A network security knowledge graph reasoning method based on TransH-Bert

Abstract

The application designs a network security knowledge graph reasoning method based on TransH-Bert, and belongs to the field of network security and artificial intelligence; first, a CWE, CVE and CAPEC knowledge base is constructed to construct a basic network security knowledge graph, then a TransH model is used to depict the position information of network security knowledge entities in the vector space, a Bert pre-training model is used to depict the semantic information of network security knowledge entities, finally, the position information depicted by the TransH model and the semantic information depicted by the Bert pre-training model are fused to execute a knowledge reasoning task, that is, the position data output by the TransH model and the relationship probability matrix output by the Bert pre-training model are used to calculate the score of knowledge reasoning, and the calculated score is used to execute the knowledge reasoning task, thereby effectively improving the accuracy of the knowledge reasoning model.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security and artificial intelligence, and particularly relates to a network security knowledge graph reasoning method based on TransH-Bert. BACKGROUND

[0002] At present, with the continuous popularization and development of technologies such as Internet of Things, cloud computing and 5G, network information interaction is increasing, and the development of network technology is showing a rapid development trend. However, the development of network security defense technology always lags behind various new network technologies, which makes hackers or attack organizations can attack by using various security vulnerabilities before the network security defense technology is updated. In recent years, network security accidents have occurred frequently, which has brought serious harm to human production and life.

[0003] In the face of various network attack technologies and network vulnerabilities that appear continuously and the increasing multi-source heterogeneous network security data on the Internet, network security knowledge graph for multi-element association intelligent reasoning has become a research hotspot. Network security knowledge graph can organize network security knowledge, guide network security practice, assist network security decision-making, and promote network security technology development. The significance of network security knowledge graph is that it can help people better understand and cope with network security problems. Knowledge graph is a graphical knowledge representation method, which can display complex knowledge system in the form of graph, so that people can more intuitively understand the relationship and law. In the field of network security, knowledge graph can help people understand network security threats, attack methods and defense strategies, and thus better protect their own and organizational network security.

[0004] Due to the natural incompleteness of knowledge graph, and with the passage of time, the knowledge in the knowledge graph will also change. In order to eliminate the inconsistency in the knowledge graph and supplement the missing relationship in the knowledge graph, knowledge reasoning needs to be performed on the knowledge in the knowledge graph. Knowledge reasoning can automatically deduce new facts and relationships according to existing facts and relationships, thereby enriching the content and quality of the knowledge graph and further improving its application effect.

[0005] The existing network security knowledge graph inference models mainly have four types: 1. Association Rule Mining under Incomplete Evidence (AMIE), AMIE is an association rule mining model based on incomplete knowledge base. By learning to predict each relationship in turn: for each relationship, start from the rule with an empty body, and expand the rule body part through three operations: add a hanging edge, add an instance edge, and add a closed edge. The three rules are respectively. This model has strong interpretability and can automatically discover inference rules, but the coverage of the generated rules is low and the model prediction effect is poor. 2. Path Ranking Algorithm (PRA), PRA is a knowledge reasoning model based on path ranking algorithm. The basic idea of this model is to find a set of relationship paths that connect two entities to predict the existence of a certain specific relationship between entities. The relationship path obtained actually corresponds to a Horn clause, and the path features calculated by PRA can be converted into logical rules. This model has strong interpretability and can automatically discover inference rules, but it is not good at processing low-frequency relationships and low-connectivity graphs. 3. Knowledge Graph Embedding by Translating on Hyperplanes (TransH), TransH is a knowledge reasoning model based on distributed representation learning. The central idea of this type of model is to find a mapping function to map symbolic representations to vector spaces for numerical representation, thereby reducing the dimensionality disaster and capturing the implicit association between entities and relationships. The focus is that it can be calculated directly and the calculation speed is fast. The main idea of TransH is to convert the problem of measuring the rationality of the triple in the vectorized knowledge graph into the problem of measuring the distance between the head entity and the tail entity. This model has low complexity and fast training speed, but cannot depict the semantic relationship between knowledge entities when performing knowledge reasoning. 4. Neural Tensor Networks (NTN), the core idea of NTN model is to model the relationship by introducing tensor representation, and use neural network for reasoning and classification. This model has high complexity and needs a large number of triple examples to be fully learned, and its effect on large-scale sparse knowledge graph is poor. SUMMARY

[0006] In view of the deficiencies of the prior art, the present application provides a network security knowledge graph reasoning method based on TransH-Bert, which can use the existing network security knowledge graph to reason new network security knowledge. The present application first proposes a CWE, CVE and CAPEC knowledge base to construct a basic network security knowledge graph, then uses a TransH model to depict the position information of network security knowledge entities in a vector space, uses a Bert pre-training model to depict the semantic information of network security knowledge entities, and finally proposes to perform a knowledge reasoning task by fusing the position information depicted by the TransH model and the semantic information depicted by the Bert pre-training model, that is, to use the position data output by the TransH model and the relationship probability matrix output by the Bert pre-training model to calculate the score of knowledge reasoning, and to use the calculated score to perform the knowledge reasoning task, thereby effectively improving the accuracy of the knowledge reasoning model.

