthermore, the reasoning of the cybersecurity spatial knowledge graph includes,

[0011] Construct inference rules for general scenarios;

[0012] Using the Pellet inference engine, the cybersecurity OWL ontology, which is a fusion of the inference rules and instances, is loaded according to business requirements to realize the inference of the cybersecurity spatial knowledge graph.

[0013] Furthermore, the inference rules are written into the RuleMapper class in the MySQL database in the form of strings, and insert and select interfaces are developed in the RuleMapper class.

[0014] Furthermore, the crawling process includes crawling Alibaba Cloud vulnerability database, the National Information Security Vulnerability Database, and the NSFOCUS vulnerability database.

[0015] Furthermore, the natural language processing includes entity extraction, entity disambiguation, and relation extraction.

[0016] Furthermore, the construction of the OWL cybersecurity ontology includes the following steps:

[0017] Based on the triple instance data, class hierarchy, relationships, and relationship attributes are constructed.

[0018] Using Protégé, construct the OWL ontology for cybersecurity based on the hierarchy and relationships of the classes and their relational attributes.

[0019] Furthermore, the instance fusion includes the following steps:

[0020] By integrating Jena with Spring Boot, we can call its Ontology API to dynamically read triplet instance data according to timestamps and perform instance fusion using an instance fusion algorithm.

[0021] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0022] The present invention provides a method for constructing a cybersecurity spatial knowledge graph. Firstly, it differentiates data sources: for structured data, a real-time crawling framework is used to dynamically crawl data according to timestamps; for unstructured data, natural language processing is employed, improving data processing efficiency to a certain extent. Secondly, compared to traditional data modeling, using Protégé for data modeling allows for clearer class hierarchies and more diverse relationships and relational attributes, resulting in a richer semantic meaning for the cybersecurity OWL ontology. Simultaneously, this invention applies the concept of inverted indexes to instance fusion in the cybersecurity OWL ontology, improving the accuracy of instance fusion. Attached Figure Description

[0023] Figure 1 This is a flowchart of a method for constructing a cybersecurity spatial knowledge graph;

[0024] Figure 2 This is a system block diagram of the construction method for cybersecurity spatial knowledge graphs;

[0025] Figure 3 This is the database ER diagram of the present invention;

[0026] Figure 4 This is a diagram showing the hierarchical construction of the OWL ontology class for network security in this invention.

[0027] Figure 5 This is a flowchart of the backend development process of this invention;

[0028] Figure 6 This is a diagram illustrating the instance fusion process of the instance matching method for divide-and-conquer replication in this invention. Detailed Implementation

[0029] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0030] Example:

[0031] This embodiment provides a method for constructing a cybersecurity spatial knowledge graph, including:

[0032] The system acquires and processes the data to be processed, resulting in triplet instance data. Specifically, it crawls and processes the structured data in the data to be processed, and performs natural language processing on the unstructured data in the data to be processed.

[0033] Based on triplet instance data, a cybersecurity OWL ontology is constructed using Protégé; and through a divide-and-conquer replication instance matching method, a cybersecurity OWL ontology with instance fusion is obtained, forming a cybersecurity spatial knowledge graph, and reasoning of the cybersecurity spatial knowledge graph is realized.

[0034] The technical concept of this invention is as follows: First, the data sources are differentiated. For structured data, a real-time crawling framework is used to dynamically crawl data according to timestamps; for unstructured data, natural language processing is used, which improves the efficiency of data processing to a certain extent. Second, compared with traditional data modeling, using Protégé for data modeling can make the class hierarchy clearer and the relationships and relationship attributes more diverse, resulting in a richer semantics for the OWL ontology of cybersecurity. Simultaneously, this invention applies the concept of inverted indexes to instance fusion in the OWL ontology of cybersecurity, improving the accuracy of instance fusion.

