A secure entity knowledge graph relationship reasoning method and device

Abstract

The embodiment of the application provides a kind of security entity knowledge graph relationship reasoning method and device, it is related to threat detection technical field.The method includes constructing security entity triple based on threat intelligence log;Fact data and counterfactual data are obtained based on the security entity triple;According to the fact data and counterfactual data, obtain positive sample data and negative sample data;The positive sample data and negative sample data are respectively input into the prediction model pre-trained, and the probability that positive and negative samples exist is obtained.The method uses counterfactual data to enhance the expression ability in the field of knowledge graph, and then improves the relationship prediction ability on the security knowledge graph, can mine the implicit relationship of security knowledge graph, solve the problem that existing method lacks the prediction ability of counterfactual data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of threat detection, in particular to a security entity knowledge graph relationship reasoning method and device. BACKGROUND

[0002] With the continuous development of the network security field, intelligence information related to network security presents a diversified and massive growth. How to mine, discover and deduce relevant hidden knowledge or new knowledge from such semantic data structures is the focus of threat intelligence analysis research. Relationship reasoning based on graph learning can convert multi-source heterogeneous unstructured text into reliable security intelligence knowledge, providing decision support for deeper analysis.

[0003] Existing methods such as using the SANC model use WGCN to learn the embedding of entities and relationships in the first half, and use Conv-TransE to learn the relationship between entities and relationships in the second half, but this method lacks the ability to predict counterfactual data. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a security entity knowledge graph relationship reasoning method and device, which enhances the expressiveness of the knowledge graph field using counterfactual data, thereby improving the relationship prediction ability on the security knowledge graph, and can mine the implicit relationships of the security knowledge graph, solving the problem of the lack of prediction ability of counterfactual data in existing methods.

[0005] The embodiments of the present application provide a security entity knowledge graph relationship reasoning method, which comprises:

[0006] Constructing a security entity triple based on threat intelligence logs;

[0007] Obtaining factual data and counterfactual data based on the security entity triple;

[0008] Obtaining positive sample data and negative sample data according to the factual data and counterfactual data;

[0009] Inputting the positive sample data and negative sample data into a pre-trained prediction model respectively to obtain the probability of existence of the positive and negative samples.

[0010] In the above implementation process, the method introduces counterfactual data enhancement technology, thereby enhancing the expressiveness of the knowledge graph field, and further improving the relationship prediction ability on the security knowledge graph, which can mine the implicit relationships of the security knowledge graph, solving the problem of the lack of prediction ability of counterfactual data in existing methods.

[0011] Further, the obtaining of factual data and counterfactual data based on the security entity triple comprises:

[0012] determine whether (h, t) belongs to the same community in the case of a given relationship r or 1, to obtain factual data, the safe entity triple is represented as (h, r, t);

[0013] In the case of a given relationship r, obtain two pairs of entities (h', t') similar to (h, t), and determine whether they belong to the same community:

[0014] If Then the two pairs of entities (h', t') constitute counterfactual data of entity (h, t), represented as

[0015] In the above implementation process, factual data and counterfactual data are obtained to obtain positive and negative sample data according to the factual data and the counterfactual data.

[0016] Further, the method further comprises:

[0017] In the case of (h, t), obtain the triple positive sample (h, r, t) and the triple negative sample (h, r, t') that do not exist in the safe entity knowledge graph;

[0018] Convert the triple positive sample and the triple negative sample into vectors, and form positive sample data with the factual data and the counterfactual data and negative sample data

[0019] In the above implementation process, the positive and negative sample data are obtained by using the factual data and the counterfactual data, so as to apply the counterfactual data to the model prediction and improve the prediction ability of the model to the counterfactual data.

[0020] Further, before the step of inputting the positive sample data and the negative sample data into the pre-trained prediction model to obtain the probability of existence of the positive and negative samples, the method further comprises:

[0021] Construct the prediction model;

[0022] Set the model loss function, and optimize the prediction model by using the model loss function.