[0007] A network security knowledge graph reasoning method based on TransH-Bert, comprising the following contents:

[0008] Step 1: Construct a network security knowledge graph and store it in a label-based graph database in the form of triples;

[0009] Step 1.1: Prepare the graph database environment; first install a graph database on the computer for storing the network security knowledge graph; and close the firewall and system update function of the operating system;

[0010] Step 1.2: Use a crawler tool to crawl the Common Vulnerabilities and Exposures (CVE) knowledge base, Common Attack Pattern Enumeration and Classification (CAPEC) knowledge base and Common Weakness Enumeration (CWE) knowledge base from the network security knowledge base;

[0011] Step 1.3: Extract knowledge entities from the knowledge base and save them to the label-based graph database;

[0012] Step 1.3.1: Analyze the CVE knowledge base and convert the knowledge in the CVE knowledge base into CVE knowledge nodes stored in the label-based graph database; the CVE knowledge nodes take the CVE_ID in the CVE knowledge base as the entity ID, and extract the description, references, cvssV3Score and cvssV3Vector fields as the attributes of the CVE nodes;

[0013] Step 1.3.2: Parse the CWE knowledge base and convert the knowledge in the CWE knowledge base into CWE knowledge nodes stored in a tag-based graph database; the CWE knowledge nodes take the CWE_ID in the CWE knowledge base as the entity ID, and the description and name fields are extracted as the attributes of the CWE nodes;

[0014] Step 1.3.3: Parse the CAPEC knowledge base and convert the knowledge in the CAPEC knowledge base into CAPEC knowledge nodes stored in a tag-based graph database; the CAPEC knowledge nodes take the CAPEC_ID in the CAPEC knowledge base as the entity ID, and the description and name fields are extracted as the attributes of the CAPEC nodes;

[0015] Step 1.4: Extract the relationships between knowledge entities from the knowledge base and save them to the tag-based graph database;

[0016] Step 1.4.1: Extract the Observed_Examples field in the CWE knowledge base to parse the relationships between CVE entities and CWE entities;

[0017] Step 1.4.2: Extract the Related_Weaknesses field in the CWE knowledge base to parse the relationships between CWE entities and CWE entities;

[0018] Step 1.4.3: Extract the Related_Attack_Patterns field in the CAPEC knowledge base to parse the relationships between CAPEC entities and CAPEC entities;

[0019] Step 1.4.4: Extract the Related_Weaknesses field in the CAPEC knowledge base to parse the relationships between CAPEC entities and CWE entities;

[0020] Step 1.4.5: Save all the parsed relationships to the tag-based graph database;

[0021] Step 2: Based on Step 1, use the Bert pre-training model to obtain the relationship between the text descriptions of the knowledge entities in the knowledge graph, i.e. based on the text description of the knowledge entity, and then calculate the relationship probability matrix between the knowledge entities through the Bert pre-training model;

[0022] Step 2.1: Download the Bert pre-training model, and convert the text description of the knowledge entity in the knowledge graph obtained in Step 1 from string form to array form according to the parameters of the Bert pre-training model;

[0023] Step 2.2: Constructing the input data of the Bert pre-training model; the text description of any two knowledge entities in the knowledge graph obtained in step 1 is spliced in the following formula to obtain a sample, wherein [CLS] represents the sample identifier, and [SEP] represents the data separator and end symbol;

[0024] [CLS] sentence1[SEP] sentence2[SEP] (1)

[0025] Step 2.3: Based on the types of relationships in the knowledge graph obtained in step 1, the relationship between the two entities in step 2.2 is converted into one-hot encoding as the label of the sample;

[0026] Step 2.4: Digitize the spliced sample to construct input_ids, input_mask and segment_ids arrays, and then input them into the Bert pre-training model; first, define the maximum length of the sample LEN, if the sample length exceeds LEN, the data exceeding LEN will be lost, then convert all samples into index arrays input_ids with a length of LEN, if the sample length is less than LEN, 0 is added at the end of the sample; in order to distinguish the useful data and useless data in the input_ids array, input_mask array needs to be generated according to input_ids, wherein the invalid part of the sample is set to 0 and the effective part is set to 1, the part set to 0 will be ignored during training; in order to distinguish different sentence segments in the sample, segment_ids array needs to be generated according to input_ids, wherein the first sentence is filled with 0 and the second sentence is filled with 1, and 0 is filled at the end when the sample length is less than LEN;

