A knowledge graph construction method and device, an electronic device, and a storage medium

Abstract

Embodiments of the present application provide a knowledge graph construction method and device, electronic equipment and storage medium, the method comprising: determining change information of a target system based on transmission data of the target system and preset deployment information; wherein the preset deployment information comprises preset resource information and preset vulnerability file information; determining a knowledge graph of an entity in the target system based on the change information and a preset correspondence relationship of the target system; wherein the preset correspondence relationship comprises an initial correspondence relationship between entities in the target system, and the entities in the target system comprise computing power layer entities, subsystem layer entities, software layer entities and component layer entities in the target system. By analyzing software supply chain behavior from a global perspective, the structured knowledge network is constructed by covering entities in the entire system; based on the transmission data, cloud network behavior monitoring of the system is realized, the knowledge graph is dynamically updated, and the cloud network ecology suitable for rapid iteration is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software supply chain, and particularly relates to a knowledge graph construction method and device, electronic equipment and a storage medium. BACKGROUND

[0002] Software is the cornerstone of the digital world and is applied in various computer systems. In order to improve the software development efficiency, some software development needs to refer to third-party components or modules. In the referring process, the attack behaviors on the software supply chain increase, and the attack behaviors are hidden. Therefore, it is necessary to construct and manage the software supply chain information.

[0003] In the related art, the corresponding relationship information between the software and the module is constructed offline, and then is deployed to a release system.

[0004] However, the above method is for a single software, and cannot perceive the changes of the software supply chain in real time, and is not suitable for the cloud network ecology with rapid iteration. SUMMARY

[0005] The present application provides a knowledge graph construction method and device, electronic equipment and a storage medium, to provide software supply chain information suitable for the cloud network ecology with rapid iteration.

[0006] In a first aspect, an embodiment of the present application provides a knowledge graph construction method, and the method comprises the following steps:

[0007] Based on the transmission data of the target system and the preset deployment information, the change information of the target system is determined; wherein the preset deployment information comprises preset resource information and preset vulnerability file information;

[0008] Based on the change information and the preset corresponding relationship of the target system, the knowledge graph of the entity in the target system is determined; wherein the preset corresponding relationship comprises the initial corresponding relationship between the entities in the target system, and the entities in the target system comprise the computing power layer entity, the subsystem layer entity, the software layer entity and the component layer entity in the target system.

[0009] The above scheme, since the transmission data of the target system represents the communication behavior of the entity in the target system, based on the transmission data and the preset deployment information, the change information of the entity in the target system can be dynamically determined; and then according to the change information and the initial corresponding relationship between the entities in the target system, the knowledge graph between the power layer entity-subsystem layer entity-software layer entity-component layer entity is accurately determined, that is, the deep software supply chain. By analyzing the software supply chain behavior from a global perspective, covering all entities in the system, a structured knowledge network is constructed, which is suitable for micro-service application scenarios with distributed architecture deployment; in addition, based on the transmission data, the cloud network behavior of the system is monitored, the entity and relationship characteristics of the software supply chain of the system are perceived in real time, and the knowledge graph is dynamically updated, which is suitable for the fast iteration of the cloud network ecology.

[0010] In some optional embodiments, based on the transmission data of the target system and the preset deployment information, the change information of the target system is determined, comprising:

[0011] If the transmission data is download data or upload data, the file information of the transmission data is matched with the preset vulnerability file information;

[0012] If the matching fails, the change information of the entity corresponding to the transmission data is determined.

[0013] The above scheme, by matching the file information of the transmission data with the preset vulnerability file information, if the matching fails, it means that the preset vulnerability file does not contain the transmission data, so the transmission data does not exist vulnerability, and the transmission data is allowed to pass, and the corresponding entity will change (such as version change), and the change information of the entity corresponding to the transmission data needs to be determined, so as to timely change the knowledge graph.

[0014] In some optional embodiments, further comprising:

[0015] If the matching is successful, the transmission data is intercepted, and the transmission data is notified through a preset notification mode.

[0016] The above scheme, if the file information of the transmission data matches the preset vulnerability file information successfully, it means that the preset vulnerability file contains the transmission data, so the transmission data has vulnerability, and there may be malicious intrusion. By intercepting the transmission data and notifying the transmission data through a preset notification mode, the occurrence of malicious intrusion is reduced, and relevant personnel can learn about the attack behavior in time.

