Network security knowledge graph embedding method and device and medium

Abstract

This application discloses a method, apparatus, and medium for embedding cybersecurity knowledge graphs. The method includes: constructing a training set for a knowledge graph embedding model; initializing entities in the training set as entity vectors of the embedding layer of the knowledge graph embedding model, and embedding spatial and temporal information layer by layer into the entity vectors of the embedding layer; obtaining positive samples and performing negative sampling on the positive samples to obtain negative samples; constructing a cross-entropy loss function, and training the knowledge graph embedding model using positive and negative samples; calculating the average reciprocal rank of the knowledge graph embedding model, and selecting the knowledge graph embedding model with the highest average reciprocal rank as the target model; and testing and evaluating the target model based on link prediction to determine the performance of the target model. In this embodiment of the invention, the temporal and spatial information of cybersecurity knowledge can be mapped to the embedding layer, realizing the representation of cybersecurity knowledge with spatiotemporal characteristics in the embedding layer.

Description

Technical Field

[0001] This application relates to the field of knowledge graph application technology, and in particular to a method, apparatus and medium for embedding a network security knowledge graph. Background Technology

[0002] Knowledge graphs are semantic networks with a graph structure. Due to their excellent structure and semantic expressive power, they have been widely welcomed and applied in recent years. A general knowledge graph is usually composed of knowledge in the form of triplets (head entity, the relationship between the head entity and the tail entity, and the tail entity, represented as (h,r,t)). By constructing knowledge graphs, not only can dynamic development patterns be presented in different fields, but valuable references can also be provided for disciplinary research and engineering applications.

[0003] In the MDATA (Multi-dimensional Data Association and InTelligent Analysis) model, an improved triplet is used to associate the temporal and spatial information of knowledge, making it suitable for cybersecurity knowledge graphs. However, to generate value from knowledge, it is necessary to embed the knowledge as vectors to make it computable. Currently, most mainstream temporal knowledge embedding methods utilize graph neural networks, learning the structural information of the graph and the neighbor information of nodes at different times through convolutional neural networks and attention mechanisms. They rely on recurrent neural networks to update nodes, thus completing the embedding work. However, due to the large number of parameters and the lack of utilization of spatial information, the model struggles to perceive and respond to changes in network dynamics in a timely manner. Summary of the Invention

[0004] This application provides a method, apparatus, and medium for embedding a network security knowledge graph, which maps the temporal and spatial information of network security knowledge to the embedding layer, thereby realizing the representation of network security knowledge with spatiotemporal characteristics in the embedding layer.

[0005] In a first aspect, embodiments of this application provide a method for embedding a network security knowledge graph, including:

[0006] A training set for a knowledge graph embedding model is constructed, wherein each security knowledge sample in the training set includes a head entity, a relation, a tail entity, spatial information representing a network address, and temporal information corresponding to the spatial information;

[0007] The entities in the training set are initialized as embedding layer entity vectors of the knowledge graph embedding model, and the spatial information and the temporal information are embedded into the embedding layer entity vectors in a hierarchical manner.

[0008] Obtain a small batch of positive samples from the training set, and perform negative sampling on the positive samples to obtain negative samples;

[0009] A cross-entropy loss function is constructed based on the scoring function of the knowledge graph embedding model, and the knowledge graph embedding model is trained for a preset total number of rounds H using the positive samples and the negative samples. The knowledge graph embedding model is saved once every g rounds of training, where H and g are both positive integers and H is an integer multiple of g.

[0010] Calculate the average reciprocal rank of the saved knowledge graph embedding models, and select the knowledge graph embedding model with the highest average reciprocal rank as the target model;

[0011] The target model is tested and evaluated based on link predictions to determine its effectiveness.

[0012] In some embodiments, the embedding layer entity vector includes d dimensions, where d is a positive integer; the step of embedding the spatial information and the temporal information hierarchically into the embedding layer entity vector includes:

[0013] The spatial information is embedded by selecting a first number of dimensions from the d dimensions of the embedded layer entity vector;

[0014] The time information is embedded by selecting a second number of dimensions from the d dimensions of the embedded layer entity vector;

[0015] The dimension in which the spatial information is embedded is different from the dimension in which the temporal information is embedded.

[0016] In some embodiments, the spatial information includes source address information and destination address information; the step of selecting a first number of dimensions from the d dimensions of the embedding layer entity vector to embed the spatial information includes:

[0017] Select half of the first number of dimensions to embed the source address information;

[0018] The destination address information is embedded in the remaining half of the first number of dimensions.

[0019] In some embodiments, the step of hierarchically embedding the spatial information and the temporal information into the embedding layer entity vector includes:

[0020] The source address information is embedded in the first md dimensions of the embedding layer entity vector, the destination address information is embedded in the last md dimensions of the embedding layer entity vector, and the time information is embedded in the pd-th to qd-th dimensions of the embedding layer entity vector.

[0021] Where m, p, and q are all greater than 0 and less than 1, md, pd, and qd are all positive integers, md is less than or equal to pd, and pd is less than or equal to qd.

[0022] In some embodiments, the step of hierarchically embedding the spatial information and the temporal information into the embedding layer entity vector includes:

[0023] The d dimensions of the embedded layer entity vector are divided into four parts according to parameters m, p, and q. The first part is to embed the source address information in the [1, md] dimension, the second part is to maintain the static features of the dimension in the (md, pd] dimension, the third part is to embed the time information in the (pd, qd) dimension, and the fourth part is to embed the destination address information in the [qd, d] dimension, where qd = (1-m)d + 1.

[0024] In some embodiments, the embedding layer entity vector is represented as follows:

[0025]

[0026] in, Let n be the entity vector of the embedding layer, s be the current dimension, and S be the spatial information. src For the source address information, S dst Here, t represents the destination address information, and a represents the time information. v [n] represents an entity vector of dimension n, σ s and σ t These are the spatial activation function and the temporal activation function, respectively, ω v [n] and b v [n] represents the spatial weight parameter and the temporal weight parameter, respectively.

