CWE partitioning method, equipment, and storage media based on community detection algorithm

Abstract

This invention relates to the field of computer network security technology, specifically to a CWE (Cost Evidence-Based Weapon) segmentation method, device, and storage medium based on a community discovery algorithm, aiming to improve the benefits of vulnerability classification for vulnerability intelligence analysis. The proposed CWE segmentation method based on a community discovery algorithm includes: constructing a knowledge graph based on the relationships between different CWEs; assigning each CWE in the knowledge graph to a separate community; and using a modularity-based community discovery algorithm to progressively merge communities until the modularity no longer increases, resulting in the final segmented CWE communities. Furthermore, this invention proposes, from an attack benefit perspective, constructing a joint CAPEC and CWE knowledge graph, and using a community discovery algorithm to segment CWEs into communities, significantly improving the benefits of vulnerability classification for vulnerability intelligence analysis.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to a CWE partitioning method, device, and storage medium based on a community discovery algorithm. Background Technology

[0002] CWE (Common Weakness Enumeration) is a standard for describing software and hardware vulnerabilities. How to classify vulnerabilities has always been a challenging problem in the industry. Classification that is too granular leads to poor readability; classification that is too coarse results in decreased accuracy and recall of the analysis results.

[0003] Currently, most industry solutions for vulnerability classification are based on the CWE standard, using manual screening to select some typical CWEs as their classification criteria. Figure 1 This is a schematic diagram illustrating the selection of a typical CWE as a classification standard in existing technologies. For example... Figure 1 As shown, the CNNVD (China National Vulnerability Database) standard selects 26 CWE (Critical Web Impact Factors) as vulnerability classification categories and divides them into five levels in a "tree" format. The official CWE also publishes an annual CWE Top 25 classification, representing the most common and impactful CWE vulnerabilities of the past two years. These vulnerabilities are usually easy to discover and exploit. The CWE Top 25 classification can effectively help developers, security research institutes, testers, and others gain a deeper understanding of the most serious security vulnerabilities currently existing. The CWE Most Important Hardware Weaknesses classification standard includes a list of 12 of the most important hardware weaknesses currently identified in the CWE, which is of great reference value to hardware designers, educators, and others. There are many other classification methods based on the CWE standard, which will not be listed here again.

[0004] While existing classification methods significantly improve the readability of the CWE standard, they sacrifice the benefits that vulnerability classification brings to vulnerability intelligence analysis. For example, when analyzing the historical causes of vulnerabilities in a component, using the CWE classification method allows for a clear and accurate view of the component's vulnerability distribution map, enabling research projects such as "unknown vulnerability prediction" and "vulnerability cause trend development." However, using existing classification methods cannot construct a clear vulnerability distribution map, mainly because the vulnerability classification is too coarse, resulting in excessive data density that hinders effective identification and judgment. Summary of the Invention

[0005] To address the aforementioned problems in the prior art, this invention proposes a CWE partitioning method, device, and storage medium based on a community discovery algorithm, which improves the benefits of vulnerability vulnerability classification for vulnerability intelligence analysis.

[0006] In a first aspect, the present invention proposes a CWE partitioning method based on a community detection algorithm, the method comprising:

[0007] Construct a knowledge graph based on the relationships between different CWEs;

[0008] Each CWE in the knowledge graph is assigned to a separate community;

[0009] A community discovery algorithm based on modularity is used to gradually merge communities until the modularity no longer increases, resulting in the final divided CWE communities.

[0010] Preferably, the step of constructing a knowledge graph based on the relationships between different CWEs includes:

[0011] Construct a knowledge graph based on the relationships between each CWE and other CWEs as described by the Related_Weaknesses field in each CWE description file;

[0012] Set the weight of the relationship between the two interconnected CWEs to 1;

[0013] in,

[0014] The entities in the knowledge graph include: CWE;

[0015] The entity relationships in the knowledge graph include: hierarchical relationships.

[0016] Preferably, the entity relationships in the knowledge graph also include: need, belonging to, preceding, approximating, and originating from.

[0017] Preferably, the step of constructing a knowledge graph based on the relationships between different CWEs includes:

[0018] A knowledge graph is constructed based on the relationship between the CWE and other CWEs described by the Related_Weaknesses field in each CWE description file, and the correspondence between the attack benefits described by the Consequence field in the CAPEC description file and the CWE number.

[0019] The attack revenue generated by each CWE is statistically analyzed, and the average attack revenue of each CWE is calculated.