[0017] In some optional embodiments, if the transmission data is download data, and the preset resource information does not contain the resource information corresponding to the download data, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, further comprising:

[0018] The download attribute of the target system is determined to allow non-trusted source file download.

[0019] The above scheme compares the preset resource information (related information of the trusted database) with the resource information corresponding to the download data. If the preset resource information does not contain the resource information corresponding to the download data, it indicates that the download data is a non-trusted source file, that is, a file downloaded from an untrusted database. The source of these files is not a trusted database, and the download attribute of the target system needs to be referred to. If the download attribute indicates that non-trusted source file download is allowed, it indicates that the target system allows to download files from an untrusted database, and the subsequent steps can also be executed, thereby meeting the needs of different scenarios.

[0020] In some optional embodiments, if the transmission data is upload data and the upload data is data transmitted within the target system, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, the method further includes:

[0021] The internal transmission attribute of the target system is determined to allow internal transmission.

[0022] The above scheme indicates that the upload data is transmitted within the target system, that is, the transfer operation of the upload data is performed between component hosts. The internal transmission attribute of the target system needs to be referred to. If the internal transmission attribute indicates that internal transmission is allowed, it indicates that the target system allows internal file transmission, and the subsequent steps can also be executed, thereby meeting the needs of different scenarios.

[0023] In some optional embodiments, the change information of the target system is determined based on the transmission data of the target system and the preset deployment information, including:

[0024] If the transmission data is access data, the current version information of the entity corresponding to the access data is compared with the version information carried by the access data.

[0025] Based on the comparison result, the version state of the entity corresponding to the access data is determined.

[0026] The above scheme compares the current version information of the entity corresponding to the access data with the version information carried by the access data, that is, the consistency of the two versions is determined. Based on the comparison result, the version state of the entity corresponding to the access data is accurately determined, thereby achieving the effect of rapid version convergence.

[0027] In some optional embodiments, the transmission data is obtained by a network probe deployed in the target system. In some optional embodiments, the transmission data is obtained by a network probe deployed in the target system.

[0028] In a second aspect, the embodiments of the present application provide a knowledge graph construction device, which comprises:

[0029] a change information determination module configured to determine change information of the target system based on the transmission data of the target system and preset deployment information, wherein the preset deployment information comprises preset resource information and preset vulnerability file information;

[0030] a knowledge graph determination module configured to determine a knowledge graph of an entity in the target system based on the change information and a preset correspondence relationship of the target system.

[0031] The preset correspondence relationship comprises an initial correspondence relationship between entities in the target system, and the entities in the target system comprise an algorithm layer entity, a subsystem layer entity, a software layer entity and a component layer entity in the target system.

[0032] In some optional embodiments, the change information determination module is specifically configured to:

[0033] If the transmission data is download data or upload data, the file information of the transmission data is matched with the preset vulnerability file information.

[0034] If the matching fails, the change information of the entity corresponding to the transmission data is determined.

[0035] In some optional embodiments, the change information determination module is further configured to:

[0036] If the matching succeeds, the transmission data is intercepted, and the transmission data is notified through a preset notification mode.

[0037] In some optional embodiments, if the transmission data is download data, and the preset resource information does not comprise resource information corresponding to the download data, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, the change information determination module is further configured to:

[0038] determine that a download attribute of the target system represents that a non-trusted source file download is allowed.

[0039] In some optional embodiments, if the transmission data is upload data, and the upload data is data transmitted within the target system, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, the change information determination module is further configured to:

[0040] determine that an internal transmission attribute of the target system represents that internal transmission is allowed.

[0041] In some optional embodiments, the change information determining module is specifically configured to:

[0042] If the transmission data is access data, the current version information of the entity corresponding to the access data is compared with the version information carried by the access data.

[0043] Based on the comparison result, the version state of the entity corresponding to the access data is determined.

[0044] In some optional embodiments, the transmission data is acquired by a network probe deployed in the target system.

[0045] In a third aspect, an electronic device is provided, which includes at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the knowledge graph construction method of any one of the first aspect.

