A security and protection efficiency dynamic evaluation method, system and device based on a knowledge graph

Abstract

This invention discloses a method, system, and device for dynamic evaluation of security effectiveness based on knowledge graphs. The method includes the following steps: collecting security system information and storing it in a graph database; quantitatively analyzing the effectiveness of the security system to generate an intrusion path graph; analyzing the probability of intrusion events occurring in security units over the years to generate initial event occurrence matrices for different intrusion events; sorting out the transition probabilities of various types of intrusion events to generate an event transition probability matrix and calculating the security effectiveness matrix for each path node; importing the obtained initial state occurrence matrix, intrusion event transition matrix, and security effectiveness matrix into the intrusion path graph for intrusion path analysis and calculating the weakest intrusion path. This invention can perform real-time dynamic evaluation of the security system on each intrusion path, solving the problems of poor timeliness and inability to accurately analyze the weakest path in existing intrusion path analysis methods.

Description

Technical Field

[0001] This invention relates to the field of security systems, and in particular to a method, system, and device for dynamic evaluation of security effectiveness based on knowledge graphs. Background Technology

[0002] With rapid economic development, people's demands for personal and property safety are increasing, greatly promoting the vigorous development of various security systems. As the primary means of protecting targets, security systems mainly address security incidents such as intrusion, theft, and vandalism. These incidents account for a high percentage of security accidents and result in significant property losses. A security incident can be committed by different people, at different times, and using different methods, but regardless of the circumstances, there is always an intrusion path. It can be said that the intrusion path has a significant impact on the probability that these security incidents will be detected, responded to, and prevented by the security system. By analyzing the security effectiveness of each intrusion path, weak points in the security system can be identified, forming the basis for current security system effectiveness evaluation.

[0003] Currently, there are two main methods for analyzing intrusion paths: abstract modeling and simulation. Simulation involves creating a high-precision model of the security system, retaining most of its information, and then conducting extensive computer simulations to identify the system's most vulnerable areas or parts. It is a probabilistic assessment model, often used in critical national security facilities where high accuracy is required. Therefore, risk assessment is conducted by building simulation models, simulating intrusion events based on the simulated security system, and thus analyzing various areas of the security system. For example... Figure 1 As shown. Despite its high accuracy, it has not become widespread due to drawbacks such as high cost and poor portability. Abstract modeling refers to highly abstracting a security system, dividing it into several regional levels, such as... Figure 2 As shown, this is the most widely used ASD (Adversary Intrusion Sequence Graph). This method is beneficial for analyzing the relationships between different areas, and then analyzing and evaluating the systems and equipment in each area based on specialized standards developed with the participation of various experts, thus obtaining the security effectiveness analysis results for that path. However, this method cannot take into account the actual operating effect of the system, and too much information and data are lost when abstracting to a hierarchical level. Therefore, it is a static, isolated method that does not consider the influence of intruders, resulting in low accuracy in the effectiveness analysis results of intrusion paths.

[0004] In general, all methods are static analyses, providing only assessments for a specific state. They lack scalability and cannot perform real-time analysis of results across different intrusion paths. Furthermore, the systems, devices, and personnel along an intrusion path change over time, and the security outcomes for the same intrusion path will vary depending on the specific intrusion event. Therefore, none of the methods described above accurately reflect the system's real-time performance across different intrusion paths. Summary of the Invention

[0005] To address the aforementioned issues and the inability of current technologies to accurately reflect the real-time security effectiveness of each intrusion path, this paper proposes a security effectiveness analysis method, system, and device that integrates knowledge graphs, based on abstract modeling methods. This method constructs a more detailed path information graph using knowledge graphs and updates the graph information over time, performing real-time analysis on each path. Ultimately, the effectiveness of the security system is determined.

[0006] According to a first aspect of the present invention, an intrusion path representation method based on knowledge graphs is proposed, comprising the following steps:

[0007] Collect security system information and store the collected security system information in the graph database;

[0008] Based on the collected security system information, the effectiveness of the security system is quantitatively analyzed to generate an intrusion path map;

[0009] Based on the generated intrusion path map, the probability of intrusion events occurring in security units over the years is analyzed, and an initial event occurrence matrix for different intrusion events is generated. The transition probabilities of each type of intrusion event are sorted out, an event transition probability matrix is ​​generated, and the security effectiveness matrix of each path node is calculated.