[0035] Knowledge graphs are a technological approach that uses graph models to describe knowledge and model the relationships between everything in the world. They consist of nodes and edges. Nodes can be entities, such as vulnerabilities, affected software, locations, or abstract concepts. Edges represent the relationships between entities. Therefore, a knowledge graph is essentially a large-scale semantic network, rich in entities, concepts, and the semantic relationships between them. As a semantic network, knowledge graphs are one of the main ways to represent data in the era of big data, and as a technological system, they represent a significant advancement in knowledge engineering in the big data era. Based on application, they can be divided into general knowledge graphs and domain-specific knowledge graphs. Domain-specific knowledge graphs can propose targeted applications based on the specific circumstances of a domain. Introducing knowledge graphs into the field of cybersecurity helps to characterize and present the security posture, supporting security decision-making and early warning prediction.

[0036] Specific steps are as follows: Figure 1 and Figure 2 As shown:

[0037] Step 1:

[0038] The data to be processed is acquired, categorized into structured and unstructured data, with data sources determined accordingly. For structured data, vulnerabilities from Alibaba Cloud, the National Information Security Vulnerability Database, and the NSFOCUS Vulnerability Database are crawled. For unstructured data, natural language processing techniques—entity extraction, entity disambiguation, and relation extraction—are used to construct triplet instance data. The triplet instance data is then stored in a MySQL database.

[0039] Step 1-1: Prepare the development environment: Windows 10 operating system, Java development toolkits JDK 1.8, Python 3.9.6, MySQL 8.0.26 relational database, and Maven. Development software used includes PyCharm and IntelliJ IDEA.

[0040] Steps 1-2: Create a Python-based web crawler project, importing the Requests crawler module and the PyMySQL data persistence module;

[0041] Steps 1-3: Structured data is characterized by its high level of organization and neat formatting, making it easy to incorporate into tables. A typical example is data represented and stored using a relational database, appearing as two-dimensional data. Unstructured data, on the other hand, is data with irregular or incomplete structures, lacking a predefined data model, and is inconvenient to represent using two-dimensional logical tables in a database. This includes all formats of office documents, text, images, HTML, various reports, images, and audio / video information, etc.

[0042] For structured data, triple relationships can be easily extracted based on field attributes to construct instance data for the OWL ontology of network security. Vulnerability intelligence is developing rapidly, focusing on platforms such as Alibaba Cloud Vulnerability Database, NSFOCUS Vulnerability Database, and the China National Vulnerability Database (CNNVD). Analysis of these vulnerability websites reveals that Alibaba Cloud Vulnerability Database has a more intuitive and clear web layout, facilitating the construction of crawler strategies. Data is crawled in JSON format and written to a MySQL relational database in real-time based on fields. For vulnerable entities, CVE numbers, vulnerability names, vulnerability types, disclosure times, and vulnerability descriptions were crawled. For affected entities, operating systems, databases, applications, web applications, and hardware devices, type, vendor, product, version, and impact attributes were crawled. Attack attributes, serving as the relationship attributes between vulnerable entities and affected entities, included attack paths, attack complexity, permission requirements, impact scope, exploit maturity, patch status, data confidentiality, data integrity, server impact, and the number of attacks across the entire network. Figure 2 The database ER diagram is shown.

[0043] For unstructured data, primarily text data, the NLP tool DeepKE is used to extract entities and relationships, forming...<E,R,E> The data is structured into triplet instances and stored in MySQL. DeepKE is an open-source and scalable knowledge graph extraction tool that supports regular fully supervised learning, low-resource and low-sample scenarios, long documents, and multimodal scenarios, covering various information extraction tasks including named entity recognition, relation extraction, and attribute extraction.

[0044] Step 2: Use protégé to build hierarchical categories and relationships, as well as the attributes of those relationships, based on the fields in the instance database;

[0045] Step 2-1: The Java dependency environment for Protégé has been installed in Step 1-1 above. Next, install Protégé 5.5.0.

[0046] Step 2-2: Compare the fields of the instance data in the database to determine the class hierarchy. For example... Figure 4The OWL (Open Source Library) ontology for cybersecurity is structured with the main classes being vulnerabilities and targets. Subclasses of the main class "Vulnerabilities" include Operating Systems, Databases, Applications, Web Applications, Hardware Devices, and Affected Entities. The subclasses of the main class "Operating Systems" are Windows, Unix, MacOS, Linux, and Embedded Systems. The subclasses of Windows are WinXP, Win7, Win8, Win10, and Win11. The subclasses of Linux are Ubuntu, Fedora, and Debian. The subclasses of the main class "Databases" are MySQL, Sybase, Oracle, SQLService, and DB2.