[0046] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program executable by an electronic device, and when the program is run on the electronic device, the electronic device executes the knowledge graph construction method of any one of the first aspect.

[0047] In addition, the technical effects brought by any one of the implementation manners of the second aspect to the fourth aspect can refer to the technical effects brought by different implementation manners of the first aspect, which will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0049] Figure 1 The first knowledge graph construction method provided by the embodiments of the present application is shown in the schematic flow chart;

[0050] Figure 2 The data monitoring schematic diagram provided by the embodiments of the present application is shown in the schematic flow chart;

[0051] Figure 3 The entity schematic diagram of the target system provided by the embodiments of the present application is shown in the schematic flow chart;

[0052] Figure 4 The second knowledge graph construction method provided by the embodiments of the present application is shown in the schematic flow chart;

[0053] Figure 5 A third knowledge graph construction method provided by an embodiment of the present application is shown in the schematic flowchart.

[0054] Figure 6 A fourth knowledge graph construction method provided by an embodiment of the present application is shown in the schematic flowchart.

[0055] Figure 7 A structure schematic diagram of a knowledge graph construction device provided by an embodiment of the present application is shown in the schematic flowchart.

[0056] Figure 8 A schematic block diagram of an electronic device provided by an embodiment of the present application is shown in the schematic flowchart. DETAILED DESCRIPTION

[0057] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0058] In the description of the present application, unless otherwise explicitly specified and limited, the term "connection" should be understood broadly, for example, it can be direct connection or indirect connection through an intermediate medium, and it can be internal connection of two devices. For those of ordinary skill in the art, the specific meaning of the above-mentioned term in the present application can be understood according to the specific circumstances.

[0059] In order to improve the software development efficiency, some software development needs to refer to third-party components or modules. In the reference process, the attack behavior of software supply chain increases, and the attack behavior is hidden. The longer the software supply chain is, the more likely it is to be attacked. Therefore, it is necessary to construct and manage the software supply chain information.

[0060] In the related art, the corresponding relationship information between the software and the module is constructed offline, and then deployed to the release system. For example, the single machine version application is analyzed by static code scanning or sandbox exercise, and the software supply chain information is obtained.

[0061] However, the above-mentioned method is for a single software, and cannot complete the deep supply chain analysis; in addition, the above-mentioned method cannot realize real-time perception of the change of the software supply chain, and is not suitable for the cloud network ecology of rapid iteration.

[0062] Based on this, the embodiment of the application provides a knowledge graph construction method and device, an electronic device and a storage medium. The method comprises the following steps: determining change information of a target system based on transmission data of the target system and preset deployment information; wherein the preset deployment information comprises preset resource information and preset vulnerability file information; determining a knowledge graph of an entity in the target system based on the change information and a preset correspondence relationship of the target system; wherein the preset correspondence relationship comprises an initial correspondence relationship between entities in the target system, and the entities in the target system comprise an algorithm layer entity, a subsystem layer entity, a software layer entity and a component layer entity in the target system.

[0063] The above scheme, since the transmission data of the target system represents the communication behavior of the entities in the target system, based on the transmission data and the preset deployment information, the change information of the entities in the target system can be dynamically determined; and then according to the change information and the initial correspondence relationship between the entities in the target system, the knowledge graph between the algorithm layer entity, the subsystem layer entity, the software layer entity and the component layer entity, i.e. the deep software supply chain, can be accurately determined. By analyzing the software supply chain behavior from a global perspective, the structured knowledge network covering all entities in the system is constructed, which is suitable for the micro-service application scenario of distributed architecture deployment. In addition, based on the transmission data, the cloud network behavior of the system is monitored, the entity and relationship characteristics of the software supply chain of the system are sensed in real time, the knowledge graph is dynamically updated, and the cloud network ecology suitable for rapid iteration is adapted.

[0064] The technical scheme of the application and how the technical scheme of the application solves the above technical problems will be described in detail below with reference to the drawings and specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments.

[0065] The embodiment of the application provides a first knowledge graph construction method, which is applied to an electronic device, as shown in the figure, the method can comprise the following steps: Figure 1

[0066] Step S101: determining change information of a target system based on transmission data of the target system and preset deployment information.

[0067] The preset deployment information comprises preset resource information and preset vulnerability file information.

