A method for completing the relationship in an industrial control system vulnerability knowledge graph based on graph neural networks.

Abstract

This invention discloses a method for completing the relationship in an industrial control system vulnerability knowledge graph based on graph neural networks. It constructs a heterogeneous industrial control system knowledge graph and proposes a latent relationship mining method (R-HetGNN) based on this graph. This method solves the multimodal problem and the heterogeneity problem in knowledge graph aggregation. Simultaneously, we use a random walk algorithm to solve the multi-layer neighborhood relationship problem. Finally, experiments demonstrate the effectiveness of the proposed method. We fuse vulnerability information from various self-crawled vulnerability databases to construct a vulnerability knowledge graph and conduct corresponding experiments on the graph. Experimental results show that the proposed method outperforms traditional knowledge reasoning methods by approximately 10%-35%.

Description

Technical Field

[0001] This invention belongs to the field of industrial control system security technology, and relates to the technology of constructing industrial control system vulnerability knowledge graphs, and in particular to a method for completing the relationship of industrial control system vulnerability knowledge graphs based on graph neural networks. Background Technology

[0002] Industrial control systems underpin the operation of national infrastructure, making their security paramount. However, the increasing integration of industrialization and informatization has made it easier for attackers to exploit vulnerabilities in industrial control systems, posing significant challenges to their security. High-risk vulnerabilities can be exploited or combined to achieve malicious purposes, such as damaging industrial control systems or collecting sensitive information. A thorough understanding of the vulnerabilities within industrial control systems plays a crucial role in practical applications. Currently, our understanding of vulnerabilities comes from authoritative vulnerability databases (CVE, NVD, CNVD, CISA, etc.). However, traditional vulnerability database queries are rudimentary. Security personnel often only search for potential vulnerabilities after a system malfunction has occurred. Traditional vulnerability databases require analyzing each vulnerability individually and verifying whether the malfunction was caused by that vulnerability, which is not only time-consuming but also tests the professionalism and breadth of knowledge of security personnel. Therefore, inspired by Google's Knowledge Graph, many works have attempted to represent vulnerability information in the form of a knowledge graph, storing vulnerability information in a structured format. Knowledge graphs (KGs) are expressive data structures composed of numerous triples, in the form of (head entity, relation, tail entity). This structured data representation is natural and intuitive, enabling security personnel to quickly provide effective vulnerability information. However, in practical applications, large and comprehensive security knowledge graphs may lose precision due to the excessive information they contain, easily leading to confusion when extracting key features of vulnerabilities in subdomains. Therefore, it is necessary to construct domain-specific security knowledge graphs with a narrower scope and more precise data.

[0003] Furthermore, completing the potential relationships between different vulnerabilities is an important direction in the field of cybersecurity, but current research in this area is very limited. In a single attack, attackers often exploit multiple vulnerabilities to achieve their ultimate malicious objective. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a method for completing the relationship of industrial control system vulnerability knowledge graph based on graph neural network, which is used to construct industrial control system vulnerability knowledge graph and complete the potential relationship between vulnerabilities. This is because it is difficult to find the potential connection between vulnerabilities, and traditional link prediction technology is also difficult to take into account the multi-layer neighborhood relationship of knowledge graph, and lacks purpose in aggregating different types of entity information.

[0005] The technical solution of this invention to solve the above-mentioned technical problems is as follows: a method for completing the relationship of an industrial control system vulnerability knowledge graph based on graph neural networks, comprising five modules: a vulnerability data crawling module, a named entity recognition module, a graph data construction module, an information aggregation module, and a knowledge reasoning module. The vulnerability data crawling module crawls unstructured vulnerability information from web pages; the named entity recognition module extracts keywords from the obtained vulnerability description information; the graph data construction module combines the keywords extracted by the named entity recognition module with the information obtained from the data crawling module to construct an attack clue graph; the information aggregation module aggregates information from each node of the obtained attack clue graph according to neighbor relationships and attribute information; finally, the knowledge reasoning module calculates the similarity distance between nodes based on the embedded data in the attack clue graph, realizing the self-updating of the attack clue graph and the querying of attack clues. The following describes each module and its implementation steps:

[0006] 1) Vulnerability Data Crawling Module. The internet contains a vast amount of scattered and difficult-to-integrate vulnerability information. This information is typically stored in different vulnerability databases, and these databases store vulnerabilities in different ways. To deduce complete attack clues, this vulnerability information needs to be standardized and integrated. Therefore, this module uses web crawling technology to crawl vulnerability information from multiple authoritative vulnerability databases and constructs rules to integrate it into a unique vulnerability data table.