[0023] In the above implementation process, the prediction model is trained and optimized by using the model loss function, so that the performance of the model reaches the optimal.

[0024] Further, the method further comprises:

[0025] The SANC architecture model is constructed by using a WGCN encoder and a Conv-TransE decoder, and the Conv-TransE decoder is provided with two layers of multilayer perceptrons.

[0026] In the implementation process, the SANC architecture model is improved by using a multilayer perceptron.

[0027] Further, the model loss function is set, including:

[0028] The loss of factual data is represented as:

[0029]

[0030] The loss of counterfactual data is represented as:

[0031]

[0032] Wherein, P F represents the predicted probability of the factual data, and the probability that the obtained triple exists; P CF represents the predicted probability of the counterfactual data.

[0033] The two-norm distance is calculated as:

[0034] L disc =disc(P F ,P CF );

[0035] Based on the loss of the factual data, the loss of the counterfactual data, and the two-norm distance, a loss function is generated:

[0036] L=βL disc +αL CF +L F ;

[0037] Wherein, beta and alpha are respectively preset values.

[0038] In the implementation process, the model loss function is constructed to optimize the prediction model and improve the accuracy of the prediction result.

[0039] The embodiment of the application also provides a security entity knowledge graph relationship reasoning device, the device comprises:

[0040] A triple construction module is configured to construct a security entity triple based on a threat intelligence log.

[0041] A counterfactual data acquisition module is configured to acquire factual data and counterfactual data based on the security entity triple.

[0042] A positive sample data acquisition module is configured to acquire positive sample data and negative sample data according to the factual data and the counterfactual data.

[0043] A probability calculation module is configured to input the positive sample data and the negative sample data into a pre-trained prediction model respectively, and obtain probabilities of existence of the positive sample data and the negative sample data.

[0044] In the implementation process, the counterfactual data augmentation technology is introduced, so that the expression ability of the knowledge graph field is enhanced, and the relationship prediction ability on the safety knowledge graph is improved. The hidden relationship of the safety knowledge graph can be mined, and the problem that the existing method lacks the prediction ability for counterfactual data is solved.

[0045] Further, the counterfactual data acquisition module comprises:

[0046] A factual data acquisition module is configured to determine whether (h, t) belongs to the same community in the case of a given relationship r or 1, to acquire factual data, and the safety entity triple is represented as (h, r, t);

[0047] A counterfactual data determination module is configured to acquire two pairs of entities (h', t') similar to (h, t) in the case of a given relationship r, and determine whether they belong to the same community:

[0048] If then the two pairs of entities (h', t') constitute counterfactual data of the entity (h, t), and are represented as

[0049] In the implementation process, the factual data and the counterfactual data are acquired, so as to acquire the positive sample data and the negative sample data according to the factual data and the counterfactual data.

[0050] Embodiments of the present application also provide an electronic device, which comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to make the electronic device execute the safety entity knowledge graph relationship reasoning method in any one of the above.

[0051] Embodiments of the present application also provide a readable storage medium, which stores computer program instructions, and the computer program instructions are read and run by a processor to execute the safety entity knowledge graph relationship reasoning method in any one of the above. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those of ordinary skill in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0053] Figure 1 The flow chart of the safety entity knowledge graph relationship reasoning method provided by the embodiments of the present application;

[0054] Figure 2 The specific implementation flow chart of the safety entity knowledge graph relationship reasoning method provided by the embodiments of the present application;

[0055] Figure 3 The flow chart of the acquisition of counterfactual data provided by the embodiments of the present application;

[0056] Figure 4 The flow chart of the acquisition of positive and negative sample data provided by the embodiments of the present application;

[0057] Figure 5 The flow chart of the model training provided by the embodiments of the present application;

[0058] Figure 6 The flow chart of the setting of the model loss function provided by the embodiments of the present application;

[0059] Figure 7 The structural block diagram of the safety entity knowledge graph relationship reasoning device provided by the embodiments of the present application;

[0060] Figure 8 The structural block diagram of another safety entity knowledge graph relationship reasoning device provided by the embodiments of the present application.