[0047] Steps 2-3: Construct data attributes and relationship attributes, such as... Figure 3 As shown.

[0048] For vulnerable entities, under the Protégé camelCase data attribute naming convention, the following attributes have been added: hasCveNo (Cve ID), hasName (Name), hasType (Type), disclosingTime (Disclosure Time), hasCvssScore (Cvss Score), and hasDiscription (Description). The domains of these attributes are set to Vulnerabilities, with ranges of: xsd:string, xsd:string, xsd:string, xsd:dateTimeStamp, xsd:double, and xsd:string.

[0049] For the target being attacked, add the attributes hasId (id number), hasType (type), hasManufacture (manufacturer), hasVersion (version), and hasInfluence (impact). Set the above domains as the Target, with ranges of xsd:int, xsd:string, xsd:string, xsd:string, and xsd:string respectively.

[0050] Add attacks to the relationships and add relationship attributes such as hasAttackNo (attack number), hasAttackComplexity (attack complexity), hasApplicability (applicability), hasPermissionRequirements (permission requirements), hasAttackPath (attack path), hasSecurity (security), hasInfluence (impact), hasCvss3Score (Cvss score), hasIntegrity (integrity), and hasUserInteraction (user interaction). The above construction of the ontology does not mean that it is static and immutable. On the contrary, it can be dynamically updated based on the hierarchical construction of concept classes, so that the data model of the ontology is continuously updated and improved.

[0051] Step 3: Integrate Mybatis, MySQL, and Jena using the Java web development framework Spring Boot; write SQL query statements in the XML file of Mybatis to read instance data;

[0052] Step 3-1: Prepare the development environment using Spring Boot 2.5.6, add the dependencies listed in Table 1 below, and manage them uniformly through Maven. Table 1 lists the JAR packages required for the backend architecture of this invention.

[0053] id groupID artifactId version 1 org.springframework.boot spring-boot-starter 2.6.5 2 org.springframework.boot spring-boot-starter-web 2.6.5 3 mysql mysql-connector-java 8.0.26 4 org.mybatis.spring.boot mybatis-spring-boot-starter 2.2.2 5 com.alibaba druid 1.2.6 6 org.apache.jena apache-jena-libs 3.17.0 7 com.clarkparsia.pellet pellet-owlapiv3 2.3.3 8 com.clarkparsia.pellet pellet-core 2.3.3 9 com.clarkparsia.pellet pellet-query 2.3.3 10 pellet pellet-datatypes 2.2.2 11 pellet Pellet-el 2.2.2 12 com.clarkparsia.pellet pellet-explanation 2.3.3 13 pellet Pellet-rules 2.2.2 14 net.sourceforge.owlapi owlapi-distribution 3.4.9 15 net.sourceforge.owlapi owlapi-osgidistribution 4.2.8

[0054] Table 1

[0055] Spring Boot is a framework and a new programming standard. Its creation simplifies the use of frameworks. The simplification refers to the reduction of the large number and cumbersome configuration files required by many Spring frameworks. Therefore, Spring Boot is a framework that serves other frameworks, and its service scope is to simplify configuration files. It has the following characteristics: (1) A simple Spring Boot project does not need to manually add configurations in pom.xml. You only need to add dependencies in pom.xml, and the program will automatically load the dependency JAR packages and other configuration files. (2) When developing with SSM or SSH, the resources store the configuration files of various corresponding frameworks. Now, only one configuration file is needed. The configuration content includes the server port number, database connection address, username, password, etc. (3) When Spring Boot is created, the Application startup class is automatically created, which represents the startup and loading of this project and the server. In Spring Boot, the server is included, so there is no need to manually configure Tomcat.