[0027] Step 2.5: input the input_ids, input_mask and segment_ids arrays constructed in step 2.4 into the Bert pre-training model, then input the pooled representation of the model output into the Dropout layer to prevent model overfitting, then input the output of the Dropout layer into the softmax layer to obtain the relationship probability matrix;

[0028] Step 2.6: Based on the parameters of the Bert pre-training model that have been trained and the relationship probability matrix calculated in step 2.5, the model weights are updated through back propagation, that is, the existing parameters are fine-tuned to make the model more suitable for the knowledge graph reasoning model;

[0029] Step 3: using the TransH model to depict the position information of the knowledge entities in the knowledge graph obtained in step 1, i.e. mapping all the knowledge entities in the knowledge graph into an N-dimensional vector space by the TransH model; each knowledge entity has a vector representation, and the L2 norm of any two knowledge entities is calculated by the vector representation, which represents the positional relationship of the knowledge entities in the vector space, and the smaller the value is, the closer the positions of the knowledge entities in the vector space are, and the larger the value is, the farther the positions of the knowledge entities in the vector space are;

[0030] Taking the triples in the knowledge graph as the data set for training the TransH model, the loss function is minimized; the output of the TransH model is the vector representation of the knowledge entities and the relationship in the vector space;

[0031] Step 3.1: constructing the data set required for training the TransH model; converting the knowledge entities and relationships in the knowledge graph obtained in step 1 into the form of triples <h, r, t> as the data set for training the TransH model;

[0032] The TransH model defines any two knowledge entities and the relationship between the entities in the knowledge graph obtained in step 1 as triples <h, r, t>, h and t represent the head node and the tail node respectively, and for each relationship r existing between the entities, there is a relationship vector d r and a hyperplane w r , i.e. embedding the entities and the relationship into different vector spaces; the score function of the model is:

[0033]

[0034] where h ⊥ represents the projection of the head node h on the hyperplane w r , t ⊥ represents the projection of the tail node t on the hyperplane w r , and the L2 norm (Euclidean norm) of the hyperplane w r is limited to 1, then the following formula is derived:

[0035]

[0036]

[0037] Step 3.2: initializing the parameters of the TransH model; in order to train the TransH model, all the parameters in the model need to be initialized, including the vector representation of the entities and the relationship, the projection matrix and the hyperparameters of the model, and the parameters are all taken as random values;

[0038] Step 3.3: Set the loss function of the TransH model; use the Margin-based Ranking Loss as the loss function, which improves the model's ability to distinguish knowledge entities by minimizing the distance between positive and negative samples, and the distance between samples is calculated by formula (2);

[0039] Step 3.4: Randomly sample the data set; randomly sample a portion of triples from the training data each time as training samples, including positive and negative samples; positive samples are known triples, and negative samples are randomly selected entities from all entities that are not connected to the positive samples, so that the model can better distinguish correct triples from incorrect triples;

[0040] Step 3.5: Update the parameters of the TransH model using gradient descent to minimize the loss function; that is, calculate the derivative of the loss function with respect to each parameter, which is used to update the parameters;

[0041] Repeat steps 3.4 and 3.5 to get the optimal parameters of the TransH model, and the output of the final model is the vector representation of the relationship between knowledge entities in the vector space;

[0042] Step 4: Fuse the semantic information and structural information of knowledge entities to perform the missing entity completion task, that is, calculate the score according to the L2 norm distance of entities in the TransH vector space and the relationship probability matrix output by the Bert model; the entity corresponding to the maximum score is the desired entity;

[0043] Step 4.1: Randomly select a knowledge entity from the knowledge graph created in step 1 as the known entity, randomly select one from the remaining knowledge entities as the predicted entity, and obtain the text description of the two knowledge entities;

[0044] Step 4.2: Query the vector representation of the two entities obtained in step 4.1 from the vector representation output in step 3, and calculate the L2 distance between the two entities when the relationship is any relationship in the knowledge graph in step 1 according to formula (2);

[0045] Step 4.3: Concatenate the text descriptions of the two entities according to step 2, digitize and input them into the Bert pre-training model to finally obtain the relationship probability matrix between the text descriptions of the two entities;

[0046] Step 4.4: Calculate the final score corresponding to each relationship according to formulas (5) and (6), and the relationship corresponding to the highest score is the desired relationship, and the predicted entity is the desired entity;

[0047]

[0048]

[0049] wherein, v1 represents the vector representation of the known entity in the TransH vector space, v2 represents the vector representation of the predicted entity in the TransH vector space, r represents any one relationship in the step 1 knowledge graph, l r Score (r) represents the score calculated according to formula (2) of the known entity, the predicted entity and the relationship r, sum (1) represents the sum of the scores of all relationships; R probar Score (r) represents the relationship probability matrix obtained in step 4.3, Score r Score (r) represents the final score corresponding to the relationship r, and the calculation of the score fuses the position information of the knowledge entity in the vector space and the semantic information of the text description of the knowledge entity.