[0061] Icon:

[0062] 100-triple construction module; 200-counterfactual data acquisition module; 201-factual data acquisition module; 202-counterfactual data judgment module; 300-positive and negative sample data acquisition module; 301-positive and negative sample acquisition module; 302-positive and negative sample data generation module; 400-probability calculation module; 410-model training module. DETAILED DESCRIPTION

[0063] The technical solutions in the embodiments of the present application will be described below in combination with the drawings in the embodiments of the present application.

[0064] It should be noted that similar reference numerals and letters refer to like items in the accompanying drawings, and once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Also, in the description of the present application, the terms "first", "second", and the like are used only to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0065] Embodiment 1

[0066] Please refer to Figure 1 , Figure 1 A flowchart of a security entity knowledge graph relationship reasoning method provided by the embodiment of the present application. The present application enhances the expression ability of the knowledge graph field using counterfactual data, solves the problem of only being able to express single homogeneous graph expression ability, enhances the link prediction ability of the SANC model through counterfactual data, and solves the problem of the SANC model lacking prediction ability for counterfactual data.

[0067] The method specifically includes the following steps:

[0068] Step S100: constructing a security entity triple based on a threat intelligence log;

[0069] From the threat intelligence log, extract keywords to construct a security entity triple (h, r, t). For example, from the log, a triple is proposed: Threat actor (hacker, head entity h), uses (relationship entity r), and Tool (tail entity t). Multiple security entity triples constitute a security knowledge graph.

[0070] Step S200: obtaining fact data and counterfactual data based on the security entity triple;

[0071] Step S300: obtaining positive sample data and negative sample data according to the fact data and the counterfactual data;

[0072] Step S400: inputting the positive sample data and the negative sample data into a pre-trained prediction model respectively to obtain the probability of existence of the positive and negative samples.

[0073] As Figure 2 shown, it is a specific implementation flowchart of the security entity knowledge graph relationship reasoning method. As Figure 3 shown, it is a flowchart of obtaining counterfactual data, and step S200 specifically includes the following steps:

[0074] Step S201: judging whether (h, t) belongs to the same community or not in the case of a given relationship r or 1 to obtain fact data, and the security entity triple is represented as (h, r, t);

[0075] Whether to belong to the same community can be determined by using a k-core community discovery algorithm, which is not described in detail here.

[0076] Step S202: In the case of a given relationship r, two pairs of entities (h', t') similar to (h, t) are obtained, and it is determined whether they belong to the same community: if then the two pairs of entities (h', t') constitute counterfactual data of the entity (h, t), denoted as

[0077] In the case of a given relationship r, two entities (h', t') similar to (h, t) are found, that is, the embedding of the entity is calculated under the given relationship r using an unsupervised algorithm such as node2vec, that is, the two-norm distance between entities is calculated, and the smaller the distance, the more similar they are; Then, it is determined whether they belong to the same community (such as using a k-core community discovery algorithm), if then the two pairs of entities (h', t') constitute counterfactual data of the entity (h, t).

[0078] Let that is, the counterfactual data of the entity (h, t) under the given r is obtained.

[0079] As shown in FIG. 3, Figure 4 the flowchart of obtaining positive and negative sample data, step S300 specifically includes the following steps:

[0080] Step S301: In the case of (h, t), obtain the existing triple positive sample (h, r, t) and the non-existing triple negative sample (h, r, t') in the security entity knowledge graph;

[0081] Step S302: Convert the triple positive sample and the triple negative sample into vectors, and construct positive sample data and negative sample data

[0082] As shown in FIG. 4, Figure 5 the flowchart of model training, the method further includes:

[0083] Step S410: Constructing the prediction model;

[0084] The SANC architecture model is constructed by using the WGCN encoder and the Conv-TransE decoder, and the Conv-TransE decoder is connected with two layers of multilayer perceptron.

