A network space mapping expression method based on graph theory-space-time objects

Abstract

The present invention belongs to the field of cyberspace mapping technology, and specifically relates to a cyberspace mapping expression method based on graph theory-spacetime objects, comprising: obtaining cyberspace mapping data; organizing the cyberspace mapping data using a cyberspace mapping expression model to form data for expression; and visually expressing the organized cyberspace mapping data at a selected cyberspace level. The cyberspace mapping expression model uses a node set to represent cyberspace resources and an edge set to represent cyberspace relationships; an edge represents a cyberspace relationship between two corresponding nodes; both cyberspace resources and cyberspace relationships are strongly correlated with time, and their corresponding objects are multi-granularity spacetime objects. Therefore, the present invention solves the problems in the prior art of inconsistent organization of different cyberspace mapping data, incompatibility in organizing cyberspace mapping data at various network levels, inability to quickly achieve visual expression of various cyberspace levels, and poor expression effects.

Description

Technical Field

[0001] The present invention belongs to the technical field of network space mapping, and in particular relates to a network space mapping expression method based on graph theory-space-time objects. Background Art

[0002] With the rapid development of technologies like the internet and the Internet of Things, cyberspace has become a fully integrated part of human life. Cyberspace has become the fifth strategic space, alongside land, sea, air, and space. Compared to physical space, cyberspace possesses several characteristics: First, it is a complex system. Its sheer size, complex technical structure, and frequent cyberattacks make it difficult to accurately map, perceive, and intuitively interpret. Second, it is pervasive. Cyberspace has permeated all political, economic, military, cultural, and social sectors globally, supporting and influencing the functional stability and operational order of each sector. Third, it is dynamic and real-time. The topology, communication paths, and operational state of cyberspace can be adjusted and shaped on demand through technical means. Changes to network addresses, ports, routes, host identities, communication protocols, and instruction sets directly impact the overall state of cyberspace. A comprehensive understanding of the characteristics of cyberspace and its resource distribution is crucial for both boosting the national economy and safeguarding national security. Consequently, cyberspace mapping technology has emerged as a new application of surveying and mapping science and technology to this new domain, a natural extension of geospatial mapping.

[0003] Cyberspace mapping refers to the theory and technology of taking cyberspace as the object, computer science, network science, mapping science, information science as the basis, network detection, network analysis, entity positioning, geographic mapping and geographic information system as the main technologies, obtaining the location, attributes and topological structure of cyberspace physical resources and virtual resources in cyberspace through detection, collection, processing, analysis and display, and mapping them to geographic space, drawing their coordinates, topology, surrounding environment and other information in the form of maps or other visual forms and showing related situations, and conducting spatial analysis and application based on this.

[0004] Cyberspace is an extremely complex space. Various cyberspace resources are distributed in cyberspace. These cyberspace resources are interconnected through communication networks, and various cyber events such as cyber attacks, virus ransomware, and network protection are happening all the time. In addition, compared with objects in geographic space, cyberspace expression objects have the following characteristics, which need to be considered when designing expression models. (1) Resources are cross-layered. Cyberspace can be divided into physical layer, logical layer, and cognitive layer. Different cyberspace layers contain different resources and different attributes of resources in cyberspace, and the same type of resources may span different cyberspace layers. For example, hardware devices contain both location attributes (physical layer) and logical topological relationships between devices (logical layer); network users contain both location attributes (physical layer), user operations (logical layer), and ideology (cognitive layer). Cyberspace situation expression needs to fully consider this feature. (2) Element association. The association relationship of cyberspace is the key content that needs to be expressed in cyberspace. In the multi-granular spatiotemporal object model proposed in some literature, it is regarded as a kind of behavioral feature, which obviously cannot highlight the characteristics of the interconnection of all things in cyberspace. In addition, the association relationship of cyberspace involves the relationship between multiple entity targets and needs to be highlighted. (3) Frequent events. Cyberspace events change rapidly, and not only the geographical location changes with time, but also the equipment operation status and traffic changes are all changing in real time. Therefore, all elements in the expression object attributes should be functions of time and change with time. (4) Scale change. When expressing the results of cyberspace mapping, due to different user roles, task requirements, etc., the scale of the cyberspace map or the position of the observer's viewpoint in the visualization engine will change. In order to clearly present the expression elements of cyberspace, it is necessary to perform automatic comprehensive operations such as adding, deleting, and transforming the shape of the expression elements according to conditions such as scale or viewpoint position to achieve multi-scale expression of cyberspace.

[0005] The above analysis is about the objects that need to be expressed in cyberspace and their characteristics. In short, these cyberspace mapping objects are complex and their spatial relationships span multiple network levels. In the existing technical solutions, various cyberspace mapping data are not organized uniformly and are not universal between different network levels. As a result, multiple data organization forms are used when organizing cyberspace mapping data at various network levels. This is cumbersome to implement, and it is not possible to quickly realize the visualization of various cyberspace levels, and the expression effect is poor. Summary of the Invention

[0006] The purpose of the present invention is to provide a network space mapping expression method based on graph theory-space-time objects, so as to solve the problems in the prior art of inconsistent organization of different network space mapping data, non-universal organization of network space mapping data at various network levels, cumbersome operation, inability to quickly realize the visualization expression of various network space levels and poor expression effect.