[0010] The obtained initial state occurrence matrix, intrusion event transition matrix, and security effectiveness matrix are imported into the intrusion path map to perform intrusion path analysis and calculate the weakest intrusion path.

[0011] Preferably, after generating an intrusion path map by quantitatively analyzing the effectiveness of the security system based on the collected security system information, the method further includes:

[0012] By performing a depth-first traversal of all paths in the intrusion path graph, the intrusion path graph can be improved.

[0013] Preferably, the security system information includes basic information and time-sensitive information. For time-sensitive data, it is updated in real time by calling the system or device data interface; for basic information, it is updated manually at regular intervals by formulating troubleshooting and maintenance plans.

[0014] Preferably, the collection of security system information includes the following steps:

[0015] The security system is integrated into the graph database through interfaces provided by various subsystems.

[0016] By utilizing the security subsystems and various rules and regulations already established by the security unit, various types of security information from the security system are collected.

[0017] Preferably, the step of quantitatively analyzing the effectiveness of the security system based on the collected security system information and generating an intrusion path map includes the following steps:

[0018] Based on the security unit's construction plan and spatial information, and according to the openness of each security area, the security unit is divided into different areas that progress from the outside in.

[0019] Based on the different equipment and personnel factors in each area, the obtained security area is further divided into security nodes and numbered.

[0020] By linking the various security nodes according to their path relationships, and connecting the security targets with the security nodes that have path relationships, an intrusion path map is generated.

[0021] Preferably, the calculation of the security effectiveness matrix for each path node includes:

[0022] By importing basic performance information and dynamic performance information into the intrusion path map, and using simulation experiments or index scoring methods, the performance impact of various attributes on different types of intrusion events is calculated to obtain the security performance matrix of each path node.

[0023] Preferably, the intrusion path analysis and calculation of the weakest intrusion path includes the following steps:

[0024] A depth-first search is used to traverse the intrusion path graph and find all intrusion paths;

[0025] The security effectiveness of each intrusion path is calculated using the event transition matrix and the security effectiveness matrix of each node.

[0026] Identify the weakest link in the security system;

[0027] Wherein, the security effectiveness of the intrusion path S = ∑p i q i In the formula, i = 1, 2, 3, ..., n; pi represents the security effectiveness of path node i, and qi represents the weight of path node i.

[0028] Preferably, the security effectiveness of path node i is calculated as follows: the security effectiveness P of path node i i=∑P1(P2) i-1 P3, where P i P1 represents the security effectiveness of intrusion path i; P2 represents the probability of the initial state occurrence matrix; P3 represents the probability of the intrusion event transition matrix; P4 represents the security efficiency matrix.

[0029] According to a second aspect of the present invention, the present invention proposes a security performance dynamic evaluation system based on knowledge graph, the system comprising: a first data acquisition module, an intrusion path graph construction module, a second data acquisition module, and a security performance evaluation module;

[0030] The first data acquisition module is used to collect security system information and store the collected security system information into the graph database;

[0031] The intrusion path map construction module is used to quantitatively analyze the effectiveness of the security system based on the collected security system information and generate an intrusion path map.

[0032] The second data acquisition module is used to analyze the probability of intrusion events occurring in security units over the years based on the generated intrusion path map, generate initial event occurrence matrices for different intrusion events, sort out the transfer probabilities of each type of intrusion event, generate an event transfer probability matrix, and calculate the security effectiveness matrix of each path node.

[0033] The security performance evaluation module is used to import the obtained initial state occurrence matrix, intrusion event transition matrix and security performance matrix into the intrusion path map, perform intrusion path analysis, and calculate the weakest intrusion path.

[0034] According to a third aspect of the present invention, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to at least one of the processors; wherein the memory stores instructions executable by the processor, the instructions being executed by the processor to implement the aforementioned knowledge graph-based dynamic evaluation method for security effectiveness.