[0050] The present application has the beneficial technical effects:

[0051] The present application analyzes the current demand for network security knowledge graph construction and network security knowledge reasoning, and designs a network security knowledge graph reasoning method based on a TransH-Bert model. The method analyzes the knowledge base in the Internet, constructs a basic network security knowledge graph, and further reasons the knowledge graph to generate a new knowledge graph. In the reasoning process, the knowledge entity Embedding output by the TransH model and the relationship probability matrix output by the Bert model are fused, so that the structural information of the knowledge and the semantic information of the knowledge are considered in the reasoning process, and the accuracy of the knowledge reasoning model is high. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 The present application is a kind of network security knowledge graph reasoning method based on TransH-Bert framework diagram of the embodiment of the application;

[0053] Figure 2 The network security knowledge graph obtained by the embodiment of the application is shown in the schematic diagram;

[0054] Figure 3 The present application is a kind of network security knowledge graph reasoning method based on TransH-Bert Bert model framework diagram of the embodiment of the application;

[0055] Figure 4 The sample array of the embodiment of the application is shown in the figure;

[0056] Figure 5 The present application is a kind of network security knowledge graph reasoning method based on TransH-Bert Bert model framework diagram of the embodiment of the application; DETAILED DESCRIPTION

[0057] The present application will be further described below in combination with the drawings and embodiments;

[0058] A network security knowledge graph reasoning method based on TransH-Bert, the overall framework is as shown in the accompanying Figure 1 The method comprises the following contents:

[0059] Step 1: Construct a network security knowledge graph; as shown in the accompanying Figure 2 The network security knowledge graph is stored in the Neo4j graph database in the form of triples.

[0060] Step 1.1: Prepare the Neo4j graph database environment; first, install the Neo4j graph database on the computer for storing the network security knowledge graph; turn off the firewall and system update function of the operating system;

[0061] Step 1.2: Use a python-based crawler tool to crawl the Common Vulnerabilities and Exposures (CVE) knowledge base, Common Attack Pattern Enumeration and Classification (CAPEC) knowledge base, and Common Weakness Enumeration (CWE) knowledge base from the network security knowledge base maintained by the mitre company; the crawling versions are CVE-2023, CWE4.10, and CAPEC3.9 respectively;

[0062] Step 1.3: Extract knowledge entities from the knowledge base and save them to a label-based graph database;

[0063] Step 1.3.1: Use Python to parse the CVE knowledge base and convert the knowledge in the CVE knowledge base into CVE knowledge nodes and relationships stored in the Neo4j graph database. The CVE knowledge node takes the CVE_ID in the CVE knowledge base as the entity ID, and extracts the description, references, cvssV3Score, and cvssV3Vector fields as the attributes of the CVE node.

[0064] Step 1.3.2: Use Python to parse the CWE knowledge base and convert the knowledge in the CWE knowledge base into CWE knowledge nodes and relationships stored in the Neo4j graph database. The CWE knowledge node takes the CWE_ID in the CWE knowledge base as the entity ID, and extracts the description and name fields as the attributes of the CWE node.

[0065] Step 1.3.3: Parse the CAPEC knowledge base using Python, convert the knowledge in the CAPEC knowledge base into CAPEC knowledge nodes and relationships, and store them in the Neo4j graph database; the CAPEC knowledge nodes take the CAPEC_ID in the CAPEC knowledge base as the entity ID, and extract the description and name fields as attributes of the CAPEC node;

[0066] Step 1.4: Extract the relationships between knowledge entities from the knowledge base and save them to the label-based graph database;

[0067] Step 1.4.1: Extract the Observed_Examples field in the CWE knowledge base to parse the relationship between the CVE entity and the CWE entity;

[0068] Step 1.4.2: Extract the Related_Weaknesses field in the CWE knowledge base to parse the relationship between the CWE entity and the CWE entity;

[0069] Step 1.4.3: Extract the Related_Attack_Patterns field in the CAPEC knowledge base to parse the relationship between the CAPEC entity and the CAPEC entity;

[0070] Step 1.4.4: Extract the Related_Weaknesses field in the CAPEC knowledge base to parse the relationship between the CAPEC entity and the CWE entity;

[0071] Step 1.4.5: Save all the parsed relationships to the Neo4j graph database;

[0072] Step 2: Based on Step 1, use the Bert pre-training model to obtain the relationship between the text descriptions of the knowledge entities in the knowledge graph, i.e. based on the text description of the knowledge entity, use the Bert model to calculate the relationship probability matrix between the knowledge entities;

[0073] Step 2.1: Download the Bert pre-training model, and convert the text description of the knowledge entity in the knowledge graph obtained in Step 1 from string form to array form according to the parameters of the Bert pre-training model;