[0007] In order to solve the above technical problems, the technical solutions provided by the present invention and the corresponding beneficial effects of the technical solutions are as follows:

[0008] The present invention provides a network space mapping expression method based on graph theory-space-time objects, comprising the following steps:

[0009] 1) Obtain cyberspace mapping data;

[0010] 2) Using a cyberspace mapping expression model to organize the cyberspace mapping data into data for expression; the cyberspace mapping expression model is formally described as:

[0011] M=<O(t),E(t)>

[0012] Wherein, M is the cyberspace mapping expression model, O(t) is the node set representing cyberspace resources in the cyberspace mapping expression model, t represents time, and E(t) is the edge set representing cyberspace relationships in the cyberspace mapping expression model;

[0013] The node set O(t) is formally described as:

[0014] O(t)={o1(t),o2(t),…,o n (t)}

[0015] Among them, t represents time, o i (t) is the i-th node in O(t), o i (t) represents a network space resource object, a network space resource object o i (t) includes attribute features p(t), spatiotemporal features sp(t,s,l) and behavioral features a(t), o i (t) is formally described as:

[0016] o i (t)=[p(t),sp(t,s,l),a(t),…],t∈[t b ,t e ],i=1,2,…,n

[0017] Among them, [t b ,t e ] represents the network space resource object o i(t), l represents the cyberspace level, s represents the scale or the viewpoint distance in the visualization engine, the attribute feature p(t) represents the attribute information of the cyberspace resource object, the spatiotemporal feature sp(t,s,l) represents the spatial information of the cyberspace resource object, and the behavioral feature a(t) represents the behavior of the cyberspace resource object;

[0018] The formal description of the edge set E(t) is:

[0019] E(t)={e1(t),e2(t),…,e n (t)}

[0020] Among them, e i (t) is the i-th edge in E(t), e i (t) represents the network space relationship between two nodes, including: <o u (t),o v (t)>, spatiotemporal features sp′(t,s,l), attribute features p′(t) and state features s(t), e i (t) is formally described as:

[0021] e i (t)=[ <o u (t),o v (t)>,sp′(t,s,l),p′(t),s(t),…],t∈[t′ b ,t′ e ],i=1,2,…,n

[0022] Among them, u (t),o v (t) represents edge e i (t) corresponds to two nodes, the spatiotemporal feature sp′(t,s,l) represents the position when the edge is drawn, l is the network space level, [t′ b ,t′ e ] represents edge e i (t), the state feature s(t) represents the state information corresponding to the edge, and p′(t) represents the attribute information associated with the edge;

[0023] 3) Visualize the organized cyberspace mapping data at the selected cyberspace level to obtain a cyberspace map.

[0024] The beneficial effects of the above technical solution are: based on the analysis of the three major categories of cyberspace expression objects: cyberspace resources, relationships, and events, combined with the time, space, behavior and other characteristics that need to be paid attention to in cyberspace expression, following the three principles of graph theory as the basis, combining multi-granularity spatiotemporal objects, and strengthening time attributes, a cyberspace mapping expression model based on graph theory-spatiotemporal objects is designed. The data organization form of each network level in this cyberspace mapping expression model is unified and suitable for each network level. It can organize the cyberspace mapping data very conveniently, thereby realizing the visualization expression of each level of cyberspace simply and quickly. The data of each network level is complete, the logic of data organization of the cyberspace mapping expression model of the present invention is clear, and the expression effect is good.

[0025] This cyberspace mapping model effectively encompasses cyberspace representation objects such as resources, relationships, and events. It comprehensively reflects the characteristics of cyberspace resources, such as cross-layered, interconnected elements, frequent events, and variable scales, effectively organizing and expressing complex cyberspace information. Furthermore, this model is based on graph theory, and theoretical findings related to graph theory can be further applied to this model to support relevant analytical applications of cyberspace.

[0026] Furthermore, in order to further enrich the elements related to cyberspace resources and cyberspace relationships and make the information content more abundant, node o i (t) also includes the geometric features g(t,s,l), including the geometric features g(t,s,l) after o i (t) is formally described as:

[0027] o i (t)=[p(t),sp(t,s,l),g(t,s,l),a(t),…]

[0028] Wherein, the geometric feature g(t,s,l) represents the cyberspace map symbol used in the expression;

[0029] Edge i (t) also includes the geometric feature g(t,s,l), including the edge e after the geometric feature g′(t,s,l) i (t) is formally described as:

[0030] e i (t)=[ <o u (t),o v (t)>,sp′(t,s,l),g′(t,s,l),p′(t),s(t),…]

[0031] Among them, the geometric feature g′(t,s,l) represents the shape of the edge when it is expressed.

[0032] Furthermore, in order for the cyberspace mapping expression model to be applicable to different layers and displayed at different layers according to needs, the cyberspace hierarchy includes a physical layer, a logical layer, and a cognitive layer.

[0033] Furthermore, when the network space resource object is a server, the attribute characteristics of the server include the server type, capacity size and bandwidth size; the spatiotemporal characteristics of the server include the geographical location where the network space resource object is deployed; and the behavioral characteristics of the server include the specific services and protection behaviors provided by the network space resource object.

[0034] Furthermore, in order to improve the credibility of the data, before organizing the cyberspace mapping data in step 2), the cyberspace mapping data needs to be cleaned to obtain credible cyberspace mapping data.

[0035] Furthermore, in order to ensure the consistency of the expression results, before the organized cyberspace mapping data are visualized at the selected cyberspace level in step 3), it is necessary to perform spatiotemporal benchmark assimilation to perform spatiotemporal conversion on various types of cyberspace mapping data including cyberspace resources, cyberspace relationships, and cyberspace events, so as to transform them into a unified time and space benchmark.

[0036] Furthermore, in order to provide a good display effect, in step 3), a virtual observer object is set when visually expressing the organized cyberspace mapping data, and the virtual observer object is used to dynamically manage the content displayed during the visual expression.