[0027] In some embodiments, the spatial information includes source address information and destination address information; before embedding the spatial information and the temporal information hierarchically into the embedding layer entity vector, the embedding method further includes:

[0028] When the source address information and the destination address information are IPv4 (Internet Protocol version 4) addresses, both the source address and the destination address are divided into four address delimiter fields according to the IP address separator.

[0029] The time information is divided into three time-segmented fields according to the year, month, and day time format.

[0030] In some embodiments, selecting a first number of dimensions from the d dimensions of the embedding layer entity vector to embed the spatial information includes:

[0031] Embed the four address segmentation fields in the first selected number of dimensions respectively;

[0032] Perform a summation operation on embedded entity vectors that are in the same dimension and belong to the same IP address;

[0033] The step of selecting a second number of dimensions from the d dimensions of the embedded layer entity vector to embed the time information includes:

[0034] Embed the three time segmentation fields in the selected second number of dimensions respectively;

[0035] Perform a summation operation on embedded entity vectors that are in the same dimension and belong to the same time information.

[0036] In some embodiments, the training set for constructing the knowledge graph embedding model includes:

[0037] Each security knowledge sample is assigned a number to form an entity-number dictionary and a relation-number dictionary;

[0038] The step of performing a negative sampling operation on the positive samples to obtain negative samples includes:

[0039] For the small batch of positive samples obtained, entities are randomly selected from the entity-number dictionary to replace the head and tail entities of the positive samples, resulting in two types of negative samples. The number of negative samples of each type is collected according to a preset ratio, which is the ratio of the number of negative samples to the number of positive samples.

[0040] In some embodiments, the step of testing and evaluating the target model based on link prediction to determine the performance of the target model includes:

[0041] Construct a test set and an entity set for the knowledge graph embedding model. Each security knowledge fact in the test set includes a head entity, a relation, a tail entity, spatial information, and temporal information. The entity set includes all entities in the knowledge graph.

[0042] The first candidate query dictionary is obtained by replacing the header entity of each security knowledge fact in the test set with all entities in the entity set, and the second candidate query dictionary is obtained by replacing the tail entity of each security knowledge fact in the test set with all entities in the entity set.

[0043] During the testing process, for the security knowledge facts in the test set, the embedding vector corresponding to the security knowledge facts is searched in the target model according to the first candidate query dictionary and the second candidate query dictionary;

[0044] Calculate the average inverse rank and overall rank Hits@n of the target model's embedding representation on the test set to determine the performance of the target model.

[0045] Secondly, embodiments of this application provide an embedding device for a network security knowledge graph, including at least one processor and a memory for communicatively connecting to the at least one processor; the memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to perform the embedding method as described in the first aspect.

[0046] Thirdly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the embedding method as described in the first aspect.

[0047] The network security knowledge graph embedding method, apparatus, and medium provided in this application have at least the following beneficial effects: In the network security knowledge graph based on the MDATA model, security knowledge with spatial and temporal information is embedded into the embedding layer of the knowledge graph embedding model for embedding representation. Training is then performed based on the embedded vectors, and network parameters are updated through the cross-entropy loss function to finally obtain the trained target model. The target model can accept security knowledge with spatial and temporal information as input and output the final embedded representation of all entities and relationships in the network security knowledge graph. This embedded representation has spatiotemporal characteristics and can well reflect the relationship between security knowledge and space and time in the network security knowledge graph, successfully solving the problem that the temporal and spatial characteristics of security knowledge cannot be expressed in complex network environments. Attached Figure Description

[0048] Figure 1 This is an overall flowchart of an embedding method provided in one embodiment of this application;

[0049] Figure 2 yes Figure 1 Flowchart of the specific method for step S200;

[0050] Figure 3 yes Figure 2 Flowchart of the specific method for step S210;

[0051] Figure 4 This is an overall flowchart of an embedding method provided in another embodiment of this application;

[0052] Figure 5 yes Figure 2 Another specific method flowchart for step S210;

[0053] Figure 6 yes Figure 2 Flowchart of the specific method for step S220;

[0054] Figure 7 yes Figure 1 Flowchart of the specific method for step S100;

[0055] Figure 8 yes Figure 1 Flowchart of the specific method for step S300;

[0056] Figure 9 yes Figure 1 Flowchart of the specific method for step S600;

[0057] Figure 10 This is an overall flowchart of an example embedding method provided in this application;

[0058] Figure 11 This is a schematic diagram of the structure of an encoding device provided in one embodiment of this application. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] Knowledge is the crystallization of human wisdom. Humans have acquired vast amounts of knowledge through various means such as collection, induction, and reasoning. However, how to represent knowledge has always been a major challenge. Numerous studies have explored knowledge representation, including symbolic logic, expert systems, knowledge graphs, ACT-R (Adaptive Control of Thought-Rational), and IBLT (Invertible Bloom Lookup Tables). Among these, knowledge graphs, a type of semantic network with a graph structure, have gained widespread popularity and application in recent years due to their excellent structure and semantic expressive power. A typical knowledge graph is composed of knowledge in the form of triples (head entity, relation, tail entity, abbreviated as (h,r,t)). Nodes typically describe the head and tail entities, and edges describe the relations. Thus, hundreds of millions of triples form a complex network—the knowledge graph. By constructing knowledge graphs, humans not only reveal dynamic development patterns in different fields but also provide valuable references for disciplinary research and engineering applications.