[0007] Step 1: Starting with the industrial control system vulnerability database, use web crawling technology to obtain all vulnerability information, then proceed to Step 2.

[0008] Step 2: Extract attributes such as vulnerability name, risk level, CVE number, etc., and then proceed to Step 3.

[0009] Step 3: Collect and remove vulnerability information from the ICS vulnerability database based on CNVD. During aggregation and deduplication, CNVD is used for unique attributes, such as "release date" and "threat level." If these attributes overlap, the CNVD-extracted attribute information is retained. For attributes that are not unique, the information is aggregated. For attribute information not found in CNVD, the CVE dictionary is queried for supplementation. Proceed to Step 4.

[0010] 2) Named Entity Recognition Module. The vulnerability information obtained from the vulnerability data crawling module contains a large amount of unstructured vulnerability descriptions, making it difficult to intuitively and accurately construct an industrial control system vulnerability knowledge graph. Therefore, named entity recognition technology is needed to extract vulnerability features. Among existing named entity recognition models, the BiLSTM-CRF model has a strong feature extraction capability for contextual information and sequential dependencies between tags. Therefore, we use the BiLSTM-CRF model to extract vulnerability feature information.

[0011] Step 4: Input the aggregated and deduplicated vulnerability description information into the BiLSTM-CRF model. The model outputs the structured vulnerability feature information after named entity recognition. Then, proceed to Step 5.

[0012] 3) Graph Data Construction Module. Through the named entity recognition process, vulnerability characteristic information was obtained, and characteristic keywords were extracted. Based on the collected data, an industrial control system vulnerability knowledge graph was constructed.

[0013] Step 5: Construct an industrial control system vulnerability knowledge graph containing vulnerability names, attack methods, and attack results, then proceed to Step 6.

[0014] Step 6: Starting from any attack method node, use a random walk algorithm to find the multi-level neighbors of the current node, forming a random walk neighbor list, and then proceed to Step 7.

[0015] 4) Information Aggregation Module. The initially constructed industrial control system (ICS) vulnerability knowledge graph contains not only explicit relationships but also a large number of potential relationships. In actual ICS scenarios, devices often contain multiple vulnerabilities simultaneously; the presence of vulnerability A is highly likely to be accompanied by vulnerability B. Therefore, there are potential correlations between vulnerabilities. However, these relationships are not explicitly stored in the vulnerability database platform and need to be supplemented by combining existing ICS vulnerability knowledge graphs. Therefore, we made adaptive improvements to HetGNN, embedding structural and content information of nodes in the attack clue graph, and finally aggregating heterogeneous neighbors to complete the information aggregation process of the attack clue graph.

[0016] Step 7: Embed node structure information. Perform another random walk in the random walk list generated in Step 6, ensuring that the number of neighbors in the secondary random walk for each node does not exceed m. Proceed to Step 8.

[0017] Step 8: Group the neighbors from the second random walk by type, and use the top k neighbors from the random walk results as the final walking neighbors for each type of node. Proceed to Step 9.

[0018] Step 9: Embed the node numbers of the final wandering neighbors using word2vec and aggregate them together to form the structural information vector of each node. Execute Step 10.

[0019] Step 10, Node Content Information Embedding. The text content information of the final wandering neighbor nodes generated in Step 8 is embedded using the BERT model and aggregated together to form the content information vector of each node. Then, proceed to Step 11.

[0020] Step 11: Aggregate the structural information vector and content information vector from Steps 9 and 10 together, and then execute Step 12.

[0021] 5) Knowledge Reasoning Module. The exported node embeddings can be applied to fill in the potential relationships between vulnerabilities.

[0022] Step 12: Randomly shuffle the vulnerability knowledge graph and proceed to step 13.

[0023] Step 13: Select node n on the graph, perform a random walk to obtain a list of random walk neighbors, and then proceed to step 14.

[0024] Step 14: In a small training task, select a positive node n from the random walk neighbor list generated in Step 13. p The training process executes step 15, and the testing process executes step 17.

[0025] Step 15: Select a matching negative node n using the negative sampling algorithm. n Proceed to step 16.