[0056] Step 3-2: In practical applications, due to the massive scale of instances in the OWL ontology for network security, instance-level matching is particularly important. While instance matching shares similarities with ontology matching, single-instance matching is a large-scale data processing problem, requiring solutions to its time and space complexity. Typically, when instance data is too large, a divide-and-conquer approach is used. The most common divide-and-conquer strategy is to divide the large-scale ontology into several smaller knowledge graphs and then perform matching on these smaller knowledge graphs. While the ontology-based divide-and-conquer method is intuitive, its main drawback is information loss at the module boundaries after partitioning. This invention proposes a divide-and-conquer replication instance matching method from a practical development perspective. Instead of partitioning the ontology, it replicates the ontology into OWL1, OWL2…OWL after modeling. n Where n is the number of OWL ontologies replicated. The massive instance data stored in MySQL can also be horizontally partitioned based on the number of ontologies replicated, n.

[0057] The number of vulnerability instances was P when the `count(*)` command was executed in the MySQL console. vulnerabiliy The number of attack instances is P attack The number of target attack instances is P target .

[0058] Then follow Mod vulnerability =P vulnerability / n, Mod attack =P attack / n and Mod target =P target / n calculates the modulus of each level split.

[0059] For each vulnerable instance, the unique identifier cve_no is moduloed to obtain the ID of each horizontally partitioned database. vulnerability =cve_no / Mod vulnerability .

[0060] For each attack instance, the unique identifier `attack_no` is moduloed to obtain the ID of each horizontally partitioned database. attack =attack_no / Mod attack .

[0061] The ID of each horizontally partitioned database is obtained by taking the modulo of the unique identifier ID of the target. target =id / Mod target .

[0062] Its modulus is the amount of data in each horizontal partition, and ld is the number of partition tables. Because the modulus is based on a unique identifier, the data in each partition table is unique. Then, leveraging the multi-core capabilities of the CPU, n threads are created to perform instance fusion. Once all threads are complete, the instance fusion is finished, resulting in ontologies of the same class level. Because they are homogeneous and isomorphic, the fusion of these ontologies directly yields the final network security OWL. security =OWL1 + OWL2 + ... + OWL n .like Figure 6 As shown.

[0063] Step 4: Develop the inference rules module for the inference engine.

[0064] Step 4-1: To make the rules dynamically extensible, develop an inference rule module, write an inference rule RuleMapper class, write the inference rules into the MySQL database in the form of strings, and develop an Insert interface in the RuleMapper class of the MySQL database.

[0065] Step 4-2: To enable it to invoke the inference rules according to business needs, the MySQL database develops a query select interface.

[0066] Step 5: Develop the PelletService layer interface, use the Pellet inference engine, load the OWL ontology for network security and the rules from MySQL according to business requirements, implement inference, and call the interface through routing mapping in the Controller layer, such as... Figure 5 As shown.

[0067] Step 5-1: Based on the above steps, introduce the Pellet inference engine dependency, load the OWL ontology for network security, construct conditional query statements according to business requirements, read inference rules from the MySQL database, and load them into the Pellet inference engine along with the OWL ontology for network security to realize inference for business scenarios.

[0068] Step 5-2: Introduce the inference module into the PelletService service and develop the relevant interfaces. Inject the Pellet inference engine, the RuleMapper class, and the MySQL database's Insert and Select interfaces into the PelletService service, which will then uniformly schedule these interfaces.