[0068] Since the transmission data of the target system represents the communication behavior of the entities in the target system, based on the transmission data and the preset deployment information, the change information of the entities in the target system can be dynamically determined;

[0069] ​Based on this, the embodiment needs to obtain the transmission data of the target system and the preset deployment information (the preset deployment information is not directly used for constructing the knowledge graph, but can be used for determining abnormal behavior), and then determine the change information of the target system.

[0070] In some optional embodiments, the transmission data is obtained through a network probe deployed in the target system.

[0071] For example, data transmission may occur inside the target system. Based on this, a network probe needs to be deployed in the intranet where the components run, to capture the traffic in the east-west direction in the Internet data center (IDC) room or the cloud.

[0072] The entities in the target system may transmit data with the outside world. Based on this, a network probe needs to be deployed in the extranet where the components run, to capture the extranet traffic, such as deploying a network probe at the operation and maintenance port, the management port, and the business traffic port.

[0073] Referring to Figure 2 As shown, the network probe deployed in the intranet obtains the data transmitted inside the target system; the network probe at the operation and maintenance port obtains the operation and maintenance data transmitted to the outside; the network probe at the management port obtains the management data transmitted to the outside; and the network probe at the business traffic port obtains the ordinary business data transmitted to the outside.

[0074] Step S102: determining the knowledge graph of the entities in the target system based on the change information and a preset correspondence relationship of the target system.

[0075] The preset correspondence relationship includes an initial correspondence relationship between the entities in the target system, and the entities in the target system include computing power layer entities, subsystem layer entities, software layer entities, and component layer entities in the target system.

[0076] Referring to Figure 3 As shown, the knowledge graph in the embodiment contains the relationship network between the four entities, which are the computing power layer entities, the subsystem layer entities, the software layer entities, and the component layer entities.

[0077] For example, the computing power layer entities include physical servers, virtualization clusters based on KVM (a kind of virtualization service), container clusters based on docker (a kind of open source application container engine), etc.; the subsystem layer entities include cache systems, message systems, configuration centers, middleware clusters, various warehouses, etc.; the software layer entities include redis (a kind of storage system), nginx (a kind of web server), etc.; and the component layer entities include driver module files, dynamic link library files, etc.

[0078] According to the transmission data of the target system and the preset deployment information, the change information of the entity in the target system can be dynamically determined, and according to the change information and the initial correspondence relationship between the entities in the target system, the knowledge graph between the entities in the power layer, the entities in the subsystem layer, the entities in the software layer and the entities in the component layer, that is, the deep software supply chain, can be accurately determined. By analyzing the software supply chain behavior from a global perspective, the structured knowledge network covering all entities in the system is constructed, which is suitable for the micro-service application scenario of distributed architecture deployment. In addition, based on the transmission data, the cloud network behavior monitoring of the system is realized, the entity and relationship characteristics of the software supply chain of the system are perceived in real time, and the knowledge graph is dynamically updated, which is suitable for the fast iteration of the cloud network ecology.

[0079] In the implementation, the knowledge graph can be constructed by a target model, which can be trained according to the entity and relationship characteristics obtained by the behavior knowledge learning engine.

[0080] For example, in order to adapt to the reality that the same entity has different semantics in different scenarios, different mapping matrices M are used for training to define the mapping from the entity space to the personalized relationship space. For a given triple (h, r, t), that is, using the TransR model, using the relationship-specific mapping matrix Mr to map the entity from the entity space to the relationship space where the relationship r is located, so as to obtain the hr and tr corresponding to the tail entity t, that is, hr=h·Mr, tr=t·Mr.

[0081] In the space of the relationship r, the relationship transfer constraint satisfied by hr and tr, that is, the scoring function is:

[0082]

[0083] In some optional embodiments, based on the transmission data of the target system and the preset deployment information, the change information of the target system is determined, including:

[0084] If the transmission data is download data or upload data, the file information of the transmission data is matched with the preset vulnerability file information.

[0085] If the matching fails, the change information of the entity corresponding to the transmission data is determined.