[0061] Although knowledge graphs have been widely applied in many fields, the representation of knowledge triples in cybersecurity knowledge graphs still has significant shortcomings. These shortcomings are mainly reflected in two aspects: First, security knowledge is largely time-sensitive. For example, the knowledge "a certain CVE (Common Vulnerabilities and Exposures) vulnerability can lead to the theft of sensitive data from a system" may still exist in the existing knowledge graph even if the system is patched at a certain point in time, as the risk no longer exists. If the time-sensitive nature of knowledge is not considered, invalid knowledge in the knowledge graph will become increasingly redundant, making it difficult to capture effective information. Second, security knowledge has a high correlation with spatial features, especially since various hacker attacks involve multiple types and spatial changes from one IP address to another. Therefore, Gu et al. proposed a multi-dimensional data association and intelligent analysis model based on general knowledge graphs, redefining the overall architecture of the knowledge representation model.

[0062] In the MDATA (Multi-dimensional Data Association and InTelligent Analysis) model, an improved triplet is used to associate the temporal and spatial information of knowledge, making it suitable for cybersecurity knowledge graphs. However, to generate value from knowledge, it is necessary to embed the knowledge as vectors to make it computable. Currently, most mainstream temporal knowledge embedding methods utilize graph neural networks, learning the structural information of the graph and the neighbor information of nodes at different times through convolutional neural networks and attention mechanisms. They rely on recurrent neural networks to update nodes, thus completing the embedding work. However, due to the large number of parameters and the lack of utilization of spatial information, the model struggles to perceive and respond to changes in network dynamics in a timely manner.

[0063] Based on this, embodiments of this application provide an embedding method, apparatus, and medium for a cybersecurity knowledge graph. In a cybersecurity knowledge graph based on the MDATA model, security knowledge with spatial and temporal information is embedded into the embedding layer of the knowledge graph embedding model for embedding representation. Training is then performed based on the embedded vectors, and network parameters are updated through a cross-entropy loss function to finally obtain the trained target model. The target model can accept security knowledge with spatial and temporal information as input and output the final embedded representation of all entities and relationships in the cybersecurity knowledge graph. This embedded representation has spatiotemporal characteristics and can well reflect the relationship between security knowledge and space and time in the cybersecurity knowledge graph, successfully solving the problem that the temporal and spatial characteristics of security knowledge cannot be expressed in complex network environments.

[0064] Reference Figure 1 The present application provides an embedding method for a network security knowledge graph, which includes, but is not limited to, the following steps S100 to S600.

[0065] Step S100: Construct the training set for the knowledge graph embedding model;

[0066] It should be noted that each security knowledge sample in the training set includes a head entity, a relation, a tail entity, spatial information representing the network address, and temporal information corresponding to the spatial information.

[0067] In some embodiments, a training set for a knowledge graph embedding model is constructed according to the application scenario of the knowledge graph. The training set includes each security knowledge sample, including a head entity, a relation, a tail entity, spatial information representing a network address, and temporal information corresponding to the spatial information, which can be represented as (h,r,t,T,S) to facilitate subsequent embedding of security knowledge.

[0068] It should be noted that the knowledge graph embedding model in this embodiment can be a TransE model, a TransE-like model, or other knowledge graph representation learning models.

[0069] It is understood that the application scenarios of knowledge graphs include, but are not limited to, search engine scenarios, recommendation system scenarios, medical and health scenarios, natural language processing scenarios, intelligent transportation scenarios, etc. This embodiment is based on the data scenario collected from the attack and defense competition in the target range. The core fields of these data include attack name, vulnerability, intrusion detection device, timestamp, source address of the attack, destination address of the attack, etc. The entities involved in the data can be roughly divided into attack entities and vulnerability entities, and the relationship can be abstractly expressed as "exploitation" and "detection", etc. This embodiment does not impose specific limitations.

[0070] Step S200: Initialize the entities in the training set into entity vectors of the embedding layer of the knowledge graph embedding model, and embed spatial and temporal information into the entity vectors of the embedding layer in a hierarchical manner.

[0071] In some embodiments, entities and relations in the training set are initialized, and entities in the training set are initialized as embedding layer entity vectors of the knowledge graph embedding model. At the same time, spatial and temporal information in the training set are embedded into the embedding layer entity vectors in a hierarchical manner to embed spatial and temporal information. This improves the representation structure of knowledge with spatiotemporal characteristics in the embedding layer and successfully solves the problem that the temporal and spatial characteristics of security knowledge cannot be expressed in complex network environments.

[0072] Step S300: Obtain a small batch of positive samples from the training set, and perform negative sampling on the positive samples to obtain negative samples;

[0073] In some embodiments, a small batch of positive samples are obtained from the training set, and negative sampling is performed on the positive samples to obtain negative samples. The negative sampling operation filters out some trivial samples, which reduces the number of samples that the model needs to process. Furthermore, the combination of positive and negative samples can help the model learn the semantic relationships between words better, improve the expressiveness of word vectors and the accuracy of similarity calculation.

[0074] It should be noted that this embodiment uses the mini-batch method to divide the training set into multiple small batches of positive samples. Only one small batch of samples is used to update the model parameters each time, thereby saving memory, speeding up the training process, and making the training process more stable.

[0075] Step S400: Construct a cross-entropy loss function based on the scoring function of the knowledge graph embedding model, and train the knowledge graph embedding model for a preset total number of rounds H using positive and negative samples. Save the currently trained knowledge graph embedding model every g rounds of training.

[0076] It should be noted that H and g are both positive integers and H is an integer multiple of g.

[0077] In some embodiments, the scoring function φ(h, r, t, T, S) = ||h| is used according to the knowledge graph embedding model. TS +rt Ts || l1 / l2 A cross-entropy loss function is constructed, and the knowledge graph embedding model is trained for a predetermined number of rounds H using positive and negative samples. Every g rounds, the currently trained knowledge graph embedding model is saved, where the currently trained knowledge graph embedding model includes the representation vectors h of all entities. TS t TSThe representation vector r of the relationship is represented by bold symbols in this embodiment, thereby enabling the training and updating of the representation vector of the security knowledge sample. This allows the knowledge graph embedding model to receive security knowledge with spatial and temporal information as input and output the final embedded representation of all entities and relationships in the network security knowledge graph.