[0037] Furthermore, in order to dynamically manage the display content during expression and provide a good display effect, the display content and display form are selected according to needs from a variety of expression contents. The form of the virtual observer object is described as follows:

[0038] S″(t)=[p″(t),sp″(t),g″(t,s,l)…]

[0039] Among them, S″(t) is the virtual observer object, p″(t) refers to the expression parameters that need to be set when expressing in cyberspace, sp″(t) refers to the spatiotemporal position of the virtual observer that determines the result of cyberspace expression, g″(t,s,l) refers to the display viewport and posture of the virtual observer, l is the cyberspace level to which the expression belongs, and s represents the scale or the viewpoint distance in the visualization engine. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a schematic diagram of the classification of network space resources used in the present invention;

[0041] Figure 2It is a schematic diagram of the network space relationship of different levels of the present invention;

[0042] Figure 3 It is a schematic diagram of the network space mapping expression model of the present invention;

[0043] Figure 4 It is a structural diagram of the network space mapping expression model based on graph theory-space-time objects of the present invention;

[0044] Figure 5 It is a schematic diagram of the structure of the multi-granularity spatiotemporal object model mentioned in the present invention;

[0045] Figure 6 It is a diagram showing the realization of the network space mapping expression model of the present invention;

[0046] Figure 7 It is a flow chart of the steps of processing cyberspace mapping expression data of the present invention;

[0047] Figure 8 It is a schematic diagram of the network space mapping expression model including a virtual observer of the present invention;

[0048] Figure 9 is a flowchart of the execution of virtual observer instructions of the present invention;

[0049] Figure 10 It is the XML structure diagram of the cyberspace visualization scene organization file of the present invention;

[0050] Figure 11-1 This is a schematic diagram of an XML file for a network space visualization scene organization of the present invention;

[0051] Figure 11-2 This is another XML schematic diagram of a cyberspace visualization scene organization file of the present invention;

[0052] Figure 12 is an example diagram of the expression of the network space resource 38008 of the present invention;

[0053] Figure 13 This is an example diagram of the network space logical relationship expression of the present invention;

[0054] Figure 14 Schematic diagram of the multi-scale expression result of the network space of viewpoint 1 according to the present invention;

[0055] Figure 15 This is a schematic diagram of the multi-scale expression results of the network space for viewpoint 2 of the present invention. DETAILED DESCRIPTION

[0056] Cyberspace mapping can fully understand the characteristics of cyberspace and its resource distribution. The present invention mainly focuses on the problem of cyberspace mapping expression model in the "how to draw" of cyberspace mapping. The present invention summarizes the cyberspace expression objects into three categories: cyberspace resources, relationships, and events. Based on the analysis of the characteristics of these three types of expression objects, combined with the characteristics of cyberspace resources being cross-layer, element-related, frequent events, and variable scales, the present invention follows the three principles of being based on graph theory, combining multi-granularity spatiotemporal object models, and strengthening time attributes. A cyberspace mapping expression model based on graph theory-spatiotemporal objects is designed, and a formal description and specific implementation methods are given. Cyberspace mapping expression experiments show that the model can effectively cover various types of cyberspace expression objects, reflect the characteristics of cyberspace, and achieve effective organization and expression of complex cyberspace information.

[0057] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below with reference to the accompanying drawings and embodiments.

[0058] Method Example:

[0059] 1. Analysis of objects expressed in cyberspace.

[0060] Cyberspace is an extremely complex space. Various cyberspace resources are distributed in cyberspace. These cyberspace resources are interconnected through communication networks. In addition, various cyber events such as cyber attacks, virus ransomware, and network protection are occurring every moment. Therefore, in general, the objects of cyberspace expression mainly include three categories: cyberspace resources, cyberspace relationships, and cyberspace events.

[0061] 2. Objects expressed in cyberspace.

[0062] (1) Cyberspace resources.

[0063] Cyberspace resources are the main objects of cyberspace expression, which constitute the supporting foundation of cyberspace. The classification standards of cyberspace resources are diverse, and different scholars have proposed different classification methods from different perspectives. For example, some scholars divide cyberspace resources into four types of elements: carriers, information, subjects, and operations. Some scholars have constructed a cyberspace element classification system under the guidance of the "human-land-network" linkage theory. Some scholars divide cyberspace resources into terminal equipment, switching equipment, transmission media, virtual themes, information data, etc. Some scholars, from the perspective of material form and social form, divide cyberspace resources into physical resources and virtual resources. This classification method has been recognized by many scholars in the industry. The present invention also adopts this cyberspace resource classification method, such as Figure 1As shown in the figure, the physical resources of cyberspace are mainly composed of switching devices and access devices. Switching devices are mainly node devices used for information exchange, such as switches, routers, WiFi devices, communication base stations, etc. Access devices are terminal devices that access the network, such as PCs, servers, mobile phones, laptops, cameras, etc., which can be divided into fixed-line access devices, mobile network access devices and Internet of Things / industrial control network access devices according to the access method; virtual resources of cyberspace are information content, virtual people and virtual services in cyberspace. Information content includes chat, communication information, text, and video documents; virtual people refer to WeChat, Weibo, QQ and other accounts; virtual services include DNS, websites, email and other services. In addition, network systems and organizations that provide network services, such as autonomous domain systems (AS), can also be classified as virtual services.

[0064] (2) Cyberspace relations.

[0065] Cyberspace relations refer to the connection relations between various cyberspace resources in cyberspace. The various cyberspace resources in cyberspace are not independent. Various resources need to be connected through information and communication facilities such as the Internet, mobile communication networks, and the Internet of Things to jointly constitute cyberspace. Therefore, cyberspace relations are another important type of object that needs to be expressed. Cyberspace relations affect the understanding of the connectivity situation of the entire cyberspace. Cyberspace relations are currently mainly described in the form of network topology, but this description method mainly describes the logical connectivity relationship between network nodes and is not applicable to scenarios that are strongly related to geographic space. Cyberspace relations can be divided into different types of cyberspace relations according to different hierarchies. Taking the international Internet as an example, it can be divided into different hierarchical relationships such as AS relations, PoP (Points of Presence) relations, routing relations, and IP node relations. AS relations represent the connectivity relationship between different network autonomous domains. Each AS contains multiple PoPs, and PoPs are connected by multiple routes. IP nodes are the most basic nodes, such as Figure 2 shown.