[0035] The technical effects and advantages of this invention are as follows:

[0036] This invention proposes a knowledge graph-based dynamic evaluation method, system, and device for security systems, enabling real-time dynamic evaluation of security systems along each intrusion path. It solves the problems of poor timeliness and inability to accurately identify the weakest path in existing intrusion path analysis methods. By storing the collected data in a graph database, intrusion paths are visualized and can be updated in real time. Due to the relational nature of graph databases, it eliminates the need to manually extract dependencies from large amounts of source information, saving detection time. Furthermore, since all source information resides in the graph database, the entire calculation process is performed in memory, significantly improving computation time. This invention introduces an intrusion event graph, transforming intrusion path calculation from simple local area calculations and isolated source tracing calculations of single paths into consideration of different intrusion event behaviors and changes in intrusion events during the intrusion process. This improves the accuracy of intrusion path analysis. Attached Figure Description

[0037] Figure 1 This is a simulation model diagram provided in the prior art of the embodiments of the present invention;

[0038] Figure 2 This is a diagram of an ASD intrusion sequence provided in the prior art of this invention.

[0039] Figure 3 This is a flowchart of intrusion path analysis provided for an embodiment of the present invention;

[0040] Figure 4 Intrusion path map provided for embodiments of the present invention;

[0041] Figure 5 An intrusion path diagram provided for an embodiment of the present invention;

[0042] Figure 6 This is a schematic diagram of the path calculation method provided in an embodiment of the present invention. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] Firstly, this invention proposes a dynamic evaluation method for security effectiveness based on knowledge graphs, specifically as follows: Figure 3 As shown, the method includes the following steps:

[0045] Collect information from the security system and store the collected data in the graph database;

[0046] Obtain performance evaluation indicators for the security system, conduct quantitative analysis of the system's performance, and obtain an intrusion path map;

[0047] Based on the security subsystems or personnel and equipment contained in the path nodes, construct the attributes of each node in the intrusion path graph to improve the knowledge graph;

[0048] Analyze the probability of intrusion incidents in security units over the years to generate an initial event occurrence matrix for different intrusion incidents;

[0049] The transition probabilities of various types of intrusion events are analyzed, and an event transition probability matrix is ​​generated.

[0050] Weighting is performed on the basic and timely information of the security system to obtain the contribution ratio of each type of information; basic performance information and dynamic performance information are formed; based on the attributes of each node, the basic performance information and dynamic performance information are imported to calculate the performance impact of each attribute on different types of intrusion events, and the security performance matrix of each path node is obtained.

[0051] The obtained initial state occurrence matrix, intrusion event transition matrix, and security efficiency matrix are imported into the intrusion path map to calculate the weakest intrusion path.

[0052] It should be noted that this invention visualizes intrusion paths and allows for real-time updates by storing the collected data in a graph database. Since the graph database eliminates the need for manually extracting dependencies from large amounts of source information, detection time is saved. Furthermore, all source information resides in the graph database, and the entire calculation process is performed in memory, significantly improving computation time. Simultaneously, this invention introduces an intrusion event graph, transforming intrusion path calculation from simple local area calculations and isolated source tracing of single paths into consideration of different intrusion event behaviors and transitions during the intrusion process. This improves the accuracy of intrusion path calculations.

[0053] Specifically, the following detailed description will be provided with reference to specific embodiments.

[0054] Step S1: Collect security system information and store the collected data in the graph database. Specifically, the security system is a system designed to prevent various intrusion events. Therefore, it is necessary to obtain various security information of the security system. The security system information data is collected by integrating it into the graph database through the interfaces provided by the various subsystems of the security system.

[0055] Specifically, a graph database is a data management system that uses nodes and edges as basic storage units and is designed for efficient storage and retrieval of graph data. Graph databases include, but are not limited to, graph databases like Neo4j.

[0056] Specifically, the subsystems of a security system are represented by various processors installed within the system that use sensors such as light, physical sensors, and temperature and humidity sensors to record environmental information. Data generated during the prevention of various intrusion attempts is collected and integrated into a dataset specifically for intrusion prevention. Various computer simulation software is then used to simulate the intrusion process, providing accurate data for subsequent intrusion path analysis methods based on knowledge graphs.

[0057] It should be noted that collecting security system information also includes using the security subsystems and various rules and regulations already built by the security unit to collect various security information of the security system, build a security performance attribute table, and determine the data source and update method for various attributes.

[0058] The security system information includes basic information and time-sensitive information. By sorting out the time-sensitive data in the security system information and updating the time-sensitive data in real time, a basis can be provided for dynamic evaluation of intrusion path analysis, so that the analysis results of intrusion paths can change over time.