[0078] It should be noted that the cross-entropy loss function is shown in the following formula (1):

[0079]

[0080] Where (h, r, t′, T, S) and (h′, r, t, T, S) are two types of negative samples, (h, r, t′, T, S) is the negative sample with the tail entity replaced, and (h′, r, t, T, S) is the negative sample with the head entity replaced.

[0081] It is understandable that in the scoring function φ(h, r, t, T, S) = ||h TS +rt TS || l1 / l2 In the diagram, h, r, and t represent the initialized head entity vector, relation vector, and tail entity vector, respectively. TS and t TS These represent the head entity vector and tail entity vector after being embedded using TSEE (Time and Space Embedding for Entity), respectively, with l1 / l2 representing l1 or l2 regularization.

[0082] In some embodiments, during the training process, it is determined in real time whether the current number of training rounds has reached the preset total number of rounds H. If it is determined that the preset total number of rounds H has not been reached, step S400 is repeated; if it is determined that the preset total number of rounds H has been reached, subsequent steps S500 to S600 are executed.

[0083] Step S500: Calculate the average reciprocal rank of the saved knowledge graph embedding models, and select the knowledge graph embedding model with the highest score in the average reciprocal rank as the target model;

[0084] In some embodiments, the mean reciprocal rank (MRR) of the saved knowledge graph embedding models is calculated, and the knowledge graph embedding model with the highest score is selected as the target model, thereby improving the accuracy of the knowledge representation model, optimizing the relevant parameters of the model, and obtaining a scene-oriented and relatively superior knowledge embedding layer representation.

[0085] Understandably, the MRR (Mean Relevant Document Rank) reflects the average quality of the first relevant document returned by the search engine across all queries. A higher MRR indicates a more prominent position of the relevant document in the search results, while a lower MRR indicates a lower ranking. Therefore, a higher MRR means the first relevant document in the search results ranks higher, meaning the search engine can more accurately return documents related to the user's query. This allows users to find the information they need more quickly, improving the search engine's usability and user satisfaction. Conversely, a lower MRR means the first relevant document in the search results ranks lower, and the search engine may return many irrelevant documents, causing users to spend more time and effort searching for the information they need, thus reducing the search engine's usability and user satisfaction.

[0086] It should be noted that the formula for calculating the average reciprocal ranking is shown in formula (2) below:

[0087]

[0088] Where valid represents the validation set, rank(fact, h) represents the ranking of the facts after replacing the head entity, and rank(fact, t) represents the ranking of the facts after replacing the tail entity.

[0089] Step S600: Test and evaluate the target model based on the link prediction to determine the effectiveness of the target model.

[0090] In some embodiments, multiple metrics of the target model are tested and evaluated based on link prediction to determine the performance of the target model, thereby enabling a more accurate evaluation of the target model and facilitating subsequent training or updates of the target model.

[0091] Reference Figure 2 , Figure 2 yes Figure 1 The flowchart of the specific method for step S200 is a further explanation of step S200, which includes, but is not limited to, steps S210 to S220.

[0092] It should be noted that the embedding layer entity vector has d dimensions, where d is a positive integer.

[0093] Step S210: Select a first number of dimensions from the d dimensions of the embedded layer entity vector to embed spatial information;

[0094] Step S220: Select a second number of dimensions from the d dimensions of the embedded layer entity vector to embed time information;

[0095] It should be noted that the dimensions of embedded spatial information are different from those of embedded temporal information.

[0096] In some embodiments, a first number of dimensions are selected from the d dimensions of the embedded layer entity vector to embed spatial information, and a second number of dimensions are selected from the d dimensions of the embedded layer entity vector to embed temporal information, thereby realizing the embedding of spatial information and temporal information in different dimensions to adapt to the needs of various network security scenarios.

[0097] Reference Figure 3 , Figure 3 yes Figure 2 The flowchart of the specific method for step S210 is a further explanation of step S210. Step S210 includes, but is not limited to, steps S211 to S212.

[0098] It should be noted that spatial information includes source address information and destination address information.

[0099] Step S211: Select half of the first number of dimensions to embed source address information;

[0100] Step S212: Embed destination address information into the remaining half of the first number of dimensions.

[0101] In some embodiments, spatial information includes source address information and destination address information of network addresses, and the source address information corresponds to the destination address information. Therefore, in this embodiment, source address information is embedded in half of the dimensions of the first data, and destination address information is embedded in the remaining half of the first data dimensions, so as to achieve half embedding of source address information and destination address information.

[0102] In some embodiments, spatial information and temporal information are hierarchically embedded into the embedding layer entity vector, including embedding source address information in the first md dimensions of the embedding layer entity vector, embedding destination address information in the last md dimensions of the embedding layer entity vector, and embedding temporal information in the pd to qd dimensions of the embedding layer entity vector.

[0103] Where m, p, and q are all greater than 0 and less than 1, md, pd, and qd are all positive integers, md is less than or equal to pd, and pd is less than or equal to qd.

[0104] It should be noted that in this embodiment, hyperparameters 0≤m,p,q≤1 are set to adjust the proportion of spatial and temporal information in the entity vector of the embedding layer, so as to adapt to the application needs in different scenarios. The values ​​of m, p and q can be adjusted by the user according to their needs, and this embodiment does not impose specific restrictions.

[0105] Specifically, the d dimensions of the embedded layer entity vector are divided into four parts according to the parameters m, p, and q. The first part embeds the source address information in the [1, md] dimension, the second part maintains the static features of the dimension in the (md, pd] dimension, the third part embeds the time information in the (pd, qd) dimension, and the fourth part embeds the destination address information in the [qd, d] dimension, where qd = (1-m)d + 1.