[0085] The prediction model uses a SANC architecture model, a WGCN (weight graph convolution network) as an encoder, and a Conv-TransE as a decoder, wherein the Conv-TransE is followed by two layers of multilayer perceptron, and finally outputs a probability P that (h, r, t) exists. The greater the probability value is, the higher the existence possibility is. P includes the prediction probability of the fact and counter-fact data, and is represented as P F CF .

[0086] Step S420: setting a model loss function, and optimizing the prediction model by using the model loss function.

[0087] As shown in FIG. 8, it is a flow chart for setting the model loss function, and the setting of the model loss function in step S420 specifically includes: Figure 6

[0088] Step S421: representing the loss of the fact data as:

[0089]

[0090] wherein P represents the probability that the output triplets exist after inputting the positive sample data and the corresponding fact data thereof; represents the probability that the output triplets exist after inputting the negative sample data and the corresponding fact data thereof.

[0091] Step S422: representing the loss of the counter-fact data as:

[0092]

[0093] wherein P F represents the prediction probability of the fact data; and P CF represents the prediction probability of the counter-fact data.

[0094] Step S423: calculating the two-norm distance as:

[0095] L disc = disc(P F , P CF );

[0096] disc is the two-norm distance between them, and the purpose is to narrow the distance between the fact data and the counter-fact data, because the test set only contains fact data, and if it is not narrowed, it will cause the covariate shift.

[0097] Step S424: generating a loss function based on the loss of the fact data, the loss of the counter-fact data, and the two-norm distance:

[0098] ​​L = βL disc + αL CF + L F ;

[0099] Wherein, beta, alpha are preset values respectively.

[0100] In step S400, the input of the prediction model is positive sample data and negative sample data The output of the prediction model is the probability of the existence of the triplet positive sample (h, r, t), the closer to 1, the greater the probability of existence; and the probability of the existence of the triplet negative sample (h, r, t'), the closer to 0, the greater the probability of nonexistence.

[0101] In the specific implementation process of the method, a network security field relationship reasoning data set can be constructed. For example, the data set contains 330 samples, of which 270 are training sets, 30 are test sets, and 30 are verification sets. The method described in the application is compared with NBFNet (Neural Bellman-Ford Networks) on this data set, and from the experimental results, it can be seen that the HITS@10 of NBFNet on this data set is 0.502, while the application achieves the optimal performance of SOTA (state of the art), and the HITS@10 is 0.528.

[0102] The training data is input into the prediction model for training, and the loss function is used for model optimization, so that the probability of the triplet positive sample is greater, and the probability of the triplet negative sample is smaller.

[0103] For example, the method can use security logs to build a security knowledge graph, and when performing relationship reasoning, use the above method to construct counterfactual data, then input the SANC prediction model, and finally verify the indicators on the test set, such as mr, mrr, hits@k, etc. Specifically:

[0104] Step S11: Constructing a triplet (h, r, t). According to the STIX security entity standard, extract the security entity triplet (h, r, t) from the threat intelligence log, and construct a security knowledge graph;

[0105] Step S12: Obtain counterfactual data. Obtain counterfactual data (Henbox, targets, Google), find two entities (Henbox, Google) similar to (Henbox, Wechat) through the K-core community discovery algorithm according to the size of the embedding, the smaller the embedding value, the more similar, but they do not belong to the same community, that is Similarly, obtain the fact data and counterfactual data of negative samples (Henbox, targets, Google)

[0106] Step S13: Construct training data. Given the head entity and relationship of (Henbox, targets) to be trained, obtain the existing triple positive sample (Henbox, targets, Wechat) and the non-existing triple negative sample (Henbox, targets, Google), and combine them with counterfactual data and fact data, that is {(Henbox, targets, Wechat), (Henbox, targets, Google), } and {(Henbox, targets, Wechat), (Henbox, targets, Google), }.

[0107] Step S14: Model training. Input the training data in step S13 into the link prediction model described in the present application for training, so that the model outputs the probability of (Henbox, targets, Wechat) existing is greater, and the probability of (Henbox, targets, Google) existing is smaller.