[0086] Exemplarily, the preset vulnerability file information includes relevant information of the vulnerability file, and the file information of the transmission data includes relevant information of the transmission data, which includes file identification, file version, binary file feature, file fingerprint information, etc. By matching the file information of the transmission data with the preset vulnerability file information, if the matching fails, it is indicated that the preset vulnerability file does not contain the transmission data, the transmission data has no vulnerability, and the transmission data is allowed to pass, and the corresponding entity is changed (such as version change), based on which, change information of the entity corresponding to the transmission data needs to be determined.

[0087] The above scheme, by matching the file information of the transmission data with the preset vulnerability file information, if the matching fails, it is indicated that the preset vulnerability file does not contain the transmission data, then the transmission data has no vulnerability, the transmission data is allowed to pass, and the corresponding entity is changed (such as version change), and change information of the entity corresponding to the transmission data needs to be determined, so as to change the knowledge graph in time.

[0088] In some optional embodiments, the following steps are further performed:

[0089] If the matching succeeds, the transmission data is intercepted, and the transmission data is notified through a preset notification mode.

[0090] Exemplarily, if the matching succeeds, it is indicated that the preset vulnerability file contains the transmission data, the transmission data has a vulnerability, and there may be a malicious intrusion; based on this, the transmission data needs to be intercepted, and the transmission data is notified through a preset notification mode.

[0091] The preset notification mode is not limited in the embodiment, such as displaying the transmission data through a display screen, or prompting through voice broadcast, etc.

[0092] The above scheme, if the file information of the transmission data matches the preset vulnerability file information, it is indicated that the preset vulnerability file contains the transmission data, the transmission data has a vulnerability, and there may be a malicious intrusion, by intercepting the transmission data and notifying the transmission data through a preset notification mode, the occurrence of malicious intrusion is reduced, and relevant personnel can learn about the attack behavior in time.

[0093] For the transmission data being download data, the embodiment of the application provides a second knowledge graph construction method, which is applied to an electronic device, such as Figure 4 As shown in the figure, the method can include:

[0094] Step S401: If the preset resource information does not contain the resource information corresponding to the download data, it is determined whether the download attribute of the target system represents that non-trusted source file download is allowed.

[0095] For example, after determining that there is download data, the electronic device needs to check whether the source of the download data is a trusted source. This is achieved by comparing preset resource information with resource information corresponding to the download data. If the preset resource information contains the resource information corresponding to the download data, it indicates that the download data is a trusted source file, that is, a file downloaded from a trusted database. The source of these files is a trusted database, and the subsequent steps can be performed. The preset resource information is related information of the trusted database, such as a domain name, an internal and external network mark, a Transmission Control Protocol (TCP) port, an Internet Protocol (IP) address, a Uniform Resource Locator (URL), and the like.

[0096] Conversely, if the preset resource information does not contain the resource information corresponding to the download data, it indicates that the download data is a non-trusted source file, that is, a file downloaded from an untrusted database. The source of these files is not a trusted database, and the subsequent steps need to be performed in reference to the download attribute of the target system. If the download attribute indicates that non-trusted source files are allowed to be downloaded, it indicates that the target system allows files to be downloaded from an untrusted database, and the subsequent steps can also be performed.

[0097] If the download attribute indicates that non-trusted source files are not allowed to be downloaded, it indicates that the target system does not allow files to be downloaded from an untrusted database, and the subsequent steps cannot be performed. In some optional embodiments, the transmission data can be intercepted and an alarm can be given.

[0098] Step S402: If the download attribute of the target system indicates that non-trusted source files are allowed to be downloaded, the file information of the download data is matched with the preset vulnerability file information.

[0099] Step S403: If the matching fails, the change information of the entity corresponding to the download data is determined.

[0100] Step S404: Based on the change information and the preset corresponding relationship of the target system, a knowledge graph of the entity in the target system is determined.

[0101] The specific implementation of steps S402-S404 can refer to the above embodiments, which will not be described here.

[0102] The above scheme compares preset resource information (related information of a trusted database) with resource information corresponding to the download data. If the preset resource information does not contain the resource information corresponding to the download data, it indicates that the download data is a non-trusted source file, that is, a file downloaded from an untrusted database. The source of the file is not a trusted database, and the download attribute of the target system needs to be referred to. If the download attribute indicates that the non-trusted source file is allowed to be downloaded, it indicates that the target system allows the file to be downloaded from the untrusted database, and the subsequent steps can be executed, thereby meeting the needs of different scenarios.