[0020] The relationship weight between two interconnected CWEs is set to the absolute value of the difference in the average attack gain of the two CWEs;

[0021] in,

[0022] The entities in the knowledge graph include: CWE and CAPEC;

[0023] The entity relationships in the knowledge graph include: the relationships between each CWE and the other CWEs, and the relationships between each CWE and CAPEC;

[0024] The relationships between CWEs in the knowledge graph include: superior-subordinate, need, belonging to the same category, preceding, approximating, and originating from.

[0025] Preferably, the attributes of CWE in the knowledge graph include: name and English description of CWE;

[0026] The attributes of CAPEC in the knowledge graph include: name and attack benefits;

[0027] The attributes of the relationship between the CWEs include: attack payoff difference;

[0028] The relationship between CWE and CAPEC in the knowledge graph includes: usage relationship;

[0029] The attribute relating CWE to CAPEC includes: the name of the CAPEC that uses the CWE.

[0030] Preferably, the step of merging communities using a modularity-based community detection algorithm until the modularity no longer increases, resulting in the final divided CWE communities, includes:

[0031] For each community in the knowledge graph, try to merge the community into each of the adjacent communities in turn, and calculate the change in modularity before and after the merger. Take the largest change. If the largest change is greater than zero, merge the community into the adjacent community corresponding to the largest change. Otherwise, the community and the adjacent community remain unchanged.

[0032] Update the number of communities and repeat the community merging operation until the modularity no longer increases, resulting in the final divided CWE communities.

[0033] Preferably, each CWE in the knowledge graph is considered as a node, and the connection between two interconnected CWEs is considered as an edge. The modularity is calculated according to the following formula:

[0034]

[0035] Where M represents the number of communities in the knowledge graph, c represents the community number, and e represents the community index. c a represents the ratio of the sum of the weights of all edges within community c to the sum of the weights of all edges in the knowledge graph. c This represents the ratio of the sum of the weights of all edges connecting community c to external nodes to the sum of the weights of all edges in the knowledge graph.

[0036] Preferably, the step of statistically analyzing the attack gains from each CWE and calculating the average attack gains for each CWE includes:

[0037] For each CWE, the total attack revenue brought by the CWE is obtained by counting the number of attack revenues described by all CAPECs using the CWE. The total attack revenue is then divided by the number of all CAPECs using the CWE to obtain the average attack revenue of the CWE.

[0038] In a second aspect, the present invention provides a processing apparatus including a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed as described above.

[0039] In a third aspect, the present invention provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described above.

[0040] Compared with the closest prior art, the present invention has the following beneficial effects:

[0041] This invention constructs a knowledge graph based on the relationships between CWEs and uses a community detection algorithm to partition the CWEs, overcoming the problem in existing technologies where excessively coarse partitioning leads to excessive data density, hindering effective identification and judgment. Furthermore, this invention proposes constructing a joint CAPEC and CWE knowledge graph, calculating the average attack gain for each CWE, and setting the relationship weight between two interconnected CWEs as the absolute value of the difference in their average attack gains. This optimizes the edge weights in the graph. Based on these weights, the community detection algorithm is then used to partition the CWEs into communities, significantly improving the benefits of vulnerability classification for vulnerability intelligence analysis. Attached Figure Description

[0042] Figure 1 This is a schematic diagram illustrating the selection of a typical CWE as a classification standard in existing technologies;

[0043] Figure 2 This is a schematic diagram of the main steps of Embodiment 1 of the CWE partitioning method based on the community detection algorithm of the present invention;

[0044] Figure 3 These are schematic diagrams illustrating the main steps of Embodiments 2 and 3 of the CWE partitioning method based on the community detection algorithm of the present invention;

[0045] Figure 4(a) is a schematic diagram of the knowledge graph without community merging in Embodiments 2 and 3 of the present invention;

[0046] Figure 4(b) is a schematic diagram of the community division obtained after the initial community merging in embodiments of the present invention (two and three).