[0106] It is understood that in this embodiment, the dimensions of the entity vector in the embedding layer are divided into four parts according to the parameters, and different information is embedded in each part. In this embodiment, source address information is embedded in the dimension of the first part, the entity vector is initialized in the dimension of the second part, the static characteristics of the dimension are maintained, and no processing is performed. Time information is embedded in the dimension of the third part, which means that the temporal transformation information is embedded in this dimension. Destination address information is embedded in the dimension of the fourth part, thereby forming a closed loop of spatial transfer information and realizing the representation of network security knowledge with spatiotemporal characteristics in the embedding layer.

[0107] In some embodiments, the embedding layer entity vector is represented as shown in formula (3):

[0108]

[0109] in, Let n be the entity vector of the embedding layer, s be the current dimension, and S be the spatial information. src For source address information, S dst Here, t represents the destination address information, and a represents the time information. v [n] represents an entity vector of dimension n, σ s and σ t These are the spatial activation function and the temporal activation function, respectively, ω v [n] and b v [n] represents the spatial weight parameter and the temporal weight parameter, respectively.

[0110] It should be noted that when σ s and σ t When both are set to sin, the embedding of entities becomes expressive, which is closely related to the fact that the sin function can simulate multiple on and off states. ω v [n] and b v [n] can be further adjusted to avoid overfitting during the learning of spatiotemporal features, when the parameter ω v Setting [n] to zero allows the static features of an entity to be extended to the d-dimensional dimension, intuitively modeling the static features of knowledge by reducing the number of learnable parameters.

[0111] Reference Figure 4 , Figure 4This is another embodiment of the embedding method provided in this application. The embedding method of the network security knowledge graph includes, but is not limited to, the following steps S800 to S900.

[0112] It should be noted that steps S800 to S900 occur before the spatial and temporal information is layered and embedded into the entity vector of the embedding layer.

[0113] Step S800: If the source address information and destination address information are IPv4 addresses, divide both the source address and destination address into four address delimiter fields according to the IP address delimiter.

[0114] Step S900: Divide the time information into three time segmentation fields according to the year, month, and day time format.

[0115] In some embodiments, when the source address information and destination address information are IPv4 addresses, the source address and destination address are divided into four address delimiter fields according to the IP address delimiter. For example, the IPv4 address 192.168.0.11 is divided into four address delimiter fields: 192, 168, 0, and 11. And the time information is divided into three time delimiter fields according to the year, month, and date time expression format. For example, if the time information is December 30, 2020, then the time information is divided into three time delimiter fields: 2020, 12, and 30.

[0116] Reference Figure 5 , Figure 5 yes Figure 2 Another specific method flowchart for step S210 is a further explanation of step S210. Step S210 includes, but is not limited to, steps S213 to S214.

[0117] Step S213: Embed four address splitting fields in the selected first number of dimensions respectively;

[0118] Step S214: Perform a summation operation on the embedded entity vectors that are in the same dimension and belong to the same IP address.

[0119] In some embodiments, after obtaining four address partition fields, the four address partition fields are embedded in the selected first number of dimensions respectively. At this time, S in formula (1) src and S dstThe address segmentation fields are the source address information and the destination address, respectively. Then, after being represented by a nonlinear function corresponding to the spatial information, the embedded entity vectors belonging to the same IP address in the same dimension are summed. The nonlinear function is represented as shown in formula (1). This function is nonlinear. The entity embedding vector obtained by this function is a vector representation method after being processed by a nonlinear function, which can better capture the relationship and connection between entities in spatial information, thereby improving the performance of the model in various tasks.

[0120] It is understandable that, taking the dimension range of the vector in the third part as an example, the IPv4 address 192.168.0.11 is divided into four address segmentation fields: 192, 168, 0, and 11. Substituting the four address segmentation fields into the segmentation function yields four qp-dimensional vectors. Adding these four a-dimensional vectors together yields a qp-dimensional vector after the joint embedding of entity and spatial information. Then, it is concatenated with other vectors belonging to the same dimension to complete the summation operation of spatial information.

[0121] Reference Figure 6 , Figure 6 yes Figure 2 The flowchart of the specific method for step S220 is a further explanation of step S220. Step S220 includes, but is not limited to, steps S221 to S222.

[0122] Step S221: Embed three time segmentation fields in the selected second number of dimensions respectively;

[0123] Step S222: Perform a summation operation on the embedded entity vectors that are in the same dimension and belong to the same time information.

[0124] In some embodiments, after obtaining three time segmentation fields, the three time segmentation fields are embedded in the selected second number of dimensions respectively. At this time, S in formula (3) src and S dst The time segmentation fields of the time information are represented by nonlinear functions corresponding to the time information. Then, the embedded entity vectors belonging to the same time information in the same dimension are summed. This can better capture the relationships and connections between entities in spatial information, thereby improving the model's performance in various tasks.

[0125] Understandably, taking the dimensional range of the vector in the third part as an example, after initializing the year as a vector and substituting it into the piecewise function, we get a qp-dimensional vector. After initializing the month as a vector and substituting it into the piecewise function, we get a qp-dimensional vector. After initializing the day as a vector and substituting it into the piecewise function, we get a qp-dimensional vector. Adding these three a-dimensional vectors together can yield a qp-dimensional vector after the joint embedding of entity and time information. Then, it is concatenated with other vectors belonging to the same dimension to complete the summation operation of spatial information.

[0126] Reference Figure 7 , Figure 7 yes Figure 1 The flowchart of the specific method for step S100 is a further explanation of step S100, which includes but is not limited to step S110.

[0127] Step S110: Number each security knowledge sample to form an entity-number dictionary and a relation-number dictionary.