[0026] Step 16: Calculate the values ​​of node n and positive node n respectively. p and negative node n n The similarity between nodes is adjusted by backpropagation to make node n similar to the positive node n. p The similarity between nodes n and negative nodes n n The similarity of negative values ​​approaches 0.

[0027] Step 17, calculate the relationship between node n and positive node n p The similarity between nodes is defined by a threshold q. If node n is similar to positive node n... p If the similarity between nodes is less than q, then the node n is considered positive. p There is a potential relationship between node n and the edge relationship can be completed in the knowledge graph.

[0028] The beneficial effects of this invention are:

[0029] I. This invention proposes a construction model for a knowledge graph of heterogeneous industrial control systems. Starting from a real industrial control system vulnerability database, the model constructs a vulnerability knowledge graph. This not only improves the efficiency of providing security personnel with professional vulnerability information, but also autonomously completes the relationships between vulnerabilities.

[0030] II. This invention proposes a potential relation completion method (R-HetGNN). The method adopts different information aggregation methods for different types of entities and different attribute information contained in the same entity. It calculates the correlation between two nodes based on the similarity function to achieve the purpose of potential relation completion.

[0031] Third, this invention demonstrates the effectiveness of the proposed method for constructing knowledge graphs and mining potential relationships in heterogeneous industrial control systems through experiments. Experimental results show that our proposed method outperforms traditional knowledge reasoning methods by approximately 10%-35%. Attached Figure Description

[0032] Figure 1 This is a flowchart illustrating the method for completing the knowledge graph relationship of industrial control system vulnerabilities based on graph neural networks as described in this invention.

[0033] Figure 2 This is a schematic diagram of the vulnerability information extraction process in steps 1-4 of Embodiment 1 of the present invention.

[0034] Figure 3 This is a schematic diagram illustrating the specific process of knowledge graph construction in steps 5-6 of Embodiment 1 of the present invention.

[0035] Figure 4 This is a schematic diagram of the information aggregation process in steps 7-11 of Embodiment 1 of the present invention.

[0036] Figure 5 This is a schematic diagram illustrating the construction method of the feature matrix in steps 12-17 of Embodiment 1 of the present invention.

[0037] Figure 6 This is a schematic diagram illustrating the effects of different named entity recognition models in Embodiment 1 of the present invention.

[0038] Figure 7 This is a schematic diagram illustrating the classification effects of different named entity recognition models on different categories of entities in Embodiment 1 of the present invention.

[0039] Figure 8 This is a schematic diagram illustrating the knowledge reasoning effect in Embodiment 1 of the present invention. Detailed Implementation

[0040] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0041] Example 1

[0042] like Figure 1 As shown, Example 1 is a method for completing the knowledge graph relationship of industrial control system vulnerabilities based on graph neural networks. This method consists of 17 steps. The specific details are described below:

[0043] Step 1: Starting with the industrial control system vulnerability database platform, use web crawling technology to obtain all vulnerability information, then proceed to Step 2.

[0044] Step 2: Extract the vulnerability name, vulnerability description, danger level, CVE number, CVE link, CNVD number, CNVD link, etc. from the unstructured web page vulnerability information, and then proceed to Step 3.

[0045] Step 3: Collect and remove vulnerability information from the ICS vulnerability database using CNVD. For example, vulnerability CNVD-2021-24492 is a low-risk authentication bypass vulnerability. Attackers can exploit this vulnerability to bypass the file opening password verification process by modifying the contents of library files. Proceed to Step 4.

[0046] Step 4: Input the vulnerability description information "An attacker can exploit the vulnerability to bypass the file opening password verification process by modifying the contents of the library file" into the BiLSTM-CRF model. The model outputs the structured vulnerability feature information after named entity recognition: "Modify the contents of the library file" and "Bypass the file opening password verification process". Then proceed to step 5.

[0047] Step 5: Add the vulnerability name "Authentication Bypass Vulnerability", the attack method "Modify Library File Contents", and the attack result "Bypass the File Open Password Verification Process" to the industrial control system vulnerability knowledge graph, and then proceed to Step 6.

[0048] Step 6: Starting from any attack method node "modify library file content", use a random walk algorithm to find the multi-level neighbors of the current node, form a random walk neighbor list, and then proceed to step 7.