[0047] Figure 4(c) is a schematic diagram of the final community division obtained after further community merging in Embodiments 2 and 3 of the present invention;

[0048] Figure 5 This is a schematic diagram of the main steps of Embodiment 4 of the CWE partitioning method based on the community detection algorithm of the present invention;

[0049] Figure 6 This is a schematic diagram of the CWE and CAPEC joint knowledge graph constructed in Embodiment 4 of the present invention. Detailed Implementation

[0050] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0052] It should be noted that in the description of this invention, the terms "first" and "second" are used merely for ease of description and do not indicate or imply the relative importance of the described devices, elements, or parameters, and therefore should not be construed as limiting the invention. Furthermore, the term "and / or" in this invention merely describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0053] This invention attempts to construct the CWE and its internal relationships using a knowledge graph from the perspective of attack benefits, and to divide the CWE into communities based on this graph.

[0054] Figure 2 This is a schematic diagram illustrating the main steps of an embodiment of the CWE partitioning method based on the community detection algorithm of the present invention. Figure 2 As shown, the method in this embodiment includes steps A10-A30:

[0055] Step A10: Construct a knowledge graph based on the relationships between different CWEs.

[0056] Step A20: Each CWE in the knowledge graph is assigned to a separate community.

[0057] Step A30: The community is gradually merged using a community discovery algorithm based on modularity until the modularity no longer increases, resulting in the final divided CWE community.

[0058] Figure 3 This is a schematic diagram illustrating the main steps of Embodiment 2 of the CWE partitioning method based on the community detection algorithm of the present invention. Figure 3 As shown, the method in this embodiment includes steps B10-B40:

[0059] Step B10: Construct a knowledge graph based on the relationships between the CWE and other CWEs as described by the Related_Weaknesses field in each CWE description file.

[0060] The entities in the knowledge graph include CWE; the entity relationships in the knowledge graph include: superior and subordinate.

[0061] In the "Research Concepts" view, the description file for a CWE is in XML format. The "Related_Weaknesses" field describes the relationship between this CWE and other CWEs, as shown in the example below:

[0062]

[0063] As can be seen from the above field descriptions, CWE-1007 is a subclass of CWE-451, meaning there is a hierarchy (ChildOf) between the two.

[0064] In the CWE standard's hierarchy (ChildOf) relationships, the relationship between a superior and subordinate can be considered a strong relationship. However, most subordinates belonging to the same superior have no relationship with each other. As shown in Table 1, the CWE standard's hierarchy relationships have the largest proportion of relationships.

[0065] Table 1. Relationships and Quantities between CWE Entities

[0066] Relationship between CWE quantity ChildOf 1121 Requires 12 PeerOf 96 CanPrecede 134 CanAlsoBe 27 StartsWith 3

[0067] In the study of vulnerability concepts, if we want to classify CWEs, we must ensure that CWEs classified into the same category have similar vulnerability types and connectivity in a certain scenario (such as attack, source tracing, alarm classification, etc.). Only in this way can we ensure that they have application significance in subsequent research.

[0068] Step B20: Set the relationship weight between the two interconnected CWEs to 1.

[0069] Step B30 involves assigning each CWE in the knowledge graph to a separate community.

[0070] Assuming there are N CWE entities in the current knowledge graph, the initial value of the number of communities M is N. For example, Figure 4(a) is a schematic diagram of the constructed knowledge graph in this embodiment. As shown in Figure 4(a), the knowledge graph contains 16 CWE entities. Small circles represent CWE entities, and the lines connecting two circles represent the relationships between entities. Each CWE is assigned to a separate community, with community numbers set from 0 to 15.

[0071] Step B40 involves using a modularity-based community detection algorithm to progressively merge communities until the modularity no longer increases, resulting in the final divided CWE communities. This step can specifically include steps B41-B42:

[0072] Step B41: For each community in the knowledge graph, try to merge the community into each of the adjacent communities in turn, and calculate the change in modularity before and after the merger. Take the largest change. If the largest change is greater than zero, merge the community into the adjacent community corresponding to the largest change. Otherwise, the community and the adjacent communities remain unchanged.

[0073] Specifically, this step may include steps B411-B413:

[0074] Step B411, set m = 0, where m is the community index in the knowledge graph;

[0075] Step B412: Try merging community m into each of the adjacent communities connected to it in turn, and calculate the change in modularity before and after the merger. Take the largest change. If the largest change is greater than zero, merge community m into the adjacent community corresponding to the largest change. Otherwise, community m and the adjacent communities remain unchanged.

[0076] For example, community m has three neighboring communities: community b1, community b2, and community b3. First, try merging community m into community b1 and calculate the change in modularity before and after the merge. (Subtract the modularity before merging from the modularity after merging); then try merging community m into community b2, and calculate the change in modularity before and after merging. Then, we tried merging community m into community b3 and calculated the change in modularity before and after the merger. If there is Then take the largest change among them. judge Is it greater than zero? If so, merge community m into the adjacent community b2; otherwise, communities m, b1, b2, and b3 remain unchanged.