[0128] In some embodiments, each security knowledge sample is numbered to form an entity-number dictionary and a relation-number dictionary, which facilitates the subsequent lookup of the embedding vector corresponding to the number through the entity-number dictionary and the relation-number dictionary.

[0129] Understandably, after the model is trained, an ID-vector dictionary will be formed again. During testing or application, when looking up an entity, it will first be mapped to the ID number, and the model will automatically retrieve the corresponding embedding vector through the ID number.

[0130] Reference Figure 8 , Figure 8 yes Figure 1 The flowchart of the specific method for step S300 is a further explanation of step S300, which includes but is not limited to step S310.

[0131] Step S310: For the small batch of positive samples obtained, randomly select entities from the entity-number dictionary to replace the head and tail entities of the positive samples, and obtain two types of negative samples. The number of negative samples of each type is collected according to a preset ratio.

[0132] It should be noted that the preset ratio is the ratio of the number of negative samples to the number of positive samples.

[0133] In some embodiments, for each positive sample in the obtained mini-batch, entities are randomly selected from the entity-number dictionary to replace the head and tail entities of the positive sample, resulting in two types of negative samples. The number of negative samples of each type is collected according to a certain preset ratio, which can accelerate the training process. By filtering out some trivial samples through negative sampling, the number of samples that the model needs to process is reduced. Furthermore, the combination of positive and negative samples can help the model better learn the semantic relationships between words, improve the expressiveness of word vectors and the accuracy of similarity calculation.

[0134] Understandably, positive sampling brings similar words closer together, while negative sampling keeps dissimilar words away, thus enhancing the discriminative power of word vectors.

[0135] Reference Figure 9 , Figure 9 yes Figure 1 The flowchart of the specific method for step S600 is a further explanation of step S600, which includes, but is not limited to, steps S610 to S640.

[0136] Step S610: Construct the test set and entity set of the knowledge graph embedding model;

[0137] It should be noted that each security knowledge fact in the test set includes a head entity, relation, tail entity, spatial information, and temporal information, and the entity set includes all entities in the knowledge graph.

[0138] In some embodiments, a test set and an entity set for the knowledge graph embedding model are constructed, wherein the entity set is a collection of all entities in the MDATA graph.

[0139] Step S620: Replace the head entity of each security knowledge fact in the test set with all entities in the entity set to obtain the first candidate query dictionary; replace the tail entity of each security knowledge fact in the test set with all entities in the entity set to obtain the second candidate query dictionary.

[0140] In some embodiments, all entities in the entity set are used as new head entities and tail entities, respectively, to replace the head entity of each existing security knowledge fact in the test set to obtain a first candidate query dictionary, and to replace the tail entity of each security knowledge fact in the test set to obtain a second candidate query dictionary, which facilitates subsequent evaluation of the performance of the target model.

[0141] It should be noted that in this embodiment, replacing the head and tail entities of each security knowledge fact in the test set with all entities in the entity set is different from the common practice in the knowledge graph field of randomly replacing head and tail entities to generate a query dictionary. The original knowledge graph uses static knowledge to generate dictionaries, and trains, tests, and evaluates them without evolutionary time and space information. However, in this embodiment, multiple dictionaries are generated based on the MDATA graph, and time and space information are embedded during the testing process. Furthermore, head and tail entities are replaced simultaneously to generate multiple dictionaries, which further improves the accuracy of the model.

[0142] Step S630: During the testing process, for the security knowledge facts in the test set, the embedding vector corresponding to the security knowledge facts is searched in the target model according to the first candidate query dictionary and the second candidate query dictionary;

[0143] In some embodiments, during the testing process, for security knowledge facts in the test set, the embedding vector corresponding to the security knowledge facts is searched in the target model according to the number in the first candidate query dictionary and the second candidate query dictionary, so as to achieve accurate search of the embedding vector.

[0144] Step S640: Calculate the average inverse rank and overall rank Hits@n of the target model's embedding representation on the test set to determine the performance of the target model.

[0145] In some embodiments, the average reciprocal ranking of the target model's embedding representation in the test set is calculated according to formula (4), and the comprehensive ranking Hits@n of the target model's embedding representation in the test set is calculated according to a preset scoring formula (5) to determine the performance of the target model. Formula (4) and the preset scoring formula (5) are as follows:

[0146]

[0147]

[0148] It should be noted that fact represents a fact in the test set, (fact, h) represents the fact after replacing the head entity in fact, and represents the score ranking of (fact, h). (fact, t) represents the fact after replacing the tail entity in fact, and represents the score ranking of (fact, t). The bool function is used to determine whether the condition is met in real time. If the condition is met, it returns 1; otherwise, it returns 0.

[0149] To more clearly illustrate this embodiment, the embedding method of this application will be described below with specific examples.

[0150] Example 1:

[0151] refer to Figure 10 , Figure 10 This is an overall flowchart of an example embedding method provided in this application.

[0152] Example 1 is based on data collected from attack and defense competitions at a test range. The core fields of this data include attack name, vulnerability, intrusion detection device, timestamp, source address of the attack, and destination address of the attack. Observation reveals that the entities involved in the data can be broadly categorized into attack-related entities and vulnerability-related entities, with relationships abstractly expressed as "exploitation" and "detection." To better demonstrate the innovation and advantages of this embodiment, the proposed embedding method TSEE will be explained in detail and in a procedural manner:

[0153] Step S1: Preprocess various entities and relationships, assigning numbers to them to form an entity-number (ent2id) dictionary and a relationship-number (rel2id) dictionary. Simultaneously, process the time and spatial information, dividing the time corresponding to each security knowledge record into three time fields (year, month, day), and dividing the source and destination addresses into four address fields.

[0154] Step S2: Initialize entity vectors and relation vectors, that is, initialize the entities and relations in the training set as vectors of the embedding layer respectively. The four-part structure of the entity vector of the embedding layer is shown in the above formula (3), which will not be repeated here.