[0103] For the case that the transmission data is upload data, the third knowledge graph construction method is provided, which is applied to an electronic device, such as Figure 5 As shown in the figure, the method can include:

[0104] Step S501: If the upload data is data transmitted within the target system, it is determined whether the internal transmission attribute of the target system indicates that internal transmission is allowed.

[0105] For example, after the electronic device determines that there is upload data, it needs to check whether the upload data is data transmitted within the target system, such as by analyzing the source IP address and the destination IP address of the upload data to determine whether the upload data is data transmitted within the target system.

[0106] If the upload data is data transmitted within the target system, it indicates that the transfer operation of the upload data is performed between component hosts, and the internal transmission attribute of the target system needs to be referred to. If the internal transmission attribute indicates that internal transmission is allowed, it indicates that the target system allows internal file transmission, and the subsequent steps can be executed.

[0107] If the internal transmission attribute indicates that internal transmission is not allowed, it indicates that the target system does not allow internal file transmission, and the subsequent steps cannot be executed. In some optional embodiments, the transmission data can be intercepted and an alarm can be given.

[0108] Step S502: If the internal transmission attribute of the target system indicates that internal transmission is allowed, the file information of the upload data is matched with the preset vulnerability file information.

[0109] Step S503: If the matching fails, the change information of the entity corresponding to the upload data is determined.

[0110] Step S504: Based on the change information and the preset correspondence relationship of the target system, the knowledge graph of the entity in the target system is determined.

[0111] The specific implementation of steps S502-S504 can refer to the above embodiments, which will not be described here.

[0112] The above scheme, if the uploaded data is data transmitted within the target system, indicates that the transfer operation of the uploaded data is performed between component hosts, and needs to refer to the internal transmission attribute of the target system. If the internal transmission attribute indicates that internal transmission is allowed, it means that the target system allows internal file transmission, and the subsequent steps can also be executed, thereby meeting the needs of different scenarios.

[0113] For the case where the transmission data is access data, the fourth knowledge graph construction method provided by the embodiments of the present application is applied to an electronic device, such as Figure 6 As shown in the figure, the method can include:

[0114] Step S601: If the transmission data is access data, compare the current version information of the entity corresponding to the access data with the version information carried by the access data.

[0115] In implementation, although the access data does not change the version information and the like, the entity can be version evaluated based on the access data, such as identifying the type and version of the web server through the server header field of the Hyper Text Transfer Protocol (HTTP) request, or filtering the jquery (a front-end framework) version information through the transmitted file;

[0116] Further, the current version information of the entity corresponding to the access data is compared with the version information carried by the access data, that is, consistency judgment is performed on the two versions, so as to know whether the version upgrade or downgrade is successful.

[0117] Step S602: Based on the comparison result, determine the version state of the entity corresponding to the access data.

[0118] For example, if the current version information of the entity corresponding to the access data is inconsistent with the version information carried by the access data, it means that the current version of the entity may fail to change, and the version state of the entity is determined to indicate that the change fails.

[0119] If the current version information of the entity corresponding to the access data is consistent with the version information carried by the access data, it means that the current version of the entity may change successfully, and the version state of the entity is determined to indicate that the change succeeds.

[0120] Step S603: Based on the version state and the preset corresponding relationship of the target system, determine the knowledge graph of the entity in the target system.

[0121] For example, by adding the version state of the above entity, a new knowledge graph is obtained.

[0122] The scheme compares the current version information of the entity corresponding to the access data with the version information carried by the access data, that is, performs consistency judgment on the two versions; based on the comparison result, the version state of the entity corresponding to the access data is accurately determined, so that the effect of fast version convergence is achieved.

[0123] As shown in Figure 7 Based on the same inventive concept, the embodiment of the present application provides a knowledge graph construction device 700, which comprises:

[0124] The change information determination module 701 is configured to determine change information of the target system based on the transmission data of the target system and preset deployment information; wherein the preset deployment information comprises preset resource information and preset vulnerability file information.

[0125] The knowledge graph determination module 702 is configured to determine a knowledge graph of an entity in the target system based on the change information and a preset correspondence relationship of the target system.