[0049] Step 7: Embed node structure information. Perform another random walk in the random walk list generated in Step 6. The number of walking neighbors for each node shall not exceed 40, the number of consecutive walking neighbors for each node shall not exceed 30, and the number of vulnerability walking neighbors shall not exceed 10. Proceed to Step 8.

[0050] Step 8: Group the secondary random walk neighbors by type. For each type of node, take the top k neighbors with the highest word frequency in the random walk results as the final walking neighbor results. When the neighbor node is method and consequence, k = 10. When the neighbor node is vulnerability, k = 3. Then proceed to step 9.

[0051] Step 9: Embed the node numbers of the final wandering neighbors using word2vec and aggregate them together to form the structural information vector of each node. Execute Step 10.

[0052] Step 10, Node Content Information Embedding. The text content information of the final wandering neighbor nodes generated in Step 8 is embedded using the BERT model and aggregated together to form the content information vector of each node. Then, proceed to Step 11.

[0053] Step 11: Aggregate the structural information vector and content information vector from Steps 9 and 10 together, and then execute Step 12.

[0054] Step 12: Randomly shuffle the vulnerability knowledge graph and proceed to step 13.

[0055] Step 13: Select node n (vulnerable node "authentication bypass vulnerability") on the graph, perform a random walk to obtain a list of random walk neighbors, and then proceed to step 14.

[0056] Step 14: In a small training task, select a positive node n from the random walk neighbor list generated in Step 13. p (Result node "Bypassing file open password verification process"), the training process executes step 15, and the testing process executes step 17.

[0057] Step 15: Select a matching negative node n using the negative sampling algorithm. n (Result node "Deny Service"), proceed to step 16.

[0058] Step 16: Calculate the values ​​of node n (vulnerable node "authentication bypass vulnerability") and positive node n respectively. p (Result node "Bypassing file open password verification process") and negative node n n The similarity between the resulting node "Reject Service" and the parameters are adjusted through backpropagation to make node n similar to the positive node n. p The similarity between nodes n and negative nodes n n The similarity of negative values ​​approaches 0.

[0059] Step 17: Calculate the similarity s = 0.0135 between node n (vulnerable node "authentication bypass vulnerability") and positive node np (vulnerable node "critical function authentication missing vulnerability"), and define a threshold q = 0.1. p If the similarity between nodes is less than q, it indicates that node n is positive. p There is a potential relationship between node n and the edge relationship can be completed in the knowledge graph.

[0060] like Figure 2 As shown, the vulnerability information extraction process in steps 1-4 above is as follows:

[0061] Starting with an industrial control system (ICS) vulnerability database platform, web crawling technology is used to obtain all vulnerability information from the database. Vulnerability names, threat levels, CVE numbers, CVE links, CNVD numbers, and CNVD links are extracted from unstructured web vulnerability information. The obtained vulnerability information from the ICS vulnerability database is then aggregated and deduplicated based on CNVDs. During aggregation and deduplication, unique attributes are determined by CNVDs, such as "release date" and "threat level." If these attributes overlap, the CNVD-extracted attribute information is retained. For attributes with multiple unique results, information is aggregated. Attributes not found in CNVDs are supplemented using CVEs.

[0062] Finally, the vulnerability attribute information crawled from different vulnerability databases is integrated and deduplicated. After the above process, the final vulnerability entity contains the following attribute information: ISVD number, CVE number, vulnerability description, vulnerability source, vulnerability name, threat level, release date, and vulnerability reference.

[0063] like Figure 3 As shown, the specific process of knowledge graph construction in steps 5-6 above is described below:

[0064] This invention constructs a heterogeneous attack clue graph containing vulnerability names, attack methods, and attack results. Data annotated with BME is used as raw data, which is then categorized and extracted. Each vulnerability entry is stored separately. Finally, a CVE vulnerability table is generated by combining the raw data obtained from web crawlers. Each CVE entry includes the CVE number, the result caused by the vulnerability, the attacker's method of exploiting the vulnerability, the cause of the vulnerability, and the vulnerability name. The data in the CVE vulnerability table is then organized into a heterogeneous graph.