[0066] In addition, there are similar network hierarchical relationships for other types of networks. In addition, the expression of cyberspace also needs to reflect the relationship between people, land and network, as well as the relationship between cyberspace and geographical space and social space.

[0067] (3) Cyberspace events.

[0068] Various events such as cyber attacks, information destruction, virus ransomware, and equipment failures are happening in cyberspace every moment. The dynamic presentation of these events is also an important part of cyberspace expression. The focus of expressing cyberspace events is to reflect the dynamic nature of cyberspace events. Each event has a life cycle, with a start time, an end time, and milestone nodes of development. Therefore, when expressing, it is necessary to show the development and evolution process of the entire event throughout its life cycle, as well as possible future development trends.

[0069] 3. Analysis of the characteristics of the expression object.

[0070] Compared with geographic objects, cyberspace objects have the following characteristics that need to be considered when designing the representation model: (1) cross-layer resources; (2) element associations; (3) frequent events; and (4) variable scales.

[0071] 4. Design of cyberspace mapping expression model.

[0072] The above analysis is about the objects that need to be expressed in cyberspace and their characteristics. These objects are complex and intricate. To use computers to draw these complex objects, an expression model must be established to achieve a regular description of these objects, so as to organize the data in a unified way and manage the scenes when the computer is performing visual expression. Figure 3 shown.

[0073] 4.1. Design of cyberspace mapping expression model.

[0074] In order to comprehensively cover the three categories of expression objects of cyberspace resources, relationships, and events, while highlighting the characteristics of cyberspace resources that are cross-layer, element-related, event-heavy, and scale-variable, the present invention designs a cyberspace mapping expression model based on graph theory-space-time objects, such as Figure 4 As shown in the figure, the model follows three principles: based on graph theory, combined with multi-granularity spatiotemporal object model, and strengthening time attributes.

[0075] (1) Based on graph theory. The current expression models of various network space logical relationships are mainly based on graph theory, which can effectively express various network space relationships. Network space relationships are the focus of network space expression. Therefore, the expression model of the present invention is still constructed based on graph theory. In graph theory, a graph is an ordered binary array. It can be expressed by G=<V,E> Indicates that V = {v1, v2, ..., v n} is a finite non-empty set, called a node set, and its elements are called nodes. n} is a finite set, called the edge set, and each element in E has a corresponding node pair in V, called an edge. Edges e can be directed or undirected. Directed edges and ordered node pairs<u,v> Correspondingly, u is called the starting point of e, and v is the end point of e.<u,v> Correspondingly, u and v are called the two endpoints of e. Graph theory can be used to analyze the connections between things and is widely used in modeling interconnected systems, such as communication networks, social networks, transportation networks, business networks, and so on.

[0076] In the traditional cyberspace model, various terminals are abstracted as nodes without size in graph theory, and the communication lines between various terminals are abstracted as edges without width. However, in the model designed by the present invention, each node is no longer a simple point without size, but a spatiotemporal object model that can express various types of cyberspace resources; the edges connecting the nodes are no longer lines without width, but lines that can reflect properties such as physical distance and traffic size. The model designed based on graph theory can respectively represent the physical connectivity relationship of the physical layer, the logical topology relationship of the logical layer, and the social relationship of the cognitive layer. In addition, based on graph theory, it lays the foundation for this model to use the latest artificial intelligence methods such as graph neural networks to carry out cyberspace situation analysis.

[0077] (2) Combining a multi-granularity spatiotemporal object model. In the model designed by the present invention, the nodes in the figure are multi-granularity spatiotemporal object models. The spatiotemporal object models in some literatures are composed of only three contents: attributes, spatiotemporal and geometric features, which are relatively simple. The multi-granularity spatiotemporal object models in some literatures are composed of eight contents: spatiotemporal reference, spatial position, spatial form, composition structure, association relationship, cognitive ability, behavioral ability and attribute characteristics, as follows Figure 5 shown.

[0078] The multi-granularity spatiotemporal object model adopted in the present invention combines the characteristics of cyberspace surveying and mapping expression, focusing on attributes, space-time, geometry, behavior and other characteristics, which correspond to the attribute characteristics, spatial position, spatial form, behavioral capabilities and other contents of the above-mentioned multi-granularity spatiotemporal object model. When performing specific visual expressions, these attributes can be concretized. For example, the expression of a server includes attribute characteristics such as server type, capacity, bandwidth, etc. The spatiotemporal characteristics mainly refer to the geographical location of its deployment. The geometric shape expression can be represented by standardized cyberspace map symbols, and the behavioral characteristics can be the specific services or protection behaviors it provides. In order to better express cyberspace at multiple scales, the spatiotemporal and geometric features in the model must also be related to the scale of the cyberspace map or the observation viewpoint distance in the visualization engine. The geometric representation of spatiotemporal objects is different for different scales or viewpoint distances, and it changes according to certain cartographic synthesis rules. The position of the object also needs to be appropriately adjusted during the corresponding expression to achieve the best expression effect. At the same time, the geometric shape also needs to change accordingly according to the level of expression. For example, when expressing the cyberspace relationship at the physical layer, the geometric shape of each node is a physical symbol with size, but when expressing the cyberspace relationship at the logical layer, each node can be expressed by a simple point.

[0079] (3) Strengthening the time attribute. In order to better express events in cyberspace and reflect the characteristics of frequent events, the expression mode designed by the present invention is a model with strong time correlation. In the model, whether it is the nodes, edges, or spatiotemporal object models in graph theory, they all use time as a variable and change with time. Even features that do not change with time are designed as functions of time, but the function is a constant. At the same time, all objects have a specific life cycle, and the occurrence, evolution, and extinction of all events are also managed and expressed with time as the main line. They are reflected in the model as a series of behaviors that change with time.

[0080] 4.2. Description of the cyberspace mapping expression model.