[0126] The preset correspondence relationship comprises an initial correspondence relationship between entities in the target system, and the entities in the target system comprise an algorithm layer entity, a subsystem layer entity, a software layer entity and a component layer entity in the target system.

[0127] In some optional embodiments, the change information determination module 701 is specifically configured to:

[0128] If the transmission data is download data or upload data, the file information of the transmission data is matched with the preset vulnerability file information.

[0129] If the matching fails, the change information of the entity corresponding to the transmission data is determined.

[0130] In some optional embodiments, the change information determination module 701 is further configured to:

[0131] If the matching succeeds, the transmission data is intercepted, and the transmission data is notified through a preset notification mode.

[0132] In some optional embodiments, if the transmission data is download data, and the preset resource information does not contain the resource information corresponding to the download data, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, the change information determination module 701 is further configured to:

[0133] Determine that the download attribute of the target system represents that the download of non-trusted source files is allowed.

[0134] In some optional embodiments, if the transmission data is upload data and the upload data is data transmitted within the target system, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, the change information determining module 701 is further configured to:

[0135] determine that the internal transmission attribute of the target system represents that internal transmission is allowed.

[0136] In some optional embodiments, the change information determining module 701 is specifically configured to:

[0137] if the transmission data is access data, compare the current version information of the entity corresponding to the access data with the version information carried by the access data;

[0138] determine the version state of the entity corresponding to the access data based on the comparison result.

[0139] In some optional embodiments, the transmission data is acquired by a network probe deployed in the target system.

[0140] Since the apparatus is the apparatus in the method in the embodiments of the present application, and the principle of the apparatus for solving the problem is similar to that of the method, the implementation of the apparatus can be referred to the implementation of the method, and the repeated parts will not be described here.

[0141] As shown in Figure 8 based on the same inventive concept, an electronic device 800 is provided, which includes a processor 801 and a memory 802.

[0142] The memory 802 can be a volatile memory (volatile memory), such as random access memory (random-access memory, RAM); the memory 802 can also be a non-volatile memory (non-volatile memory), such as read-only memory, flash memory, hard disk drive (hard disk drive, HDD) or solid-state drive (solid-state drive, SSD); or the memory 802 is any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but not limited to this. The memory 802 can be a combination of the above memories.

[0143] The processor 801 can include one or more central processing units (central processing unit, CPU), graphics processing units (graphics processing unit, GPU) or digital processing units, etc.

[0144] The specific connection medium between the memory 802 and the processor 801 is not limited in the embodiments of the present application. In the embodiments of the present application, the memory 802 and the processor 801 are connected through a bus 803, and the bus 803 is represented by a thick line in the drawings. Figure 8 Figure 8 The bus 803 can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used to represent the bus 803 in the drawings, but it does not mean that there is only one bus or only one type of bus. Figure 8

[0145] The memory 802 stores program codes, and when the program codes are executed by the processor 801, the processor 801 performs the following processes:

[0146] Based on the transmission data of the target system and the preset deployment information, the change information of the target system is determined; wherein the preset deployment information includes preset resource information and preset vulnerability file information;

[0147] Based on the change information and the preset corresponding relationship of the target system, the knowledge graph of the entity in the target system is determined.

[0148] The preset corresponding relationship includes the initial corresponding relationship between the entities in the target system, and the entities in the target system include the computing power layer entity, the subsystem layer entity, the software layer entity and the component layer entity in the target system.

[0149] In some optional embodiments, the processor 801 specifically performs:

[0150] If the transmission data is download data or upload data, the file information of the transmission data is matched with the preset vulnerability file information;

[0151] If the matching fails, the change information of the entity corresponding to the transmission data is determined.

[0152] In some optional embodiments, the processor 801 further performs:

[0153] If the matching succeeds, the transmission data is intercepted, and the transmission data is notified through a preset notification mode.

[0154] In some optional embodiments, if the transmission data is download data, and the preset resource information does not include the resource information corresponding to the download data, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, the processor 801 further performs:

[0155] ​​Determining the download attribute of the target system allows non-trusted source file download.

[0156] In some optional embodiments, if the transmission data is upload data and the upload data is data transmitted within the target system, before determining the change information of the target system based on the transmission data of the target system and the preset deployment information, the processor 801 further performs:

[0157] Determining the internal transmission attribute of the target system allows internal transmission.