[0059] Specifically, the time-sensitive information of the security system includes, but is not limited to, personnel schedules, personnel changes, equipment damage and repair records, and real-time data streams transmitted by each subsystem. This time-sensitive information is automatically updated by the security system through an interface or manually recorded and updated. Real-time updates of the aforementioned time-sensitive data include real-time updates of path node attribute data through devices or manually, primarily based on: 1. For time-sensitive data, real-time updates are performed by calling system or device data interfaces. 2. For non-time-sensitive information data, i.e., basic information, data is updated manually at regular intervals by developing troubleshooting and maintenance plans. Furthermore, the attribute data should be able to be updated regularly or in real-time by the system, sensors, devices, or manually, and the updated data information should be stored in a knowledge graph, either manually or automatically.

[0060] Step S2: Obtain the performance evaluation indicators of the security system, perform quantitative analysis of the security system's performance, and generate an intrusion path map; the intrusion path map is as follows: Figure 4 As shown, in the intrusion path map, based on the security unit's construction plan and spatial information, as well as the openness of each security area, the security unit is divided into unrestricted areas, restricted areas, and building protection zones. The intrusion path map has the following definitions:

[0061] An intrusion path graph is actually represented by RDF relation triples in a knowledge graph, where IPG = (S, E, R).

[0062] S = {S1, S2, S3, ..., S} n-1 ,Sn A set of path nodes, representing the layout of a security system, includes the starting node, intermediate nodes, and target node of the intrusion path. Nodes represent entities or instances. Figure 4 In the diagram, vehicle entrances / exits, visitor entrances / exits, personnel entrances / exits 1, and the perimeter wall represent different starting nodes. Monitoring area 1, monitoring area 2, monitoring area 3, personnel entrances / exits 2, personnel entrances / exits 3, and the perimeter wall represent different intermediate nodes. Target 1, target 2, and target 3 represent different target nodes.

[0063] E = {E ij The set of edges connecting path nodes |i,j=1,2,3....n-1,n} represents the relationships between path nodes and indicates the process of an intruder moving from one path node to another. In the diagram, the arrows show the process of moving from one path node to the next.

[0064] R i ={v1,v2,....v m} is a set of path node attributes. Each attribute corresponds to a path node attribute. Different attributes have different probabilities of stopping the same intrusion behavior. If the intruder's intrusion behavior is successful, the process moves to the next path node.

[0065] Specifically, quantitative analysis of the effectiveness of security systems includes quantitative evaluation of various security system attributes through expert assessments or data input via system interfaces.

[0066] The quantitative analysis of the security system's effectiveness and the generation of an intrusion path map include the following steps:

[0067] Step 2.1: Based on the security unit's construction plan and spatial information, and according to the openness of each security area, divide the security unit into different areas that progress from the outside in.

[0068] Furthermore, the zoning is primarily based on the following: 1. Dividing areas into restricted and unrestricted zones according to varying degrees of openness. 2. Further subdividing areas within restricted zones based on the different buildings and facilities. 3. Further refining the zones based on whether the protected objects are isolated. For detailed zoning results, please refer to [example...]. Figure 4 As shown, the area types should include external area types, open areas, restricted areas, and protected areas.

[0069] In step 1 above, data such as security system design drawings and security system design schemes should also be included. The coverage of the security system in the security unit should be tested, and a path map centered on the security system should be generated based on the actual coverage of the security system.

[0070] Step 2.2: Based on the different equipment and personnel factors in each area, the security area obtained in Step 2.1 is further divided into individual security nodes and numbered.

[0071] Specifically, in step 2, security nodes represent security areas. The selection of nodes, abstracting areas into nodes, is primarily based on the division of equipment and personnel. An intruder can freely choose their route within the area, but any intrusion path should pass through equipment detection or personnel. The main criteria for dividing security nodes are as follows: 1. If the area has multiple security facilities or subsystems, it is classified as a composite security node; 2. If the area has only a single security subsystem, it is classified as a single security node; 3. If the area has no security subsystem, it is classified as a missing security node.

[0072] Step 2.3: Link the security nodes together according to the path relationship, and connect the security target with the security node with the path relationship to generate an intrusion path map.