[0081] The cyberspace mapping expression model is actually a cyberspace mapping visualization expression model based on graph theory-spatio-temporal object (G-STO Model).

[0082] Following the above design principles, the following formal description of the cyberspace mapping expression model is given, as shown in formulas (1) to (5).

[0083] M=<O(t),E(t)> (1)

[0084] in:

[0085] O(t)={o1(t),o2(t),…,o n (t)} (2)

[0086] in:

[0087] o i (t)=[p(t),sp(t,s,l),g(t,s,l),a(t),…],t∈[t b ,t e ],i=1,2,…,n (3)

[0088] In formula (1):

[0089] E(t)={e1(t),e2(t),…,e n (t)} (4)

[0090] in:

[0091] e i (t)=[ <o u (t),o v (t)>,sp′(t,s,l),g′(t,s,l),p′(t),s(t),…],t∈[t′ b ,t′ e ],i=1,2,…,n (5)

[0092] In the above formula, M in formula (1) represents the cyberspace mapping expression model, O(t) represents the multi-granularity spatiotemporal object set (cyberspace resource set) representing the nodes in the model, t represents time, and the i-th node o i (t) is a multi-granularity spatiotemporal object (a cyberspace resource object), the i-th cyberspace resource object o i (t) is composed of multiple time-related features such as p(t) attribute features, sp(t,s,l) spatiotemporal features, g(t,s,l) geometric features and a(t) behavioral features. The i-th cyberspace resource object o i The life cycle of (t) is [t b ,t e ], sp(t,s,l) spatiotemporal features and g(t,s,l) geometric features s represents the scale or the viewpoint distance in the visualization engine, l indicates which layer it belongs to when expressing, the physical layer, the logical layer, or the cognitive layer, and the behavioral feature a(t) is a series of behaviors generated by the change over time, which constitutes an event; E(t) represents the edge set representing the network space relationship in the model. In formula (5), o u (t),o v (t) represents the edge e i(t) corresponds to the two nodes, sp′(t,s,l) represents the position of the edge when it is drawn, which is also related to the time t, the scale or the viewpoint distance s in the visualization engine, and the expression level l. g′(t,s,l) is the shape of the edge when it is expressed, such as line width, line color, etc. p′(t) represents the attribute information associated with the edge, and s(t) represents the state information corresponding to the edge, such as the connection status, etc. The i-th edge e i (t) also has a life cycle [t′ b ,t′ e ]. From the formal description of the model, it can be seen that in this model, O(t) corresponds to the cyberspace resources to be expressed, E(t) represents the cyberspace relationship, and a(t) represents the cyberspace event. All elements are variables of time t, reflecting the high dynamic characteristics of frequent cyberspace events. It can be said that this model covers the objects to be represented in cyberspace very well and reflects the characteristics of cyberspace.

[0093] 4.3. Implementation of cyberspace mapping expression model.

[0094] Class organization: Based on the designed network space mapping expression model, the object-oriented concept is used for computer implementation. Specifically, the entire network space is abstracted into two base classes, namely the object base class (ObjectBaseClass) and the relationship base class (EdgeBaseClass), which correspond to O(t) and E(t) in the model respectively. Figure 6 shown.

[0095] The object base class (ObjectBaseClass) is composed of attribute information (Property), spacetime (SpaceTime), geometry (Geometry), behavior (Action) and other elements, which correspond to the p(t) attribute characteristics, sp(t,s,l) spacetime characteristics, g(t,s,l) geometry characteristics, a(t) behavior characteristics, etc. in the model. These base class elements are also abstracted from the corresponding characteristics of the network space expression elements. For example, the geometry base class (Geometry) can be further derived based on the geometry base class to generate geometry types such as servers, routers, and computer terminals. The actual expression is based on the actual situation. Select inheritance and derivation; the relationship base class (EdgeBaseClass) is composed of elements such as endpoints (EndPoints), spacetime (SpaceTime), geometry (Geometry), property information (Property), and state information (State). Endpoints (EndPoints) records the two endpoints corresponding to the edge, and spacetime (SpaceTime) manages the location of the edge drawing. Geometry (Geometry) is mainly the specific expression style of the edge during expression. It can have different expression styles in the physical layer, logical layer, and cognitive layer. In addition, the edge itself can also be represented by a straight line or curve as needed. All objects to be expressed in cyberspace can inherit from these two base classes. When performing actual computer expression, the visual expression engine only needs to maintain the object drawing list List <objectbaseclass>and relationship drawing list List <edgebaseclass>All are possible. Each expression element can further refine its internal structure according to its own characteristics, inherit and instantiate each expression element from the base class, and draw it using computer graphics methods. Related events are based on time variables and consist of a series of behaviors that occur according to time. Ultimately, a cross-layer, associated, and highly dynamic cyberspace map covering cyberspace resources, relationships, and events is constructed.

[0096] Since cyberspace mapping data comes from various sources and has a complex structure, it also needs to be standardized, such as Figure 7 As shown, in order to be used for network space drawing expression, the specific data processing is described below in combination with the steps of the present invention:

[0097] Step 1: Obtain cyberspace mapping data.

[0098] ① Data collection. This step is the source of data processing. Data collection can be obtained in real time through network detection, or it can be extracted from existing databases on demand. It also needs to support multiple methods such as reading and interactive input of document data.

[0099] ② Data cleaning. Due to the uncertainty of data sources, data quality is generally difficult to guarantee. Therefore, it is necessary to clean the cyberspace surveying and mapping data accordingly to remove the false and retain the true, and to remove the coarse and retain the fine, so as to provide reliable data for cyberspace mapping and expression.

[0100] ③ Assimilation of temporal and spatial datums. To ensure consistency in the results, it is necessary to perform temporal and spatial conversion on all types of data, transforming them to a unified temporal and spatial datum. Steps ② and ③ utilize existing technologies and will not be elaborated on here.