[0077] Step B413, m = m + 1; if m < M, return to step B412, otherwise proceed to the next step.

[0078] For example, after the initial merging in steps B411 - B413 for the 16 communities in Figure 4(a), they are divided into 4 communities circled by a dashed ellipse as shown in Figure 4(b).

[0079] Step B42, update the number of communities M (the community numbers are updated together), and then return to step B41 to continue the community merging operation until the modularity no longer increases, obtaining the finally partitioned CWE communities.

[0080] For the 4 communities in Figure 4(b) above, after further merging, the modularity no longer increases, and finally 2 CWE communities are obtained, which are the 2 communities circled by a dashed ellipse as shown in Figure 4(c). In practical applications, the number of CWEs is large. Therefore, step B41 needs to be repeatedly executed until the modularity no longer increases.

[0081] In this embodiment, each CWE in the knowledge graph is regarded as a node, and the connection between two interconnected CWEs is regarded as an edge. The modularity Q is calculated according to the following formula (1):

[0082]

[0083] where M represents the number of communities in the knowledge graph, c represents the community number, and e c represents the ratio of the sum of the weights of the edges between the nodes within community c to the sum of the weights of all the edges in the knowledge graph, and a c represents the ratio of the sum of the weights of the edges connecting community c to the external nodes to the sum of the weights of all the edges in the knowledge graph.

[0084] It can be seen from formula (1) that to obtain the maximum modularity, it is necessary to merge communities to increase e c as much as possible and reduce That is, to make the connections between the nodes within the community as many as possible and the connections between the nodes and the nodes in other external communities as few as possible.

[0085] The present invention also provides Embodiment 3 of the CWE partitioning method based on the community discovery algorithm. The main steps of this embodiment are exactly the same as those of Embodiment 2 above. Therefore, reference can still be made to Figure 3The main steps are illustrated in the diagram. The only difference is that in the knowledge graph constructed in step B10 of this embodiment, the entity relationships include not only the hierarchical relationship (ChildOf), but also: Requires, PeerOf, CanPrecede, CanAlsoBe, and StartsWith, in order to comprehensively consider various relationships between CWE entities.

[0086] In Embodiments 2 and 3 above, for ease of calculation, the relationship weights between each CWE are all set to 1. However, in fields such as vulnerability research and network security intelligence analysis, the similarity of vulnerabilities in attributes closely related to real-world scenarios, such as "exploitation methods" and "attack benefits," is of greater concern. Attack benefits refer to the specific impact that a successful vulnerability exploit will cause, such as stealing usernames and passwords, remotely executing operating system commands, extracting privileges, reading data, modifying data, and access control. Therefore, in Embodiment 4 below, this invention constructs a joint knowledge graph of CWE and CAPEC, and sets the relationship weight between two interconnected CWEs to the absolute value of the difference in the average attack benefits of the two CWEs (because the community detection algorithm corresponds to an undirected graph). In this way, the weights of the edges in the graph become meaningful, representing the differences in the attack benefits of the two CWEs. Based on this weight, the community detection algorithm is then used to divide the CWEs into communities.

[0087] Figure 5 This is a schematic diagram illustrating the main steps of Embodiment 4 of the CWE partitioning method based on the community detection algorithm of the present invention. Figure 5 As shown, the method in this embodiment includes steps C10-C50:

[0088] Step C10: Construct a knowledge graph based on the relationship between the CWE and other CWEs described by the Related_Weaknesses field in each CWE description file, and the correspondence between the attack benefits and CWE numbers described by the Consequence field in the CAPEC description file.

[0089] CAPEC is a standard classification dataset for vulnerability attack types and rewards. In the CAPEC standard, the "Consequence" field represents the attack reward, and it is still an XML file. For example, for CAPEC with ID 101, there are multiple attack rewards (corresponding to multiple Consequence tags), one of which is Read Data, with corresponding CWE numbers 20, 74, and 97, as described below:

[0090]

[0091] In this example, the entities in the knowledge graph include CWE and CAPEC; the entity relationships in the knowledge graph include the relationships between each CWE and other CWEs, and the relationship between each CWE and CAPEC; the relationships between CWEs in the knowledge graph include: ChildOf (hierarchical relationship), Requires, PeerOf (same as), CanPrecede (before), CanAlsoBe (approximately), and StartsWith (starts with); the attributes of CWEs in the knowledge graph include: name and English description of the CWE; the attributes of CAPECs in the knowledge graph include: name and attack benefit; the attributes of the relationships between CWEs include: attack benefit difference; the relationships between CWEs and CAPECs in the knowledge graph include: UsedBy (use relationship); the attributes of the relationships between CWEs and CAPECs include: the name of the CAPEC that uses the CWE.