[0108] Step S15: Model prediction. The user inputs entity a and relationship name b, and the link prediction model outputs the predicted entity c having relationship b with entity a, constituting a new triple <a, b, c>.

[0109] Compared with the existing method, the method enhances the field expression capability of the knowledge graph by introducing the counterfactual data enhancement technology on the SANC model architecture, thereby improving the relationship prediction capability on the safety knowledge graph, and can mine the implicit relationship of the safety knowledge graph; and the experimental verification is carried out on the constructed safety knowledge graph dataset, compared with the current SOTA algorithm, the method described in the present application increases 0.26 on HITS@10.

[0110] Embodiment 2

[0111] The embodiment of the present application provides a safety entity knowledge graph relationship reasoning device, which is applied to the safety entity knowledge graph relationship reasoning method described in embodiment 1, as shown in Figure 7 , it is a structural block diagram of a safety entity knowledge graph relationship reasoning device. The device improves the connection prediction capability of the safety knowledge graph by introducing the counterfactual data enhancement technology on the SANC model architecture.

[0112] The device includes but is not limited to:

[0113] Triple construction module 100 is used to construct security entity triples based on threat intelligence logs;

[0114] The counterfactual data acquisition module 200 is used to acquire factual data and counterfactual data based on the security entity triplet.

[0115] The positive and negative sample data acquisition module 300 is used to acquire positive sample data and negative sample data based on the factual data and counterfactual data.

[0116] The probability calculation module 400 is used to input the positive sample data and negative sample data into a pre-trained prediction model to obtain the probability of the existence of positive and negative samples.

[0117] like Figure 8 The diagram shown is a structural block diagram of another secure entity knowledge graph relation reasoning device, wherein the counterfactual data acquisition module 200 includes:

[0118] The fact data acquisition module 201 is used to determine whether (h,t) belong to the same community given a relation r. Or 1, to obtain factual data, the security entity triple is represented as (h,r,t);

[0119] The counterfactual data judgment module 202 is used to obtain two pairs of entities (h′,t′) that are similar to (h,t) given a relation r, and to determine whether they belong to the same community:

[0120] like Then the two pairs of entities (h′,t′) constitute the counterfactual data of entity (h,t), represented as:

[0121] The positive and negative sample data acquisition module 300 includes:

[0122] The positive and negative sample acquisition module 301 is used to acquire, given (h,t), existing triple positive samples (h,r,t) and non-existent triple negative samples (h,r,t′) in the security entity knowledge graph;

[0123] The positive and negative sample data generation module 302 is used to convert the triplet positive samples and the triplet negative samples into vectors, and to form positive sample data together with the factual data and counterfactual data. and negative sample data

[0124] The method also includes a model training module 410 for constructing the prediction model; setting a model loss function; and optimizing the prediction model using the model loss function.

[0125] Wherein, the setting process of the specific model loss function has been specifically described in embodiment 1, and will not be repeated here.

[0126] The embodiment of the application further provides an electronic device, the electronic device comprising a memory and a processor, the memory being used for storing a computer program, and the processor running the computer program to make the electronic device execute the security entity knowledge graph relationship reasoning method described in embodiment 1.

[0127] The embodiment of the application further provides a readable storage medium, the readable storage medium storing computer program instructions, the computer program instructions being read and run by a processor to execute the security entity knowledge graph relationship reasoning method described in embodiment 1.