[0101] Step 2: Use the cyberspace mapping expression model introduced in Section 4.2 to organize the cyberspace mapping data into data for expression.

[0102] This step is to reorganize the cyberspace mapping data logically and in terms of data organization and management according to the cyberspace mapping expression model designed by the present invention to form data for expression.

[0103] Step 3: Visualize the organized cyberspace mapping data at the selected cyberspace level.

[0104] The last step is to use the corresponding graphical display method, based on the cyberspace mapping expression engine, and under the management of the virtual observer object, to express various cyberspace objects and form a dynamic cyberspace map.

[0105] The following describes the virtual observer object:

[0106] For the expression of spatial events in the network, in addition to the need for various expression objects designed in the model to be strongly related to time, in actual expression, in order to display the full picture of the network space event throughout the entire process, it is necessary to use script-driven technology. Script-driven is a commonly used technology in various game engines. It can make game characters run according to rules and complete automatic scene switching. Here, the script management concept is introduced into the network space mapping expression model based on graph theory-space-time objects designed by the present invention. The script management function is virtualized as a virtual observer object, which is a multi-granularity space-time object model. The difference is that it is not an expression object, but it affects the final drawing result of the expression object. The description model of the virtual observer object is shown in formula (6).

[0107] S″(t)=[p″(t),sp″(t),g″(t,s,l)…] (6)

[0108] In formula (6), S″(t) is the virtual observer object, p″(t) mainly refers to the various expression parameters that need to be set when expressing cyberspace, such as the visibility setting of a certain type of parameter element, the start and end time of the expression scene, etc.; sp″(t) is also a spatiotemporal feature, but it refers to the spatiotemporal position of the virtual observer that determines the result of cyberspace expression, which determines the range of the final presented cyberspace map. The spatiotemporal position can be used to accompany and fly around the observation target according to the corresponding instructions; g″(t,s,l) is a geometric feature, which refers to the display viewport, posture and other contents of the virtual observer. Therefore, the cyberspace surveying and mapping expression model after adding the virtual observer becomes as follows Figure 8 The structure shown.

[0109] Specifically in terms of implementation, the virtual observer relies on a series of instructions to complete the management of the script, corresponding to the three basic elements p″(t), sp″(t), g″(t, s, l). The instructions are mainly divided into expression parameter setting command class, spatiotemporal control command class, and geometric feature command class. Expression parameter setting command class, such as S_Property_Set (setting scene parameters), S_Property_BeginTime (setting the start time of the entire scene expression), S_Property_EndTime (setting the end time of the entire scene expression), S_Property_SetTime (setting simulation time), S_Property_SetTimeRat e (set simulation step size), etc.; space-time control command class, such as S_SpaceTime_Follow (set the viewpoint to follow a certain object), S_SpaceTime_Center (set to follow a certain object at the center of the screen), S_SpaceTime_Goto (the viewpoint reaches the object to be followed), S_SpaceTime_SetPosition (set the viewpoint position), etc.; geometric feature command class, such as S_Geometry_ViewPort (set expression window parameters), S_Geometry_Fov (set expression field of view angle), S_Geometry_Attitude (set virtual observer observation posture angle), etc.

[0110] A series of instructions of the virtual observer are given in the form of script files. The command format of the virtual observer script is: command name {[parameter name parameter][parameter name parameter]…}.

[0111] The command name is the keyword corresponding to each script command class. The parameter list is in curly brackets. The number of parameters depends on the specific command. The parameter name indicates the parameter type. For example, S_SpaceTime_Goto{object "25.20.234.9" time 5} means that the virtual observer's observation point will switch to the target "25.20.234.9" after 5 seconds. The specific execution process of the virtual observer command script is as follows: Figure 9 The dotted box on the left is the work that the virtual observer needs to complete.

[0112] In order to verify the effectiveness of the expression model of the present invention, the network space mapping expression model of the present invention is used to express AS as an example:

[0113] This example visualizes the global ASes. AS status is a key indicator of the level of sophistication of each country's network infrastructure in cyberspace. AS information effectively represents the elements of cyberspace. Each AS can be attributed to a virtual resource within cyberspace resources. The relationships between ASes globally are a typical cyberspace relationship. At the AS layer, a cyberattack manifests itself as an attack initiated by a terminal in one AS against one or more terminals in another AS. ASes exhibit the typical characteristics of cyberspace: cross-layer resources, interconnected elements, and frequent events. The data used in this experiment is provided by the CAIDA (The Cooperative Association for Internet Data Analysis) website. The data includes detailed information about AS objects and AS topology relationships. The specific data is shown in the table below.

[0114] Table 1AS data

[0115]

[0116] (1) Model-based data organization.

[0117] The CAIDA website stores data in multiple, distributed files. To represent the global AS landscape, this dispersed data needs to be reorganized into a regularized description based on a designed representation model. According to the model designed in this invention, AS representations inherit from the object base class (ObjectBaseClass) and the relationship base class (EdgeBaseClass) to obtain two AS representation classes, ASObject and ASEdge. The core elements of these two classes are shown in Tables 2 and 3 below. Other elements can be flexibly added based on specific application scenarios.

[0118] Table 2 Core elements of ASObject class

[0119]

[0120] Table 3 Core elements of ASEdge class

[0121] Feature name What's included endpoint features The two AS names corresponding to the edge Space-time elements The location of the AS edge drawing, mainly refers to the location of the key point when it is not a straight line Geometric shape elements Edge type, width, color, etc., including geometric shapes of different scales and levels Attribute elements Edge number Status elements Communication relationship, whether there are network events happening on the edge

[0122] In this way, each AS and the corresponding AS edge can be instantiated from these two classes, and the data in the class is extracted from the corresponding data file or database. At the same time, in order to further strengthen the management of data, a targeted database can be designed based on the expression model designed by the present invention to store and manage these data. After the data is extracted, the XML-based method is used to organize the data in the network space visualization expression system. Figure 10 The following is the corresponding XML structure framework diagram. Figure 11-1 、 Figure 11-2 Take a screenshot of the corresponding XML file instance. When performing visualization in this way, XML data can be directly assigned to ASObject and ASEdge instantiated objects. Then, using computer graphics methods, these AS-related objects can be sequentially expressed in the visualization engine, completing the expression of the AS situation.