[0074] Step 2.2: Construct the input data of the Bert pre-training model, and concatenate the text descriptions of any two knowledge entities in the knowledge graph obtained in Step 1 according to the following formula to obtain the sample, [CLS] represents the sample actual identifier, and [SEP] represents the data separator and end symbol;

[0075] [CLS]sentence1[SEPIsentence2[SEPI(7)

[0076] Step 2.3: According to the types of relations in the knowledge graph obtained in step 1, the relation between the two entities in step 2.2 is converted into one-hot encoding as the label of the sample. The final one-hot encoding is ChildOf: [1, 0, 0, 0, 0, 0, 0, 0], ParentOf: [0, 1, 0, 0, 0, 0, 0, 0], Canfollow: [0, 0, 1, 0, 0, 0, 0, 0], CanPrecede: [0, 0, 0, 1, 0, 0, 0, 0], PeerOf: [0, 0, 0, 0, 1, 0, 0, 0], belongOf: [0, 0, 0, 0, 0, 1, 0, 0], attackOf: [0, 0, 0, 0, 0, 0, 1, 0], contardiction: [0, 0, 0, 0, 0, 0, 0, 1].

[0077] Step 2.4: Digitize the spliced sample, as shown in the following figure: Figure 4 All samples need to be converted into index arrays input_ids with a length of LEN. If the sample length is less than LEN, 0s are added at the end of the sample. To distinguish between useful data and useless data in the input_ids array, an input_mask array needs to be generated based on input_ids. The generation rule is that the invalid part of the sample is set to 0 and the valid part is set to 1. The part set to 0 will be ignored during training. To distinguish between different sentence segments in the sample, a segment_ids array needs to be generated based on input_ids. The generation rule is that the first sentence is filled with 0 and the second sentence is filled with 1. When the sample length is less than LEN, 0s are used to fill the end. segment_ids, input_mask, and input_ids are the inputs of the Bert pre-training model.

[0078] Step 2.5: input the input_ids, input_mask, and segment_ids arrays constructed in step 2.4 into the Bert pre-training model, then input the model's output pooled representation into the Dropout layer to prevent model overfitting, then input the Dropout layer's output into the softmax layer to get the relation probability matrix. After the sample is input into the Bert model, the encoding operation will be performed. The bidirectional Attention mechanism in the Bert model allows the two sentences in the sample to Attention to each other. Through training, the relation type that may exist between the two sentences will be learned.

[0079] To prevent overfitting, a Dropout operation of 0.1 needs to be performed after obtaining the final encoding of the sample, and the result of Dropout is input to a fully connected layer, which reduces the dimension to 8 through the fully connected layer. The dimension is set to 8 because there are 7 possible relationships between knowledge entities, i.e. ChildOf, ParentOf, Canfollow, CanPrecede, PeerOf, belongOf, attackOf, and an additional relationship contardiction is needed to represent that there is no relationship between two knowledge entities. After the output of the fully connected layer, the probability corresponding to each relationship is calculated by softmax. For example, the probability of the relationship childOf in the output result shown in FIG. 8 is 0.6, which is much larger than the probability of other relationships. Therefore, from the semantic level, the relationship between the text descriptions of the two input entities is most likely to be the childOf relationship. Finally, this probability will be used to fuse the output of the TransH model to obtain the final prediction result. Figure 3

[0080] Step 2.6: Fine-tuning the Bert pre-training model. Since the Bert pre-training model has been trained based on a large corpus to obtain a set of parameters, this set of parameters can be obtained from github, and using this set of parameters as the starting point of model training can effectively improve the training efficiency. In order to make the model more suitable for the knowledge reasoning task of the knowledge graph constructed in step 1, the relationship probability matrix calculated in step 2.5 is used to update the weight of the model through back propagation based on the already trained parameters, that is, the existing parameters are fine-tuned to make the model more suitable for the knowledge graph reasoning model. After 75 iterations, the loss value of the model stabilizes at about 0.02, indicating that the model has converged.

[0081] Step 3: Use the TransH model to depict the position information of the knowledge entities in the knowledge graph obtained in step 1, that is, map all knowledge entities in the knowledge graph to an N-dimensional vector space through the TransH model, and set N to 50 in the present application. Each knowledge entity has a vector representation, and the L2 norm of any two knowledge entities can be calculated through the vector representation. The value represents the positional relationship of the knowledge entities in the vector space. The smaller the value, the closer the knowledge entities are in the vector space, and the larger the value, the farther the knowledge entities are in the vector space.