[0155] It should be noted that in the first and fourth parts, the source and destination address information of the attack is embedded in the entity vector, forming a closed loop of spatial transfer information. As shown in equation (3), we embed the starting address of the attack in the first md dimensions of the entity vector and the destination address of the attack in the last md dimensions. Wherein, S src and S dst The delimited fields representing the source and destination addresses are represented by their respective space-dependent nonlinear functions and then summed in the same dimension.

[0156] In the second part, this embodiment initializes the entity vector within the dimension range of (md, pd), maintains the static feature information of the entity vector, and does not perform any processing.

[0157] In the third part, this embodiment embeds time information into the entity vector, as shown in equation (3). We embed temporal transformation information within the dimension of (pd, qd). Here, t represents the segmentation field of the time information. After being represented by the corresponding time-related nonlinear function, a summation operation is performed in the same dimension.

[0158] In this embodiment, hyperparameters 0 ≤ m, p, q ≤ 1 are set to adjust the proportion of spatiotemporal feature information in the entity vector, thereby adapting to application needs in different scenarios. σ s and σ t These are activation functions for temporal and spatial information, respectively. Experiments showed that when both functions are set to sin, the entity embedding is expressive, which is closely related to the fact that the sin function can simulate multiple on and off states. ω v [n] and b v [n] is a parameter that can be adjusted for time and space weights to avoid overfitting during the learning of spatiotemporal features. When the parameter ω v Setting [n] to zero allows the static features of an entity to be extended to the d-dimensional dimension, intuitively modeling the static features of knowledge by reducing the number of learnable parameters.

[0159] Step S3: Obtain a small batch of samples from the training set, and perform negative sampling on each sample. That is, randomly extract the head and tail entities of the entity replacement knowledge from the entity-ID (ent2id) dictionary to obtain two types of negative samples: (h, r, t′, T, S) and (h′, r, t, T, S). The number of negative samples of each type is collected according to a certain ratio of (negative examples / positive examples).

[0160] Step S4: Train and update the security knowledge representation vector. In this embodiment, the vector represented by the TSEE embedding method is used to score the security knowledge using the TransE-like model scoring function φ(h, r, t, T, S) = ||h TS +rt TS || l1 / l2 To measure the effectiveness of knowledge representation, the model parameters are updated using the cross-entropy loss function (in the scoring function, h, r, and t represent the initialized head entity vector, relation vector, and tail entity vector, respectively, h...). TS and t TS These represent the embedding representations of the head and tail entity vectors after processing using the TSEE method, respectively, with l1 / l2 indicating l1 or l2 regularization. Every g iterations, we refine the model (i.e., the representation vectors h of all entities). TS t TS The vector representing the relationship (r) is saved once;

[0161] Step S41: Set the number of training epochs H, and determine whether the number of epochs (training epochs) has reached H. If not, return to step S4; if it has, execute step S5 to verify the representation effect of the model.

[0162] Step S5: Calculate the MRR value of the retained (H / g) representation models, select the representation model with the largest MRR value as the optimal model, and conduct testing.

[0163] Step S6: Employ the link prediction task, widely used in the knowledge graph field, to evaluate the probability of entity prediction success and the overall performance of the model. For each fact (h, r, t, T, S) in the test set, this embodiment replaces the original fact's head entity h and tail entity t with all entities e (e∈V, V is the entity set) from the entity set as new head and tail entities, generating two candidate dictionaries (this differs from the common practice in the knowledge graph field of randomly replacing head and tail entities to generate a query dictionary), namely {(h′, r, t, T, S)|h′∈V} and {(h, r, t′, T, S)|t′∈V}.

[0164] Step S7: Use two indicators, formula (4) and formula (5), to evaluate the embedding representation effect of the model. One is the mean reciprocal ranking (MRR), and the other is Hits@n, which reflects the overall ranking of the scores.

[0165] This embodiment designs a novel embedding technique that differs from previous methods. By designing a hierarchical structure for entity vectors, it successfully maps the spatiotemporal information of knowledge to the embedding layer, realizing the representation of knowledge with spatiotemporal characteristics in the embedding layer. Furthermore, through the TSEE embedding method, the entity vectors can express richer feature information than the representation vectors obtained by previous embedding methods, thereby improving the accuracy of the knowledge representation model.

[0166] By applying the MDATA model-based embedding technology to the field of network security, the problem of the inability to express the temporal and spatial characteristics of security knowledge in complex network environments has been successfully solved. Furthermore, the embedding method of this embodiment can be extended to any professional field related to time and space. By adjusting the dimension of the embedding vector and the relevant parameters of the model, the embedding method of this embodiment is also applicable to all other similar scenarios. Alternatively, the scoring function of the traditional embedding method can be used to train the embedding vector. By optimizing the relevant parameters of the model, a scenario-oriented and relatively superior knowledge embedding layer representation can be obtained.

[0167] This application also provides an embedding device for a network security knowledge graph, including at least one processor and a memory for communicatively connecting to the at least one processor; the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the aforementioned embedding method.

[0168] Reference Figure 11Taking the example of a network security knowledge graph embedding device 1000 where the control processor 1001 and memory 1002 are connected via a bus, the memory 1002, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, the memory 1002 may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1002 may optionally include memory remotely located relative to the control processor 1001, and these remote memories can be connected to the network security knowledge graph embedding device 1000 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0169] Those skilled in the art will understand that Figure 11 The device structure shown does not constitute a limitation on the embedding device 1000 for the cybersecurity knowledge graph, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0170] This application also provides a computer-readable storage medium storing computer-executable instructions that are executed by one or more control processors, for example, by... Figure 11 One of the control processors 1001 executes, which can cause the one or more control processors to execute the embedded method in the above method embodiments.