[0092] In this embodiment, the entities and relations in the knowledge graph, along with their corresponding attributes, are shown in Table 2 below:

[0093] Table 2. Entity, Relationship, and Attribute Correspondence Table in CWE and CAPEC Knowledge Graphs

[0094]

[0095] The constructed joint knowledge graph of CWE and CAPEC is as follows: Figure 6 As shown, the large circle represents the CAPEC entity, the small circle represents the CWE entity, and the line connecting the two circles represents the relationship between the entities.

[0096] Step C20: Calculate the attack revenue generated by each CWE and the average attack revenue of each CWE.

[0097] Specifically, for each CWE, the following operations are performed: count the number of attack gains described by all CAPECs using the CWE to obtain the total attack gains brought by the CWE, and divide the total attack gains by the number of all CAPECs using the CWE to obtain the average attack gains of the CWE.

[0098] For example, if a CWE is used by 3 CAPECs, and the attack gains described in the description files of these 3 CAPECs are 4, 5 and 3 respectively, then the total attack gains brought by this CWE are 4+5+3=12, and the average attack gain of this CWE is 12 / 3=4.

[0099] Step C30: Set the relationship weight between the two interconnected CWEs to the absolute value of the difference in the average attack gain between the two CWEs.

[0100] For example, if one CWE has an average attack gain of 4 and the other has an average attack gain of 6, then the relationship weight between these two interconnected CWEs is set to 2.

[0101] Step C40: Each CWE in the knowledge graph is assigned to a separate community.

[0102] Step C50 involves using a modularity-based community detection algorithm to progressively merge communities until the modularity no longer increases, resulting in the final divided CWE communities. The specific division method is the same as step B40 in Example 2, and will not be repeated here.

[0103] Although the steps in the above embodiments are described in the above order, those skilled in the art will understand that in order to achieve the effect of this embodiment, different steps do not need to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple variations are all within the protection scope of this invention.

[0104] To verify the CWE community segmentation method proposed in this invention, the inventors also conducted tests. The general steps are as follows: collecting a dataset; constructing a knowledge graph; using the constructed knowledge graph, performing community segmentation of CWE using a modularity-based discovery algorithm; and evaluating the constructed communities using the dataset.

[0105] Numerous vulnerability analysis articles are published in online communities and forums, containing information such as exploitation methods and attack profits. We screened over 9000 relevant articles and statistically analyzed the vulnerability types mentioned in each article. Then, using the attack profits described in the CAPEC standard as the base sample, we performed entity identification on the attack profit data contained in the articles. By combining the existing relationships between CWEs and CAPEC with the attack profits corresponding to the CWEs identified in the articles, we extracted features (density, distribution, distance parameters, etc.) from the directed graph of attack profits for all CWEs and performed clustering. This allows us to categorize the collected articles from the perspective of "attack profit" similarity. From the perspective of attack profit, CWEs corresponding to the same article should belong to the same community, and this serves as the basis for obtaining the test set.

[0106] A dataset was constructed using the CWE and CAPEC standards, and the CWE community was partitioned using the community partitioning algorithm. This yielded a community partitioning practice with a modularity greater than 0.7 (generally, a modularity between 0.3 and 0.7 indicates a stable community, and the larger the modularity, the more stable the community).

[0107] Evaluation of the segmented communities: (1) To ensure that vulnerabilities in the same community have a high degree of conceptual similarity, only the "ChildOf" relationship was used as the connecting edge. However, it was found that there were isolated nodes, and the recall and precision were not high. (2) Using all relationships between CWEs as connecting edges, it was found that the precision improved, but the recall did not improve significantly. (3) Using the community segmentation algorithm, the edges in the constructed knowledge graph based on attack benefits were assigned certain weights, and CWEs were segmented into communities. Finally, a CWE segmentation model that divided all CWEs into 19 categories was obtained. The segmented communities performed well in all tests as shown in Table 3 below:

[0108] Table 3 Comparison of results from different partitioning methods

[0109]

[0110] Furthermore, based on the CWE community partitioning method described above, this invention also provides an embodiment of a processing device. The processing device in this embodiment includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed as described above.