[0128] In several embodiments provided in the application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiment described above is only schematic, for example, the flow chart and block diagram in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the application. In this regard, each block in the flow chart or block diagram can represent a module, program segment or part of code containing one or more executable instructions for implementing the specified logic function. It should also be noted that, in some alternative implementation manners, the functions noted in the block can also occur in different order from that noted in the drawings. For example, two continuous blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the function involved. It should also be noted that each block in the block diagram and / or flow chart, and the combination of blocks in the block diagram and / or flow chart, can be implemented by a dedicated hardware-based system for executing the specified function or action, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0129] In addition, each functional module in the embodiments of the application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0130] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts of the prior art that make contributions or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0131] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0132] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0133] It should be noted that, in this document, the terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

Claims

1. A secure entity knowledge graph relation reasoning method, characterized in that, The method includes: Construct security entity triples based on threat intelligence logs; Obtaining factual and counterfactual data based on the aforementioned security entity triples includes: in a given relation r In the case of, determine ( h , t Do they belong to the same community? To obtain factual data, the security entity triple is represented as ( h , r , t ); in a given relation r In the case of obtaining ( h , t Two pairs of similar entities And determine whether they belong to the same community: if Then two pairs of entities Constituent Entity ( h , t Counterfactual data, represented as ; Based on the factual data and counterfactual data, obtain positive sample data and negative sample data; The positive and negative sample data are respectively input into a pre-trained prediction model to obtain the probability of the existence of positive and negative samples. A SANC architecture model is constructed using a WGCN encoder and a Conv-TransE decoder, and the Conv-TransE decoder is connected to two multilayer perceptrons. The model loss function of the prediction model is set, including: The loss of factual data can be expressed as: ； The loss from counterfactual data is expressed as: ； in, This represents the predicted probability of factual data; Indicates the predicted probability of counterfactual data; Calculate the L2 distance: ； Based on the loss from the factual data, the loss from the counterfactual data, and the L2 distance, a loss function is generated: ； in, These are the preset values.

2. The secure entity knowledge graph relation reasoning method according to claim 1, characterized in that, The process of obtaining positive and negative sample data based on the factual and counterfactual data includes: In the given ( h , t In the case of obtaining positive triplet samples existing in the security entity knowledge graph, h , r , t ) and non-existent triplet negative samples ; The positive and negative triplet samples are converted into vectors, and then combined with the factual and counterfactual data to form positive sample data. and negative sample data .

3. The secure entity knowledge graph relation reasoning method according to claim 1, characterized in that, Before the step of inputting the positive sample data and negative sample data into a pre-trained prediction model to obtain the probability of the existence of positive and negative samples, the method further includes: Construct the prediction model; Set a model loss function and use the model loss function to optimize the prediction model.

4. A secure entity knowledge graph relation reasoning device, characterized in that, The device includes: The triplet construction module is used to construct security entity triplets based on threat intelligence logs. The counterfactual data acquisition module is used to acquire factual data and counterfactual data based on the secure entity triple. The counterfactual data acquisition module includes: a factual data acquisition module, used to acquire factual data and counterfactual data based on a given relation. r In the case of, determine ( h , t Do they belong to the same community? To obtain factual data, the security entity triple is represented as ( h , r , t The counterfactual data judgment module is used to determine the counterfactual data in a given relationship. r In the case of obtaining ( h , t Two pairs of similar entities And determine whether they belong to the same community: if Then two pairs of entities Constituent Entity ( h , t Counterfactual data, represented as ; The positive and negative sample data acquisition module is used to acquire positive and negative sample data based on the factual data and counterfactual data. The probability calculation module is used to input the positive and negative sample data into a pre-trained prediction model to obtain the probability of the existence of positive and negative samples. The model utilizes a WGCN encoder and a Conv-TransE decoder to construct a SANC architecture model, with the Conv-TransE decoder connected to two multilayer perceptron layers. The module also sets the model loss function for the prediction model, including: The loss of factual data can be expressed as: ； The loss from counterfactual data is expressed as: ； in, This represents the predicted probability of factual data; Indicates the predicted probability of counterfactual data; Calculate the L2 distance: ； Based on the loss from the factual data, the loss from the counterfactual data, and the L2 distance, a loss function is generated: ； in, These are the preset values.

5. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform the secure entity knowledge graph relation reasoning method according to any one of claims 1 to 3.

6. A readable storage medium, characterized in that, The readable storage medium stores computer program instructions, which are read and executed by a processor to perform the secure entity knowledge graph relationship reasoning method according to any one of claims 1 to 3.

Images