[0123] (2) Model-based expression examples.

[0124] According to the designed expression model and scene data organization method, a cyberspace mapping expression example was completed based on the Cesium open source geographic information platform. In the expression example of the present invention, effective expression of cyberspace resources, relationships and events is achieved, and the characteristics of cyberspace resources being cross-layer, element-related, event-heavy, and scale-variable are reflected. AS data with longitude and latitude coordinates can all be displayed on the two- and three-dimensional digital earth provided by Cesium, totaling 60,012 AS points, and the image data uses data from MapWorld. Each point represents an AS object, and the connection relationship between ASs is complex. If all connection relationships are displayed at the same time, the entire map will be very chaotic. It is possible to display only all AS objects themselves without displaying their respective connection relationships.

[0125] ①Examples of cyberspace resource expression.

[0126] exist Figure 12 In the figure, the AS expression effect of the local view is shown. In the expression results, for different cyberspace resource objects, the most intuitive difference is the different expression symbols used. For cyberspace expression, the expression symbols are a basis. Only with a unified symbol system can the cyberspace map become a universal language. However, this part is not the content to be studied in this invention. Therefore, this invention uses simple letter symbols for representation.

[0127] ②Examples of expressing cyberspace relationships.

[0128] The present invention completes the visualization expression of the AS relationship in the cyberspace, such as Figure 13 As shown in the figure, there are 57 ASs directly associated with AS 1126. The AS connection diagram can be divided into the physical layer and geographical related AS connection diagram, and the logical layer AS connection diagram. The logical layer AS connection diagram is shown in Figure 13 As shown in the figure, the AS connection relationship diagram related to the physical layer and geography and the AS connection relationship diagram related to the logical layer, these two different views use a set of data and a unified expression model. The difference is that when drawing and expressing, the edges and nodes in the model present different geometric shapes according to the variable of the network space expression layer (physical or logical layer). That is, through the expression model of the present invention, different data can be described in a regularized manner, and different expression requirements can be met, thereby realizing the logical unification of the expression data.

[0129] ③Examples of expressing cyberspace events.

[0130] The present invention can simulate the representation of network attack events. For example, if the attack event is from AS 37680 to AS 37054, the representation of this event is actually an attack behavior occurring at AS 37680 at time T1. This attack behavior can be represented by an arrow, starting with the AS 37680_37054 edge and continuing along the AS 37054 edge to AS 37054 at time T2. The corresponding representation model records the attack behavior occurring at time T1 in the AS 37680 object scenario file and the attacked behavior occurring at time T2 in the AS 37054 object scenario file. The AS 37680_37054 edge scenario file records the attack behavior passing through the edge from time T1 to time T2. This ensures the consistency of the entire scenario file. Even in real-time situation display, when an attack behavior occurs, the corresponding attacking or attacked behavior can be associated with the corresponding object in real time. If only the attack behavior is perceived but the source cannot be traced, association can be performed only to the attacked AS. In addition, to dynamically display the entire attack process, the virtual observer object of the present invention can be combined to achieve backtracking and deduction of the entire process based on the edited script.

[0131] ④Examples of multi-scale expression in cyberspace.

[0132] Figure 14 、 Figure 15 This is the result of AS multi-scale expression in cyberspace at different viewpoint distances. The core of multi-scale expression is the automatic integration of expression elements. The essence of automatic integration is the selection and rejection of expression elements themselves and the change of geometric shapes through different integration operators. For the expression model designed by this invention, the geometric shape of the model changes with changes in viewpoint distance. The difference between the display of different elements lies in the different automatic integration rules, while the expression model itself does not need to change. This allows for multi-scale expression of different cyberspace resource expression elements using different integration operators, while maintaining compatibility without any changes to the expression model itself. Figure 13 In the example, when viewpoint 1 is closer, the symbol of the corresponding AS needs to be fully displayed, here it is AS 38008. When it is at a farther viewpoint 2, the geometric shape of these AS becomes a simple point. In the corresponding expression model file, only the change rules of symbol display are recorded, that is, what kind of symbol is displayed when the viewpoint is in what range.

[0133] For other data, such as the expression of IP and its topological relationships, routes and the relationships between different types of IP objects, the same method can be used. The difference is that when expressing, the corresponding expression symbols, multi-scale expression rules, attribute information, etc. change, but the expression model itself does not need to change.

[0134] (3) Experimental analysis.

[0135] As can be seen from the preceding AS expression examples, the expression model designed by this invention can effectively mask differences in cyberspace data types and database storage formats from different sources when performing cyberspace mapping visualization. When expressing cyberspace mapping, data can be extracted from various data files or databases and reorganized according to the expression model of this invention. Using XML files as a carrier, integrated scene data is generated and visualized. This model can effectively represent cyberspace resources, relationships, and events, and can achieve cross-layer expression using a single set of data and a single expression model. It can also effectively meet the requirements for expressing multiple cyberspace events at multiple scales.