[0171] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0172] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

Claims

1. A method for embedding a network security knowledge graph, characterized in that, include: A training set for a knowledge graph embedding model is constructed, wherein each security knowledge sample in the training set includes a head entity, a relation, a tail entity, spatial information representing a network address, and temporal information corresponding to the spatial information; The entities in the training set are initialized as embedding layer entity vectors of the knowledge graph embedding model, and the spatial information and the temporal information are embedded into the embedding layer entity vectors in a hierarchical manner. Obtain a small batch of positive samples from the training set, and perform negative sampling on the positive samples to obtain negative samples; A cross-entropy loss function is constructed based on the scoring function of the knowledge graph embedding model, and the knowledge graph embedding model is trained for a preset total number of rounds H using the positive samples and the negative samples. The knowledge graph embedding model is saved once every g rounds of training, where H and g are both positive integers and H is an integer multiple of g. Calculate the average reciprocal rank of the saved knowledge graph embedding models, and select the knowledge graph embedding model with the highest average reciprocal rank as the target model; The target model is tested and evaluated based on link predictions to determine its effectiveness; The embedded layer entity vector includes d dimensions, where d is a positive integer; the spatial information includes source address information and destination address information; the step of embedding the spatial information and the temporal information layer by layer into the embedded layer entity vector includes: The source address information is embedded in the first md dimensions of the embedding layer entity vector, the destination address information is embedded in the last md dimensions of the embedding layer entity vector, and the time information is embedded in the pd-th to qd-th dimensions of the embedding layer entity vector; wherein m, p, and q are all greater than 0 and less than 1, md, pd, and qd are all positive integers, md is less than or equal to pd, and pd is less than or equal to qd; The embedded layer entity vector is represented by the following formula: in, For the embedded layer entity vector, For the current dimension, For the spatial information, For the source address information, The destination address information, The time information, For an entity vector of dimension n, and These are the spatial activation function and the temporal activation function, respectively. and These are the spatial weight parameter and the time weight parameter, respectively.

2. The embedding method according to claim 1, characterized in that, The step of embedding the spatial information and the temporal information hierarchically into the embedding layer entity vector includes: The spatial information is embedded by selecting a first number of dimensions from the d dimensions of the embedded layer entity vector; The time information is embedded by selecting a second number of dimensions from the d dimensions of the embedded layer entity vector; The dimension in which the spatial information is embedded is different from the dimension in which the temporal information is embedded.

3. The embedding method according to claim 2, characterized in that, The step of selecting a first number of dimensions from the d dimensions of the embedding layer entity vector to embed the spatial information includes: Select half of the first number of dimensions to embed the source address information; The destination address information is embedded in the remaining half of the first number of dimensions.

4. The embedding method according to claim 1, characterized in that, The step of embedding the spatial information and the temporal information hierarchically into the embedding layer entity vector includes: The d dimensions of the embedded layer entity vector are divided into four parts according to parameters m, p, and q. The first part is to embed the source address information in the [1, md] dimension, the second part is to maintain the static features of the dimension in the (md, pd] dimension, the third part is to embed the time information in the (pd, qd) dimension, and the fourth part is to embed the destination address information in the [qd, d] dimension, where qd = (1-m)d + 1.

5. The embedding method according to claim 2, characterized in that, The spatial information includes source address information and destination address information; before embedding the spatial information and the temporal information hierarchically into the embedding layer entity vector, the embedding method further includes: When the source address information and the destination address information are IPv4 addresses, both the source address and the destination address are divided into four address delimiter fields according to the IP address separator. The time information is divided into three time-segmented fields according to the year, month, and day time format.

6. The embedding method according to claim 5, characterized in that, The step of selecting a first number of dimensions from the d dimensions of the embedding layer entity vector to embed the spatial information includes: Embed the four address segmentation fields in the first selected number of dimensions respectively; Perform a summation operation on embedded entity vectors that are in the same dimension and belong to the same IP address; The step of selecting a second number of dimensions from the d dimensions of the embedded layer entity vector to embed the time information includes: Embed the three time segmentation fields in the selected second number of dimensions respectively; Perform a summation operation on embedded entity vectors that are in the same dimension and belong to the same time information.

7. The embedding method according to claim 1, characterized in that, The training set for constructing the knowledge graph embedding model includes: Each security knowledge sample is assigned a number to form an entity-number dictionary and a relation-number dictionary; The step of performing a negative sampling operation on the positive samples to obtain negative samples includes: For the small batch of positive samples obtained, entities are randomly selected from the entity-number dictionary to replace the head and tail entities of the positive samples, resulting in two types of negative samples. The number of negative samples of each type is collected according to a preset ratio, which is the ratio of the number of negative samples to the number of positive samples.

8. The embedding method according to claim 1, characterized in that, The step of testing and evaluating the target model based on link prediction to determine the performance of the target model includes: Construct a test set and an entity set for the knowledge graph embedding model. Each security knowledge fact in the test set includes a head entity, a relation, a tail entity, spatial information, and temporal information. The entity set includes all entities in the knowledge graph. The first candidate query dictionary is obtained by replacing the header entity of each security knowledge fact in the test set with all entities in the entity set, and the second candidate query dictionary is obtained by replacing the tail entity of each security knowledge fact in the test set with all entities in the entity set. During the testing process, for the security knowledge facts in the test set, the embedding vector corresponding to the security knowledge facts is searched in the target model according to the first candidate query dictionary and the second candidate query dictionary; Calculate the average inverse rank and overall rank Hits@n of the target model's embedding representation on the test set to determine the performance of the target model.

9. An embedding device for a network security knowledge graph, characterized in that, It includes at least one processor and a memory for communicatively connecting with said at least one processor; The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the embedding method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing a computer to perform the embedding method as described in any one of claims 1 to 8.

Images