[0073] Specifically, the intrusion path graph uses security nodes to abstractly represent the basic and geographical attributes of the security system. Since any intrusion path will pass through at least one security node, the spatial graph generated by connecting security targets with security nodes that have path relationships is the intrusion path graph. Furthermore, importing the constructed intrusion path graph into Neo4j allows for better addition, deletion, modification, and querying of intrusion paths, improving its scalability.

[0074] After generating the intrusion path graph, the method further includes: constructing the attributes of each node in the intrusion path graph based on the security subsystems or personnel and equipment contained in the path nodes, and traversing all paths by depth-first search to improve the knowledge graph.

[0075] Specifically, the floor plan and security system construction plan information of the security unit are imported into a knowledge graph. Based on the security subsystems or personnel and equipment contained in the path nodes, the attributes of each node in the intrusion path graph are constructed. All paths are then traversed using depth-first search to refine the knowledge graph. The intrusion path graph represented by the knowledge graph, obtained through depth-first search, is as follows: Figure 5 As shown, path nodes S1, S2, S3, S4, S5, S6, and S7 are defined. For the path graph, there is a starting node S1 with out-degree but no in-degree; intermediate nodes S2, S3, S4, S5, and S6 with both out-degree and in-degree; and a target node S7 with in-degree but no out-degree. Preferably, an attribute table for each security node is constructed based on factors such as the security equipment, technology, and personnel included in each node. This table is then imported into the established intrusion path graph to complete the path graph.

[0076] Step S3: Analyze the probability of intrusion events occurring in security units over the years based on the generated intrusion path map, generate initial event occurrence matrices for different intrusion events; sort out the transition probabilities of each type of intrusion event, generate an event transition probability matrix, and calculate the security effectiveness matrix of each path node;

[0077] Furthermore, before step three (S4), the following steps are also included: collecting information on intrusion incidents of security units over the years, sorting out the intrusion incident occurrence process, and classifying the intrusion incident types according to different intrusion behavior methods; the intrusion incident types correspond to the three elements of detection, response, and prevention of security systems, and corresponding intrusion incident types can be added according to the protection requirements of security units.

[0078] It should be noted that the initial state occurrence matrix based on the intrusion path graph is not derived from any intrusion event for the initial intrusion event. The initial state occurrence matrix is ​​generated according to the occurrence probability of various intrusion events, representing the probability of the intrusion event occurring at the starting node.

[0079] Based on the collection and analysis of intrusion events, and considering the main functions and objectives of the security system, an intrusion event is defined as Q, where Q = {q1, q2, ..., q...}. n Let} represent the total number of n types of intrusion events, where n is defined as 3. By analyzing the historical intrusion event probabilities of the security unit, an initial event occurrence matrix for different intrusion events is generated. The initial occurrence matrix is: Where A i This represents the probability that event i occurs at the initial node.

[0080] The intrusion event transition matrix based on the intrusion path map is represented by an event transition matrix formed according to the relationship and probability of occurrence of each event, which represents the probability of one intrusion event developing into another.

[0081] It should be noted that a complete intrusion event consists of the mutual transitions between various types of intrusion events, and the intruder's intrusion behavior along a certain path is influenced by the previous intrusion behavior. By analyzing the transition probabilities of each type of intrusion event, an event transition probability matrix is ​​generated. This matrix represents the transition probabilities between events during the intrusion process; specifically as follows: Among them, B ij This represents the probability of event i changing into event j.

[0082] The security efficiency matrix based on intrusion path graph representation includes: importing basic performance information and dynamic performance information according to the attributes of each node, calculating the performance impact of various attributes on different types of intrusion events, and calculating the security performance matrix of each path node.

[0083] Furthermore, based on the different categories of each intrusion event, a security effectiveness matrix is ​​formed for each node in the corresponding path graph, representing the security effectiveness of the path node for different intrusion events.

[0084] Specifically, the security system information is divided into basic information and time-sensitive information. The basic information and time-sensitive information of the security system are weighted and calculated to obtain the contribution ratio of the basic information and time-sensitive information, thus forming basic performance information and dynamic performance information.