[0136] This paper primarily addresses the "how to map" of the four questions in cyberspace mapping: "What to map? How to map? How to use?" The focus is on the "how to map" aspect of cyberspace mapping, specifically the cyberspace mapping representation model. Based on an analysis of three categories of representation objects—cyberspace resources, relationships, and events—and taking into account the key characteristics of cyberspace representation, this paper designs a cyberspace mapping representation model based on graph theory and spatiotemporal objects, adhering to the principles of graph theory, incorporating a multi-granularity spatiotemporal object model, and enhancing temporal attributes. This model provides a unified data organization format that facilitates the convenient and efficient representation of cyberspace mapping data. Finally, a cyberspace situation representation experiment was conducted using the global AS situation as an example. The experimental results demonstrate that the model effectively encompasses representation objects such as cyberspace resources, relationships, and events, comprehensively reflecting the cross-layer nature of cyberspace resources, elemental interconnections, frequent events, and variable scales, effectively organizing and representing complex cyberspace information. Furthermore, the model's design is based on graph theory, and related theoretical findings can be further applied to support relevant analytical applications in cyberspace.< / edgebaseclass> < / objectbaseclass>

Claims

1. A network space mapping expression method based on graph theory-space-time objects, characterized by: The following steps are involved: 1) Obtain cyberspace mapping data; 2) using a cyberspace mapping expression model to organize the cyberspace mapping data into data for expression; The cyberspace mapping expression model is formally described as: M=<O(t), E(t)> Wherein, M is the cyberspace mapping expression model, O(t) is the node set representing cyberspace resources in the cyberspace mapping expression model, t represents time, and E(t) is the edge set representing cyberspace relationships in the cyberspace mapping expression model; The node set O(t) is formally described as: O(t)={o1(t),o2(t),...,o n (t)} Among them, t represents time, o i (t) is the i-th node in O(t), o i (t) represents a network space resource object, a network space resource object o i (t) includes attribute features p(t), spatiotemporal features sp(t, s, l) and behavioral features a(t), o i (t) is formally described as: o i (t)=[p(t),sp(t,s,l),a(t),…],t∈[t b ,t e ],i=1,2,…,n Among them, [t b , t e ] represents the network space resource object o i (t), l represents the cyberspace level, s represents the scale or the viewpoint distance in the visualization engine, the attribute feature p(t) represents the attribute information of the cyberspace resource object, the spatiotemporal feature sp(t, s, l) represents the spatial information of the cyberspace resource object, and the behavioral feature a(t) represents the behavior of the cyberspace resource object; The formal description of the edge set E(t) is: E(t)={e1(t),e2(t),...,e n (t)} Among them, e i (t) is the i-th edge in E(t), e i (t) represents the network space relationship between two nodes, including: node pair <o u (t), o v (t)>, spatiotemporal features sp′(t, s, l), attribute features p′(t) and state features s(t), e i (t) is formally described as: e i (t)=[<o u (t),o v (t)>,sp′(t,s,l),p′(t),s(t),…],t∈[t′ b ,t′ e ],i=1,2,…,n Among them, u (t), o v (t) represents edge e i (t) corresponds to two nodes, the spatiotemporal feature sp′(t, s, l) represents the position when the edge is drawn, l represents the network space level, [t′ b , t′ e ] represents edge e i (t), the state feature s(t) represents the state information corresponding to the edge, and p′(t) represents the attribute information associated with the edge; 3) Visualize the organized cyberspace mapping data at the selected cyberspace level to obtain a cyberspace map.

2. The network space surveying and mapping expression method based on graph theory-space-time objects according to claim 1 is characterized by: Node o i (t) also includes the geometric features g(t, s, l), including the geometric features g(t, s, l) after o i (t) is formally described as: o i (t)=[p(t),sp(t,s,l),g(t,s,l),a(t),…] Wherein, the geometric feature g(t, s, l) represents the cyberspace map symbol used in the expression; Edge i (t) also includes the geometric feature g(t, s, l), including the edge e after the geometric feature g′(t, s, l) i (t) is formally described as: e i (t)=[<o u (t),o v (t)>,sp′(t,s,l),g′(t,s,l),p′(t),s(t),…] Among them, the geometric feature g′(t, s, l) represents the shape of the edge when it is expressed.

3. The network space surveying and expression method based on graph theory-space-time objects according to claim 1 or 2, characterized in that: The cyberspace layers include a physical layer, a logical layer, and a cognitive layer.

4. The network space surveying and expression method based on graph theory-space-time objects according to claim 1 or 2, characterized in that: When the network space resource object is a server, the attribute characteristics of the server include the server type, capacity size and bandwidth size; the spatiotemporal characteristics of the server include the geographical location where the network space resource object is deployed; and the behavioral characteristics of the server include the specific services and protection behaviors provided by the network space resource object.

5. The network space surveying and expression method based on graph theory-space-time objects according to claim 1 is characterized by: Before organizing the cyberspace mapping data in step 2), the cyberspace mapping data needs to be cleaned to obtain credible cyberspace mapping data.

6. The network space surveying and expression method based on graph theory-space-time objects according to claim 1 or 5, characterized in that: Step 3) Before visualizing the organized cyberspace mapping data at the selected cyberspace level, spatiotemporal benchmark assimilation is required to perform spatiotemporal conversion on various types of cyberspace mapping data, including cyberspace resources, cyberspace relationships, and cyberspace events, to transform them into a unified time and space benchmark.

7. The network space surveying and mapping expression method based on graph theory-space-time objects according to claim 2 is characterized by: Step 3) When visually expressing the organized cyberspace mapping data, a virtual observer object is set up, and the virtual observer object is used to dynamically manage the content displayed during the visual expression.

8. The network space surveying and expression method based on graph theory-space-time objects according to claim 7 is characterized by: The form of the virtual observer object is described as: S″(t)=[p″(t),sp″(t),g″(t,s,l)…] Among them, S″(t) is the virtual observer object, p″(t) refers to the expression parameters that need to be set when expressing in cyberspace, sp″(t) refers to the spatiotemporal position of the virtual observer that determines the result of cyberspace expression, g″(t, s, l) refers to the display viewport and posture of the virtual observer, l is the cyberspace level to which the expression belongs, and s represents the scale or the viewpoint distance in the visualization engine.

Images