[0158] In some optional embodiments, the processor 801 specifically performs:

[0159] If the transmission data is access data, comparing the current version information of the entity corresponding to the access data with the version information carried by the access data;

[0160] Based on the comparison result, determining the version state of the entity corresponding to the access data.

[0161] In some optional embodiments, the transmission data is obtained by a network probe deployed in the target system.

[0162] The electronic device is the electronic device for executing the method in the embodiments of the present application, and the principle of solving the problem of the electronic device is similar to that of the method. Therefore, the implementation of the electronic device can be referred to the implementation of the method, and the repeated parts will not be described here.

[0163] The embodiments of the present application provide a computer readable storage medium, which stores a computer program. The program is executed by a processor to implement the steps of the knowledge graph construction method described above. The readable storage medium can be a non-volatile readable storage medium.

[0164] The present application is described above with reference to block diagrams and / or flowcharts of the method, device (system) and / or computer program product according to the embodiments of the present application. It should be understood that one block and the combination of blocks in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a processor of a special-purpose computer and / or other programmable devices to produce a machine, so that the instructions executed by the computer processor and / or other programmable devices create a method for implementing the functions / acts specified in the blocks of the block diagrams and / or flowcharts.

[0165] Accordingly, the present application can be embodied in hardware and / or in software (including firmware, resident software, micro-code, etc.) Furthermore, the present application can take the form of a computer program product on a computer-usable or computer-readable storage medium having computer-usable or computer-readable program code embodied in the medium for use by or in connection with an instruction execution system. In the context of this application, a computer-usable or computer-readable medium can be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0166] Although preferred embodiments of the application have been described herein, it will be apparent to those skilled in the art that various modifications can be made within the scope of the application. Accordingly, it is intended that all such modifications come within the scope of the claims appended hereto and their equivalents.

[0167] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method for constructing a knowledge graph, characterized in that, The method comprises: If the transmission data of the target system is download data or upload data, file information of the transmission data is matched with preset vulnerability file information of preset deployment information; If the matching fails, change information of an entity corresponding to the transmission data is determined; if the matching succeeds, the transmission data is intercepted, and the transmission data is notified through a preset notification mode; Based on the change information and a preset correspondence relationship of the target system, a knowledge graph of an entity in the target system is determined; wherein, the preset correspondence relationship comprises an initial correspondence relationship between entities in the target system, and the entities in the target system comprise computing power layer entities, subsystem layer entities, software layer entities and component layer entities in the target system.

2. The method of claim 1, wherein, If the transmission data is download data, and preset resource information of the preset deployment information does not contain resource information corresponding to the download data, before determining the change information of the target system, the method further comprises: Determining that a download attribute of the target system represents that non-trusted source file download is allowed.

3. The method of claim 1, wherein, If the transmission data is upload data, and the upload data is data transmitted within the target system, before determining the change information of the target system, the method further comprises: Determining that an internal transmission attribute of the target system represents that internal transmission is allowed.

4. The method of claim 1, wherein, The method further comprises: If the transmission data is access data, current version information of an entity corresponding to the access data is compared with version information carried by the access data; Based on the comparison result, a version state of the entity corresponding to the access data is determined.

5. The method according to any one of claims 1 to 4, characterized in that, The transmission data is obtained by a network probe deployed in the target system.

6. A knowledge graph construction apparatus, characterized by comprising: The device comprises: A change information determination module configured to, if transmission data of a target system is download data or upload data, match file information of the transmission data with preset vulnerability file information of preset deployment information; If the matching fails, change information of an entity corresponding to the transmission data is determined; if the matching succeeds, the transmission data is intercepted, and the transmission data is notified through a preset notification mode; A knowledge graph determination module configured to, based on the change information and a preset correspondence relationship of the target system, determine a knowledge graph of an entity in the target system; wherein, the preset correspondence relationship comprises an initial correspondence relationship between entities in the target system, and the entities in the target system comprise computing power layer entities, subsystem layer entities, software layer entities and component layer entities in the target system.

7. An electronic device, comprising: The electronic device comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage has a computer program executable by the electronic device, and when the program runs on the electronic device, the electronic device executes the method according to any one of claims 1 to 5.

Images