[0082] The TransH model defines any two knowledge entities and the relationship between the entities in the knowledge graph obtained in step 1 as a triple <h, r, t>, where h and t represent the head node and the tail node, respectively. For each relationship r that exists between entities, there is a relationship vector d r and a hyperplane w r ​TransE, i.e., embedding entities and relations into different vector spaces. The scoring function of this model is:

[0083]

[0084] h ⊥ denotes the projection of the head node h onto the hyperplane w r , t ⊥ denotes the projection of the tail node t onto the hyperplane w r , and the L2 norm (Euclidean norm) of the hyperplane w r is 1, i.e., The following formula can be derived

[0085]

[0086]

[0087] The triples in the knowledge graph are used as the training data set for the TransH model, and the scoring function is minimized. The output of the TransH model is the vector representation of knowledge entities and relations in the vector space;

[0088] Step 3.1: Construct the data set required for training the TransH model. The knowledge entities and relations in the knowledge graph obtained in step 1 are converted into triples <h, r, t> form as the training data set for the TransH model.

[0089] Step 3.2: Initialize the parameters of the TransH model. In order to train the TransH model, all the parameters in the model need to be initialized, including the vector representation of entities and relations, the projection matrix, and the hyperparameters of the model. In this invention, these parameters are all taken as random values.

[0090] Step 3.3: Set the loss function of the TransH model. The goal of the TransH model is to minimize the prediction error of the model, so a suitable loss function needs to be defined to measure the prediction error of the model. This invention uses Margin-based Ranking Loss as the loss function, which improves the ability of the model to distinguish knowledge entities by minimizing the distance between positive samples and negative samples. The distance between samples can be calculated by formula (8).

[0091] Step 3.4: Random sampling. In order to improve the efficiency and effectiveness of the TransH model training, random sampling of the data set is usually required. Specifically, a portion of triples is randomly selected from the training data as training samples each time, including positive samples and negative samples. Positive samples are known triples, while negative samples are randomly selected entities from all entities that are not connected to the positive samples, so as to train the model to better distinguish correct triples from incorrect triples.

[0092] Steps 3.4 and 3.5 are repeated to obtain the optimal parameters of the TransH model, and the output of the final model is the vector representation of the relationship of the knowledge entity in the vector space. After 3000 iterations, the loss value of the model stabilizes at about 0.02, indicating that the model has converged.

[0093] Step 4: Fuse the semantic information and structural information of the knowledge entity to perform the missing entity completion task, i.e. calculate the score according to the L2 norm distance of the entity in the TransH vector space and the relationship probability matrix output by the Bert model; the entity with the maximum score is the expected entity.

[0094] Step 4.1: Randomly select a knowledge entity from the knowledge graph created in step 1 as the known entity, randomly select one from the remaining knowledge entities as the predicted entity, and obtain the text description corresponding to the two knowledge entities.

[0095] Step 4.2: Query the vector representation of the two entities obtained in step 4.1 from the vector representation output in step 3, and calculate the L2 distance between the two entities when the relationship is any relationship in the knowledge graph in step 1 according to formula (2).

[0096] Step 4.3: Concatenate the text descriptions of the two entities according to step 2, digitize and input them into the Bert pre-training model to finally obtain the relationship probability matrix between the text descriptions of the two entities.

[0097] Step 4.4: Calculate the final score corresponding to each relationship according to formulas (5) and (6), and the relationship corresponding to the highest score is the expected relationship, and the predicted entity is the expected entity.

[0098]

[0099]

[0100] v1 represents the vector representation of the known entity in the TransH vector space, v2 represents the vector representation of the predicted entity in the TransH vector space, r represents any relationship in the knowledge graph in step 1, l r represents the score calculated according to formula (2) for the known entity, the predicted entity and the relationship r, sum(1) represents the sum of the scores of all relationships. probar represents the relationship probability matrix obtained in step 4.3, Score r represents the final score corresponding to the relationship r, which combines the position information of the knowledge entity in the vector space and the semantic information of the text description of the knowledge entity.

[0101] Step 5: In order to evaluate the quality of new knowledge obtained by knowledge reasoning, indicators such as Hits@3, Hits@5, Hits@10, MRR, MR and the like need to be used for evaluation. In the present application, the Hits@10 indicator and the MRR indicator are used for evaluation; Hits@10 represents the average proportion of scores ranked less than 10, the value range of which is (0, 1), and the larger the value, the better the model effect; MRR represents the reciprocal ranking of a tie, the value range of which is (0, 1), and the larger the value, the better the model effect.

[0102] As shown in the accompanying Figure 5 Fig. 6, comparison of the Hits@10 and MRR indicators of the TransH-Bert model with the TransE, TransH, mTransH and TransR models shows that the MRR indicator of the TransH-Bert model is 0.032 higher than that of the TransE model, 0.023 higher than that of the TransH model, 0.018 higher than that of the mTransH model and 0.014 higher than that of the TransR model. The Hits@10 indicator of the TransH-Bert model is 0.079 higher than that of the TransE model, 0.062 higher than that of the TransH model, 0.041 higher than that of the mTransH model and 0.045 higher than that of the TransR model. In summary, the TransH-Bert model has higher accuracy when performing the missing entity completion task.