[0065] Heterogeneous graphs contain three types of nodes and four types of edge relationships. The graph structure information is as follows:

[0066] The system comprises 569 consequence nodes (attack results), 596 method nodes (attack methods), and 57 vulnerability nodes (vulnerability names). Edge relationships are defined as c_m, c_v, m_v, and v_v. Here, c_m represents the correlation between attack methods and attack results, c_v represents the correlation between vulnerabilities and attack results, m_v represents the correlation between vulnerabilities and attack methods, and v_v represents the correlation between different vulnerabilities (if a vendor's product has vulnerability A, then that product is very likely to have vulnerability B). It's important to note that the original data did not contain edge relationships between vulnerabilities; therefore, this paper stipulates that all first-order neighbor vulnerability nodes of the same consequence node have edge relationships.

[0067] After generating the basic graph structure, the random walk algorithm in HetGNN is used to start from each method vertex and walk a fixed length L=10, repeating n=10 times for each vertex.

[0068] like Figure 4 As shown, the information aggregation process in steps 7-11 above is described as follows:

[0069] The structure and content information of nodes are embedded in the industrial control system vulnerability knowledge graph, and finally, heterogeneous neighbors are aggregated to complete the information aggregation process. The process consists of three parts: node structure information embedding, node content information embedding, and heterogeneous neighbor aggregation based on HetGNN.

[0070] Node structure information embedding: We group the random walk neighbors by type and use the top k neighbors from the random walk results as the final walking neighbors for each type of node. All node numbers are embedded using word2vec.

[0071] Node content information embedding: The BERT model is used for content information embedding.

[0072] Heterogeneous neighbor aggregation based on HetGNN: This is divided into aggregation of neighbors of the same type and aggregation of neighbors of different types. The aggregation function for neighbors of the same type is as follows:

[0073]

[0074] For the aggregation of different types of neighbors, this module is essentially a self-attention model because different types of nodes have different degrees of influence on the current node. Different types of neighbors will assign different weights to the final embedding representation of node v, representing the importance of the i-th type of node to node v.

[0075] like Figure 5 As shown, the vulnerability relationship completion process in steps 12-17 above is described as follows:

[0076] First, the entire graph is randomly shuffled. Then, a node n is selected in the graph, and a random walk is performed again to generate a list L of the random walk neighbors of node n. i ={v i m j c k}(i, j, k ∈ {1, 2, ..., p}). p is the total number of entities. In a small training task, we start from L i Choose a positive node n p And find the negative node n through the negative sampling algorithm. n Then calculate the negative node n respectively. n Sum of positive nodes n p The similarity with the current node n is calculated using the following formula:

[0077]

[0078] Where ε (·) This represents node embeddings, which are updated during training. During testing, the calculated result s is compared with the parameter q. If s > q, it is determined that there is no correlation between v and v'. As can be seen from the figure, although the node positions change, the overall graph structure remains unchanged during the shuffling process, and the adjacency relationships are propagated in a fixed manner throughout the experiment.

[0079] like Figure 6 As shown, we conduct comparative experiments using BiLSTM, CRF, and LSTM models. To evaluate the model performance, we first define the following four sample sets:

[0080] (1)TP: The set of attack samples in the dataset that are classified as attacks by the model.

[0081] (2)FP: The set of normal samples in the dataset but classified as attacks by the model.

[0082] (3)TN: The set of normal samples in the dataset that are classified as normal by the model.

[0083] (4) FN: A set of attack samples in the dataset that are classified as normal by the model.

[0084] Based on the four sample sets mentioned above, this invention employs commonly used evaluation metrics in the field of deep learning to evaluate the intrusion detection model, including: recall, precision, and F1-Score. Recall is the proportion of detected attacks out of all attacks, precision is the proportion of true attacks detected, and F1-Score is the harmonic mean of precision and recall. We believe that the values ​​of these evaluation metrics should be as high as possible, representing good detection capabilities of the model.

[0085] The formulas for calculating these evaluation indicators are as follows:

[0086]

[0087]

[0088]

[0089] like Figure 7As shown in the figure, based on the overall accuracy results, the accuracy results of different models for recognizing different categories of entities are extracted. It can be seen from the figure that the recognition performance of different models varies greatly for each category of entity, but overall, the BiLSTM-CRF model has the best robustness in recognizing different categories of entities.

[0090] like Figure 8 As shown, this invention compares the classic graph knowledge reasoning models TransE and GAT. Because the GAT model cannot be directly applied to heterogeneous graphs and its training process employs a multi-classification algorithm, only accuracy metrics are used for comparison. The comparative experimental results show that the R-HetGNN knowledge reasoning algorithm outperforms both the classic TransE and GAT algorithms on the dataset presented in this invention.