[0085] In this embodiment, the weighting of basic and timely information of the security system can be calculated using methods such as the Analytic Hierarchy Process (AHP), entropy weighting, or fuzzy AHP. The contribution ratio of basic and timely information can be obtained by collecting expert information on the weights using an importance comparison table, providing data for each method.

[0086] The attributes of each node include: video surveillance system, intrusion alarm system, access control system, communication system, security personnel, physical perimeter, and including but not limited to the security unit's dedicated equipment and systems. For example, the attribute definitions are as follows:

[0087] Attribute Name Data source Real-time Weight Video surveillance system System Interface Real-time updates A1 Intrusion alarm system System Interface Real-time updates A2 Access Control System System Interface Real-time updates A3 Communication system System Interface Real-time updates A4 security personnel Personnel List Regular updates A5 Physical perimeter Personnel Investigation Regular updates A6 .... ..... .....

[0088] Based on the attributes of each node, basic performance information and dynamic performance information are imported. Simulation experiments or index scoring methods are used to calculate the performance impact of various attributes on different types of intrusion events. Finally, the security performance matrix for each path node is calculated. Details are as follows: Among them, P ij This represents the security effectiveness at node i against different intrusion events j.

[0089] It is worth noting that this embodiment can also update the security effectiveness of path nodes in real time or periodically through expert evaluation or hierarchical analysis, thereby updating the security effectiveness matrix of each node.

[0090] In addition, it also includes updating the attributes of each node in real time based on the detection equipment and systems within the security unit, and calculating and updating the security effectiveness matrix.

[0091] Furthermore, the sources for real-time updates of attributes for each node include, but are not limited to: equipment maintenance logs, alarm information logs, and personnel duty rosters. The aforementioned equipment maintenance logs should include: equipment age, equipment operating status, alarm cause, false alarm rate, and number of personnel on duty.

[0092] Step S4: Import the obtained initial state occurrence matrix, intrusion event transition matrix, and security efficiency matrix into the intrusion path graph. Perform dynamic calculation and analysis on each path to calculate the weakest intrusion path. Utilize the characteristics of the knowledge graph to update the attributes of each intrusion path node and perform dynamic calculation and analysis on each path.

[0093] The process of dynamically calculating and analyzing each path to determine the weakest intrusion path includes the following steps:

[0094] A depth-first search is used to traverse the intrusion path graph and find all intrusion paths;

[0095] The security effectiveness of each intrusion path is calculated using the event transition matrix and the security effectiveness matrix of each node.

[0096] Identify the weakest link in the security system.

[0097] All intrusion paths are shown in Table 1 below:

[0098]

[0099] Furthermore, the security effectiveness of each intrusion path, calculated from the event transition matrix and the security effectiveness matrix of each node, is expressed as follows:

[0100] For an intrusion path with n nodes, the security effectiveness of the intrusion path = weight of node 1 × security effectiveness of node 1 + ... + weight of node n × security effectiveness of node n, i.e.: S = ∑p i q i Where i = 1, 2, 3, ..., n, pi represents the security effectiveness of path node i, and qi represents the weight of path node i. Specifically, the weight qi of path node i is obtained by the analytic hierarchy process with expert participation. The intrusion path calculation method based on the intrusion path map is optimized by the Viterbi algorithm.

[0101] In this embodiment, considering that intrusion behavior can actually be regarded as a temporal sequence, it is described as a hidden, randomly generated, unobservable intrusion behavior state sequence, and then an observable corresponding intrusion path is generated from each state.

[0102] The intrusion behavior along the intrusion path consists of an initial state matrix, a state transition matrix, and an observation probability distribution matrix, as shown in Figure 6. Furthermore, the intrusion path calculation method based on the intrusion path map is defined as follows:

[0103] For connected path nodes A and B in a path, different intrusion events occur respectively. The security effectiveness matrices A and B represent the security effectiveness A = (x1, x2, x3) at that node for different events. T B = (x4, x5, x6) T ;

[0104] The event transition matrix represents the probability of event changes, a i,j Represents the probability of event i developing into event j.

[0105]

[0106] It is known that the actual security effectiveness of any path node is the product of the security effectiveness of each path node and its event transition matrix. That is, the security effectiveness of path node i = the probability of occurrence of each initial event × the transition probability of each event × the security effectiveness of each event, i.e., P i =∑P1(P2) i-1 P3, where P i P1 represents the security effectiveness of intrusion path i; P2 represents the probability of the initial state occurrence matrix; P3 represents the probability of the intrusion event transition matrix; P4 represents the security efficiency matrix.