[0111] Furthermore, the present invention also provides an embodiment of a computer-readable storage medium. The storage medium of this embodiment stores a computer program that can be loaded by a processor and executed as described above.

[0112] The computer-readable storage medium includes, for example, various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] Those skilled in the art will recognize that the method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of electronic hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the invention.

[0114] The technical solution of the present invention has now been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions resulting from these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A community discovery algorithm based CWE partitioning method, characterized in that, The method comprises: constructing a knowledge graph according to relationships between different CWEs; dividing each CWE in the knowledge graph into a community; merging the communities step by step by using a community discovery algorithm based on modularity until the modularity no longer increases, to obtain finally divided CWE communities; the constructing of the knowledge graph according to relationships between different CWEs comprises: constructing the knowledge graph according to relationships between the CWE and other CWEs described in a Related_Weaknesses field in each CWE description file, and a corresponding relationship between attack benefits and CWE numbers described in a Consequence field in a CAPEC description file; statistically counting attack benefits brought by each CWE, and calculating average attack benefits of each CWE; setting a relationship weight between two interconnected CWEs as an absolute value of a difference between average attack benefits of the two CWEs; wherein, entities in the knowledge graph comprise: CWEs and CAPECs; entity relationships in the knowledge graph comprise: relationships between each CWE and the other CWEs, and relationships between each CWE and CAPECs; relationships between the CWEs in the knowledge graph comprise: superior-inferior, need, same, prior, similar and initial.

2. The CWE division method based on the community discovery algorithm according to claim 1, wherein, attributes of the CWEs in the knowledge graph comprise: names and English descriptions of the CWEs; attributes of the CAPECs in the knowledge graph comprise: names and attack benefits; an attribute of the relationships between the CWEs comprises: a difference in attack benefits; a relationship between the CWEs and the CAPECs in the knowledge graph comprises: a usage relationship; an attribute of the relationship between the CWEs and the CAPECs comprises: a name of the CAPEC using the CWE.

3. The community discovery algorithm based CWE partitioning method of claim 1, wherein, the merging of the communities step by step by using the community discovery algorithm based on the modularity until the modularity no longer increases, to obtain finally divided CWE communities, comprises: for each community in the knowledge graph, trying to merge the community into each adjacent community in turn, and calculating a change in modularity before and after the merging, taking a maximum change, if the maximum change is greater than zero, merging the community into the adjacent community corresponding to the maximum change, otherwise, the community and the adjacent community remain unchanged; updating the number of communities, and repeating the community merging operation until the modularity no longer increases, to obtain finally divided CWE communities.

4. The community discovery algorithm based CWE partitioning method of claim 3, wherein, the modularity is calculated according to the following formula: wherein, the knowledge graph is represented as a graph G=(V, E), V is a set of nodes, and E is a set of edges; n is a number of nodes in the graph, and m is a number of edges in the graph; d is a degree of a node, and d i is a degree of node i; c is a community, and c i is a community i; |c| is a number of nodes in the community; |E| is a number of edges in the graph; |E c| is a number of edges in the community; |E| c| is a number of edges in the community; and |E| |E| c| is a number of edges between the community and the adjacent community. ； wherein, denotes the number of communities in the knowledge graph, c denotes the index of a community, denotes the ratio of the sum of the weights of the edges within the community c to the sum of the weights of all edges in the knowledge graph, denotes the ratio of the sum of the weights of the edges connecting the community c to the outside nodes to the sum of the weights of all edges in the knowledge graph.

5. The community discovery algorithm based CWE partitioning method of claim 1, wherein, the statistical counting of attack benefits brought by each CWE, and the calculation of average attack benefits of each CWE, comprises: for each CWE, counting a number of attack benefits described by all CAPECs using the CWE to obtain a total number of attack benefits brought by the CWE, and dividing the total number of attack benefits by a number of all CAPECs using the CWE to obtain the average attack benefits of the CWE.

6. A processing device, characterized by A computer program product comprising a memory and a processor, said memory having stored thereon a computer program loadable and executable by said processor to perform the method of any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, A computer program product comprising a memory and a processor, said memory having stored thereon a computer program loadable and executable by said processor to perform the method of any one of claims 1-5.

Images