[0091] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for completing the relationship of an industrial control vulnerability knowledge graph based on a graph neural network, characterized by Applying graph neural network technology to complete the vulnerability knowledge graph, including: Step 1, starting from the industrial control vulnerability database, using web crawler technology to obtain all vulnerability information, executing step 2; Step 2, extract attributes, including vulnerability name, risk level, CVE number, execute step 3; Step 3, collect and delete vulnerability information from ICS vulnerability database according to CNVD; In the process of aggregation and deduplication, for the attributes with unique results, take CNVD as the standard, if these attributes coincide, keep the attribute information extracted by CNVD, for the attributes with non-unique results, aggregate the information, for the attribute information not in CNVD, query the CVE dictionary for supplementation; Execute step 4; Step 4, input the aggregated and deduplicated vulnerability description information into the BiLSTM-CRF model, and the model outputs the structured vulnerability feature information after named entity recognition, execute step 5; Step 5, build an industrial control vulnerability knowledge graph containing vulnerability name, attack method and attack result, execute step 6; Step 6, starting from any attack method node, use random walk algorithm to find the multi-level neighbors of the current node to form a random walk neighbor list, execute step 7; Step 7, embed node structure information; In the random walk list generated in step 6, perform random walk again, the number of secondary random walk neighbors of each node does not exceed m; Execute step 8; Step 8, group the secondary random walk neighbors by type, and take the top k neighbors in the random walk results as the final walk neighbors of each type of node; Execute step 9; Step 9, embed the node number of the final walk neighbor into the word2vec and aggregate them together to form the structure information vector of each node; Execute step 10; Step 10, node content information embedding; Embed the text content information of the final walk neighbor node generated in step 8 into the BERT model and aggregate them together to form the content information vector of each node, execute step 11; Step 11, aggregate the structure information vector and content information vector of step 9 and step 10 together, execute step 12; Step 12, randomly shuffle the vulnerability knowledge graph, execute step 13; Step 13, select a node n on the graph, perform random walk to get a random walk neighbor list, execute step 14; Step 14, in a small training task, select a positive node np from the random walk neighbor list generated in step 13, execute step 15 for training process and step 17 for testing process; Step 15, select a matching negative node nn using negative sampling algorithm, execute step 16; Step 16, calculate the similarity between node n and positive node np and negative node nn respectively, adjust the parameters through back propagation to make the similarity between node n and positive node np and the negative value of the similarity between node n and negative node nn tend to 0; Step 17, calculate the similarity between node n and positive node np, define threshold q, if the similarity between node n and positive node np is less than q, it means that there is a potential relationship between positive node np and node n, and the edge relationship is completed in the knowledge graph.

2. The method of claim 1, wherein the method is based on a graph neural network. The information aggregation method in steps 7-11 specifically includes: Embedding the structure and content information of nodes in the industrial control vulnerability knowledge graph, and finally aggregating the heterogeneous neighbors to complete the information aggregation process. The process is divided into three parts: node structure information embedding, node content information embedding, and heterogeneous neighbor aggregation based on HetGNN. Node structure information embedding: group random walk neighbors by type, and take the first k neighbors in the random walk result as the final walk neighbors of each type of node; all node numbers are embedded by word2vec; Node content information embedding: content information embedding is performed using the BERT model; Heterogeneous neighbor aggregation based on HetGNN: divided into same type and different type neighbor aggregation; the same type neighbor aggregation function is as follows: ； Different types of neighbors will assign different weights to the final embedding representation of node v, representing the importance of the i-th type of node to node v.

3. The method of claim 1, wherein, The knowledge reasoning completion method in steps 12-17 specifically includes: First, randomly shuffle the entire graph; then select a node n in the graph, perform random walk again to generate a random walk neighbor list Li = {vi, mj, ck} of node n, i, j, k ∈ {1, 2,..., p}; p is the total number of entities; in a small training task, select a positive node np from Li, and find a negative node nn through negative sampling algorithm; then calculate the similarity between the negative node nn and the positive node np and the current node n respectively, and the similarity formula is as follows: ； wherein represents the node embedding, which will be updated during the training process; during the testing process, the result s will be compared with the parameter q, if s > q, it is judged that there is no correlation between v and v', and the adjacency relationship will be fixedly transmitted during the experiment.

Images