Claims

1. A network security knowledge graph reasoning method based on TransH-Bert, characterized in that, Specifically comprising the following steps: Step 1: Construct a network security knowledge graph, and store it in the form of triples in a label-based graph database; Step 2: Based on step 1, use the Bert pre-training model to obtain the relationship between the text descriptions of the knowledge entities in the knowledge graph, that is, based on the text description of the knowledge entity, and then calculate the relationship probability matrix between the knowledge entities through the Bert pre-training model; Step 3: Use the TransH model to depict the position information of the knowledge entities in the knowledge graph obtained in step 1, that is, map all knowledge entities in the knowledge graph to an N-dimensional vector space through the TransH model; Each knowledge entity has a vector representation, and the L2 norm of any two knowledge entities is calculated through the vector representation, which represents the positional relationship of the knowledge entities in the vector space. The smaller the value, the closer the knowledge entities are in the vector space, and the larger the value, the farther the knowledge entities are in the vector space; Take the triples in the knowledge graph as the data set for training the TransH model to minimize the loss function; The output of the TransH model is the vector representation of the knowledge entity and the relationship in the vector space; Step 4: Fuse the semantic information and structural information of the knowledge entity to perform the missing entity completion task, that is, calculate the score according to the L2 norm distance of the entity in the TransH vector space and the relationship probability matrix output by the Bert model; The entity corresponding to the maximum score is the desired entity.

2. The network security knowledge graph reasoning method based on TransH-Bert according to claim 1, characterized in that, Step 1 is specifically: Step 1.1: Prepare the graph database environment; First, install a graph database on the computer for storing the network security knowledge graph; And close the firewall and system update function of the operating system; Step 1.2: Use a crawler tool to crawl the Common Vulnerabilities and Exposures (CVE) knowledge base, Common Attack Pattern Enumeration and Classification (CAPEC) knowledge base, and Common Weakness Enumeration (CWE) knowledge base from the network security knowledge base; Step 1.3: Extract the knowledge entities from the knowledge base and save them to the label-based graph database; Step 1.4: Extract the relationship between knowledge entities from the knowledge base and save it to the label-based graph database.

3. The network security knowledge graph reasoning method based on TransH-Bert according to claim 2, characterized in that, Step 1.3 is specifically: Step 1.3.1: Parse the CVE knowledge base, convert the knowledge in the CVE knowledge base into CVE knowledge nodes, and store them in the label-based graph database; The CVE knowledge node takes the CVE_ID in the CVE knowledge base as the entity ID, and extracts the description, references, cvssV3Score and cvssV3Vector fields as the attributes of the CVE node; Step 1.3.2: Parse the CWE knowledge base, convert the knowledge in the CWE knowledge base into CWE knowledge nodes, and store them in the label-based graph database; The CWE knowledge node takes the CWE_ID in the CWE knowledge base as the entity ID, and extracts the description and name fields as the attributes of the CWE node. Step 1.3.3: Analyze the CAPEC knowledge base, and convert the knowledge in the CAPEC knowledge base into CAPEC knowledge nodes and store them in the tag-based graph database; the CAPEC knowledge node takes the CAPEC_ID in the CAPEC knowledge base as the entity ID, and extracts the description and name fields as the attributes of the CAPEC node.

4. The network security knowledge graph reasoning method based on TransH-Bert according to claim 2, characterized in that, Step 1.4 is specifically: Step 1.4.1: Extract the Observed_Examples field in the CWE knowledge base to parse the relationship between the CVE entity and the CWE entity; Step 1.4.2: Extract the Related_Weaknesses field in the CWE knowledge base to parse the relationship between the CWE entity and the CWE entity; Step 1.4.3: Extract the Related_Attack_Patterns field in the CAPEC knowledge base to parse the relationship between the CAPEC entity and the CAPEC entity; Step 1.4.4: Extract the Related_Weaknesses field in the CAPEC knowledge base to parse the relationship between the CAPEC entity and the CWE entity; Step 1.4.5: Save all the parsed relationships to the tag-based graph database.