[0107] Specifically, combined Figure 6 As shown, for the path from S1 to S2, with intrusion event n=3, the following definitions are made for various matrices:

[0108] The security effectiveness from intrusion event 1 on node S1 to intrusion event 3 on node S2 is calculated as follows: Security effectiveness of node S1 for intrusion event 1 × Probability of event 1 occurring × Probability of transitioning from event 1 to event 3 × Security effectiveness of node S2 for intrusion event 3 = 0.312 × 0.951 × 0.466 × 0.951 = 0.13145, representing the security effectiveness under this state. Since the number of state transitions is n... 2 Finally, the sum of the security effectiveness for all event transfer scenarios is calculated, which is the security effectiveness from S1 to S2. See Table 2 below for details:

[0109] S1 Intrusion Incident An intrusion occurred in S2. Security performance N1 N1 0.058 N1 N2 0.087 N1 N3 0.131 N2 N1 0.097 N2 N2 0.094 N2 N3 0.108 N3 N1 0.075 N3 N2 0.110 N3 N3 0.131

[0110] From Table 2, we can see that the security effectiveness from S1 to S2 is the sum of the security effectiveness of each intrusion event, i.e., 0.058+0.087+0.131+0.097+0.108+0.075+0.110+0.131=0.891. The weakest case is when intrusion event N1 occurs at both nodes.

[0111] Secondly, the present invention also provides a security performance dynamic evaluation system based on knowledge graph, characterized in that it includes: a first data acquisition module, an intrusion path graph construction module, a second data acquisition module, and a security performance evaluation module;

[0112] The first data acquisition module is used to collect security system information and store the collected security system information into the graph database;

[0113] The intrusion path map construction module is used to quantitatively analyze the effectiveness of the security system based on the collected security system information and generate an intrusion path map.

[0114] The second data acquisition module is used to analyze the probability of intrusion events occurring in security units over the years based on the generated intrusion path map, generate initial event occurrence matrices for different intrusion events, sort out the transfer probabilities of each type of intrusion event, generate an event transfer probability matrix, and calculate the security effectiveness matrix of each path node.

[0115] The security performance evaluation module is used to import the obtained initial state occurrence matrix, intrusion event transition matrix and security performance matrix into the intrusion path map, perform intrusion path analysis, and calculate the weakest intrusion path.

[0116] It is understood that the knowledge graph-based dynamic evaluation system for security effectiveness provided by this invention corresponds to the knowledge graph-based dynamic evaluation method for security effectiveness provided in the foregoing embodiments. The relevant technical features of a knowledge graph-based dynamic evaluation system for security effectiveness can be referred to the relevant technical features of the knowledge graph-based dynamic evaluation method for security effectiveness, and will not be repeated here.

[0117] Thirdly, the present invention also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to at least one of the processors; wherein the memory stores instructions executable by the processor, the instructions being executed by the processor to implement the aforementioned knowledge graph-based dynamic evaluation method for security effectiveness.

[0118] Compared with existing technologies, this method discloses a dynamic evaluation method for security effectiveness based on knowledge graphs. By using knowledge graphs to provide a highly abstract representation of the security system and updating the knowledge graphs in conjunction with security system data, the analysis of intrusion paths is no longer limited to isolated static analysis, but rather a dynamic analysis of how each path changes over time. This greatly improves the accuracy of intrusion path analysis and enables the tracking and prevention of intrusion events.

[0119] The scope of protection of this invention is not limited to the examples described above. Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its scope and spirit. If such modifications and variations fall within the scope of the claims of this invention and their equivalents, then the intent of this invention also includes these modifications and variations.