[0069] In summary, this embodiment provides a method for constructing a network security knowledge graph, such as... Figure 2The system block diagram shown illustrates how, in practical applications, the Python Fastapi framework is used to integrate a MySQL database, a web crawler module, and a Natural Language Processing (NLP) module. The web crawler module retrieves CVE data from the Alibaba Cloud vulnerability database and the national security vulnerability database. Entity extraction, entity disambiguation, and relation extraction techniques from NLP are used to extract triples from unstructured data and combine them with the crawled structured data to form instance data, which is then persisted to MySQL. After building and persisting the instance data to the database, data modeling begins. This invention uses Protégé to build the OWL ontology for cybersecurity. Protégé is an ontology editing and knowledge acquisition software, or ontology development tool, developed by the Center for Bioinformatics at Stanford University School of Medicine using Java. It is also a knowledge-based editor and is open-source software. This software is primarily used for constructing ontology in the Semantic Web and is the core development tool for ontology construction in the Semantic Web. Version 5.5.0 is used. An ontology includes classes, instances of classes, relations, and relation attributes. The hierarchy of classes and the relationships between instances and the attributes of the relations themselves are constructed based on the fields of the instance data. After building the OWL ontology, Jena, the Pellet inference engine, and Mybatis are integrated using the Java web development framework Spring Boot. Jena is a free and open-source Java framework for building semantic web and relational data applications. Pellet is a descriptive logic inference engine based on the Tableau algorithm, developed by the MindSwap Lab at the University of Maryland, College Park. Pellet is an open-source Java-based system. Currently, Pellet supports OWL 1.1, supporting larger data instances and more complex inference, and its inference efficiency is higher than the Hermit inference engine. Mybatis is used as the data persistence framework, reading data from MySQL and mapping it to defined entity classes, loading it into the network security OWL ontology, and using inverted indexes to fuse instances, forming instance data. After instance fusion, based on the needs of inference business, inference rules are queried through Mybatis and loaded into Pellet inference as strings. This allows for the construction of a real-time updated, highly available system for building knowledge graphs for network security, improving network security situational awareness.

[0070] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0071] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0072] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0073] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0074] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for constructing a network security space knowledge graph, characterized in that, The application comprises the following steps: acquiring and processing to-be-processed data to obtain triple instance data; wherein, structured data in the to-be-processed data is subjected to crawling processing, and unstructured data in the to-be-processed data is subjected to natural language processing; according to the triple instance data, a network security OWL ontology is constructed using Protégé; and through an instance matching method of divide-and-conquer replication, a network security OWL ontology after instance fusion is obtained, a network security space knowledge graph is formed, and reasoning of the network security space knowledge graph is implemented; wherein, the network security OWL ontology after instance fusion is obtained through the instance matching method of divide-and-conquer replication, and comprises the following steps: copying the network security OWL ontology into a plurality of replicated OWL ontologies, OWL1, OWL2,... OWLn n n is the number of replicated OWL ontologies. n threads are opened using the multi-core characteristics of a CPU, and the replicated OWL ontologies are subjected to instance fusion respectively; when all threads are completed, it indicates that the instance fusion is completed, and the replicated OWL ontologies of each same class level are obtained; the replicated OWL ontologies of each same class level are fused to obtain the network security OWL ontology after instance fusion.

2. The method of claim 1, wherein the network security space knowledge graph is constructed by, the reasoning of the network security space knowledge graph comprises the following steps: inference rules of a general scenario are constructed; a Pellet inference engine is used to load the inference rules and the network security OWL ontology after instance fusion according to business requirements, so as to implement the reasoning of the network security space knowledge graph.

3. The method of claim 2, wherein the network security space knowledge graph is constructed by, the inference rules are written in the form of a string into a RuleMapper class in a MySQL database, and an insert interface and a select interface are developed in the RuleMapper class.

4. The method of claim 1, wherein the network security space knowledge graph is constructed by, the crawling processing comprises crawling Aliyun vulnerability libraries, national information security vulnerability libraries and Qianlong vulnerability libraries.

5. The method of claim 1, wherein the network security space knowledge graph is constructed by, the natural language processing comprises entity extraction, entity disambiguation and relationship extraction.

6. The method of claim 1, wherein the network security space knowledge graph is constructed by: the network security OWL ontology comprises the following steps: according to the triple instance data, the construction of class levels and relationships and relationship attributes is performed, using Protégé, the network security OWL ontology is constructed according to the class levels and relationships and relationship attributes.

7. The method of claim 1, wherein the network security space knowledge graph is constructed by, the instance fusion comprises the following steps: Spring boot is integrated with Jena, and its Ontology API is called to read the triple instance data dynamically according to a timestamp through an instance fusion algorithm to perform instance fusion.

Images