5. The network security knowledge graph reasoning method based on TransH-Bert according to claim 1, characterized in that, Step 2 is specifically: Step 2.1: Download the Bert pre-training model, and convert the text description of the knowledge entity in the knowledge graph obtained in step 1 from a string form to an array form according to the parameters of the Bert pre-training model; Step 2.2: Construct the input data of the Bert pre-training model; splice the text description of any two knowledge entities in the knowledge graph obtained in step 1 according to the following formula to obtain a sample, wherein [CLS] represents the actual identifier of the sample, and [SEP] represents the separator and end symbol of the data; [CLS]sentence1[SEP]sentence2[SEP] (1) Step 2.3: Based on the types of relationships in the knowledge graph obtained in step 1, convert the relationship between the two entities in step 2.2 into one-hot encoding as the label of the sample; Step 2.4: Digitize the spliced sample, construct input_ids, input_mask and segment_ids arrays, and then input them into the Bert pre-training model; first, define the maximum length of the sample LEN, if the sample length exceeds LEN, the data exceeding LEN will be lost, then convert all samples into index arrays input_ids with a length of LEN, if the sample length is less than LEN, 0 will be added at the end of the sample; in order to distinguish between useful data and useless data in the input_ids array, input_mask array needs to be generated according to input_ids, where the invalid part of the sample is set to 0 and the valid part is set to 1, the part set to 0 will be ignored during training; in order to distinguish different sentence segments in the sample, segment_ids array needs to be generated according to input_ids, where the first sentence is filled with 0 and the second sentence is filled with 1, and 0 is used to fill the end when the sample length is less than LEN; Step 2.5: input the input_ids, input_mask and segment_ids arrays constructed in step 2.4 into the Bert pre-training model, then input the output pooling representation of the model into the Dropout layer to prevent model overfitting, and then input the output of the Dropout layer into the softmax layer to get the relationship probability matrix; Step 2.6: Based on the parameters of the Bert pre-training model that have been trained and the relationship probability matrix calculated in step 2.5, update the weights of the model through back propagation, that is, fine-tune the existing parameters to make the model more suitable for the knowledge graph reasoning model.

6. The network security knowledge graph reasoning method based on TransH-Bert according to claim 1, characterized in that, Step 3 is as follows: Step 3.1: Construct the data set required for TransH model training; convert the knowledge entities and relationships in the knowledge graph obtained in step 1 into the form of triplets <h, r, t> as the data set for training the TransH model; The TransH model defines any two knowledge entities and the relationship between the entities in the knowledge graph obtained in step 1 as a triple <h, r, t>, h and t represent the head node and the tail node respectively, and for each relationship r existing between the entities, there is a relationship vector d r and a hyperplane w r , that is, the entities and the relationship are embedded into different vector spaces; the score function of the model is: where h ⊥ denotes the projection of the head node h onto the hyperplane w r denotes the projection of the tail node t onto the hyperplane w ⊥ denotes the projection of the tail node t onto the hyperplane w r limits the L2 norm (Euclidean norm) of the hyperplane w r to 1, The following formula is derived when Step 3.2: Initialize the parameters of the TransH model; in order to train the TransH model, all parameters in the model need to be initialized, including the vector representation of entities and relationships, projection matrix and model hyperparameters, and these parameters are all taken as random values; Step 3.3: Set the loss function of the TransH model; use Margin-based Ranking Loss as the loss function, which improves the model's ability to distinguish knowledge entities by minimizing the distance between positive samples and negative samples, the distance between samples is calculated by formula (2); Step 3.4: Randomly sample the data set; Randomly select a part of triplets from the training data as training samples each time, which includes positive samples and negative samples; the positive sample is the known triplet, and the negative sample is the entity randomly selected from all entities which is not connected with the positive sample, so as to train the model to better distinguish correct triplets from incorrect triplets; Step 3.5: Update the parameters of the TransH model using the gradient descent method to minimize the loss function; that is, calculate the derivative of the loss function with respect to each parameter, which is used to update the parameters; Repeat steps 3.4 and 3.5 to obtain the optimal parameters of the TransH model, and the output of the final model is the vector representation of the relationship between knowledge entities in the vector space.

7. The network security knowledge graph reasoning method based on TransH-Bert according to claim 1, characterized in that, Step 4 is specifically: Step 4.1: Randomly select a knowledge entity from the knowledge graph created in step 1 as the known entity, randomly select one from the remaining knowledge entities as the predicted entity, and obtain the text description corresponding to the two knowledge entities; Step 4.2: Query the vector representation of the two entities obtained in step 4.1 from the vector representation output in step 3, and calculate the L2 distance between the two entities when the relationship is any relationship in the knowledge graph in step 1 according to formula (2); Step 4.3: The text descriptions of the two entities are concatenated and digitized according to step 2 and input into the Bert pre-training model to finally obtain the relationship probability matrix between the text descriptions of the two entities; Step 4.4: Calculate the final scores corresponding to various relationships according to formulas (5) and (6), and the relationship corresponding to the highest score is the expected relationship, and the predicted entity is the expected entity; where v1 represents the vector representation of the known entity in the TransH vector space, v2 represents the vector representation of the predicted entity in the TransH vector space, r represents any one of the relationships in the knowledge graph in step 1, and l r represents the score of the known entity, the predicted entity and the relationship r calculated according to formula (2), and sum(1) represents the sum of the scores of all relationships; R probar represents the relationship probability matrix obtained in step 4.3, Score r represents the final score corresponding to the relationship r, and the calculation of the score fuses the position information of the knowledge entity in the vector space and the semantic information of the text description of the knowledge entity.

Images