Claims

1. A dynamic evaluation method for security effectiveness based on knowledge graphs, characterized in that: Includes the following steps: Collect security system information and store the collected security system information in the graph database; Based on the collected security system information, the effectiveness of the security system is quantitatively analyzed to generate an intrusion path map; this includes: based on the security unit's construction plan and unit spatial information, and based on the openness of each security area, dividing the security unit into different areas from the outside in, layer by layer; Based on the different equipment and personnel factors in each area, the obtained security area is further divided into security nodes and numbered. The security nodes are linked together according to their path relationships, and the security targets are connected to the security nodes with which they have path relationships, thus generating an intrusion path map; The intrusion path graph is improved by performing a depth-first traversal of all paths. Based on the generated intrusion path map, the probability of intrusion events occurring in security units over the years is analyzed, and an initial event occurrence matrix for different intrusion events is generated. The transition probabilities of each type of intrusion event are sorted out, an event transition probability matrix is ​​generated, and the security effectiveness matrix of each path node is calculated. The obtained initial state occurrence matrix, intrusion event transition matrix, and security effectiveness matrix are imported into the intrusion path map to perform intrusion path analysis and calculate the weakest intrusion path.

2. The method for dynamic evaluation of security effectiveness based on knowledge graphs according to claim 1, characterized in that... The security system information includes basic information and timely information. For timely data, it is updated in real time by calling the system or device data interface; for basic information, it is updated manually at regular intervals by formulating troubleshooting and maintenance plans.

3. The method for dynamic evaluation of security effectiveness based on knowledge graphs according to claim 2, characterized in that... The collection of security system information includes the following steps: The security system is integrated into the graph database through interfaces provided by various subsystems. By utilizing the security subsystems and various rules and regulations already established by the security unit, various types of security information from the security system are collected.

4. The method for dynamic evaluation of security effectiveness based on knowledge graphs according to claim 1, characterized in that... The calculation of the security effectiveness matrix for each path node includes: By importing basic performance information and dynamic performance information into the intrusion path map, and using simulation experiments or index scoring methods, the performance impact of various attributes on different types of intrusion events is calculated to obtain the security performance matrix of each path node.

5. The method for dynamic evaluation of security effectiveness based on knowledge graphs according to claim 1, characterized in that... The intrusion path analysis and calculation of the weakest intrusion path includes the following steps: A depth-first search is used to traverse the intrusion path graph and find all intrusion paths; The security effectiveness of each intrusion path is calculated using the event transition matrix and the security effectiveness matrix of each node. Identify the weakest link in the security system; Among them, the security effectiveness of intrusion paths In the formula, i = 1, 2, 3, ..., n; pi represents the security effectiveness of path node i, and qi represents the weight of path node i.

6. The method for dynamic evaluation of security effectiveness based on knowledge graphs according to claim 5, characterized in that... The security effectiveness calculation method for path node i is as follows: Security performance of path node i ,in, P1 represents the security effectiveness of intrusion path i; P2 represents the probability of the initial state occurrence matrix; P3 represents the probability of the intrusion event transition matrix; P4 represents the security efficiency matrix.

7. A dynamic evaluation method for security effectiveness based on knowledge graphs, characterized in that, include: The system comprises a first data acquisition module, an intrusion path map construction module, a second data acquisition module, and a security performance evaluation module. The first data acquisition module is used to collect security system information and store the collected security system information into the graph database; The intrusion path mapping construction module is used to quantitatively analyze the effectiveness of the security system based on the collected security system information and generate an intrusion path map; including: dividing the security unit into different areas from the outside to the inside, layer by layer, based on the security unit's construction plan and unit spatial information, and according to the openness of each security area; Based on the different equipment and personnel factors in each area, the obtained security area is further divided into security nodes and numbered. The security nodes are linked together according to their path relationships, and the security targets are connected to the security nodes with which they have path relationships, thus generating an intrusion path map; The intrusion path graph is improved by performing a depth-first traversal of all paths. The second data acquisition module is used to analyze the probability of intrusion events occurring in security units over the years based on the generated intrusion path map, generate initial event occurrence matrices for different intrusion events, sort out the transfer probabilities of each type of intrusion event, generate an event transfer probability matrix, and calculate the security effectiveness matrix of each path node. The security performance evaluation module is used to import the obtained initial state occurrence matrix, intrusion event transition matrix and security performance matrix into the intrusion path map, perform intrusion path analysis, and calculate the weakest intrusion path.

8. An electronic device, characterized in that: include: At least one processor; And a memory communicatively connected to at least one of the processors; wherein the memory stores instructions executable by the processor to implement a knowledge graph-based dynamic evaluation method for security effectiveness as described in any one of claims 1 to 6.

Images