Knowledge completion method and system of knowledge graph, electronic device and storage medium

Abstract

This application provides a knowledge completion method, system, electronic device, and storage medium for a knowledge graph, belonging to the field of network security technology. The method includes: acquiring knowledge data and dividing the data into a training set, a validation set, and a test set; preprocessing entities and relations in the data using an initial vector representation model to form entity vectors and relation vectors embedded with time information; training the initial vector representation model using the training set to obtain multiple candidate vector representation models; validating the multiple candidate vector representation models using the validation set to obtain a target vector representation model; processing entity vectors and relation vectors in the test set using the target vector representation model to construct multiple pieces of knowledge to be tested; obtaining candidate knowledge from the multiple pieces of knowledge to be tested using a scoring function; testing the candidate knowledge and determining whether the candidate knowledge needs to be added to the knowledge graph based on the test results.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, and particularly relates to a knowledge completion method and system of a knowledge graph, an electronic device and a storage medium. BACKGROUND

[0002] A security knowledge graph refers to a technical means of structuring, classifying and integrating knowledge in the security field and presenting the knowledge in the form of a graph. Through the security knowledge graph, security practitioners can more efficiently find relevant information, accurately analyze and identify security events, and quickly respond to and handle security threats. However, due to the continuous emergence of vulnerabilities and threat information, it is necessary to collect, organize and analyze the information in a timely manner to generate timely and effective security knowledge.

[0003] In the related art, the embedding representation technology of knowledge is usually used to solve the completion problem of a time graph. However, this cannot establish the correlation of entities and relationships in time, and it is difficult to effectively complete the security knowledge graph. SUMMARY

[0004] The main purpose of the embodiments of the application is to provide a knowledge completion method and system of a knowledge graph, an electronic device and a storage medium, which can solve the problem of low correlation of entities and relationships in time.

[0005] To achieve the above purpose, a first aspect of the embodiments of the application provides a knowledge completion method of a knowledge graph, which comprises:

[0006] acquiring knowledge data, dividing the knowledge data into a training set, a validation set and a test set; wherein the knowledge data comprises entities, relationships and knowledge composed of the entities and the relationships; preprocessing the entities and the relationships in the knowledge data by using an initial vector representation model to form embedded time information entity vectors and relationship vectors; training the initial vector representation model by using the entity vectors and the relationship vectors in the training set to obtain a plurality of candidate vector representation models; verifying a plurality of the candidate vector representation models by using the validation set to calculate evaluation scores of each of the candidate vector representation models, and obtaining a target vector representation model according to the evaluation scores; processing the entity vectors and the relationship vectors in the test set by using the target vector representation model to construct a plurality of to-be-inspected knowledge; scoring and sorting a plurality of the to-be-inspected knowledge by using a scoring function to obtain candidate knowledge; inspecting the candidate knowledge to obtain an inspection result, and determining whether the candidate knowledge needs to be supplemented into the knowledge graph according to the inspection result.

[0007] According to some embodiments of this application, the entity includes ontology information and description information; the step of preprocessing the entity in the knowledge data using an initial vector representation model to form an entity vector embedded with time information includes: obtaining the ontology information corresponding to the entity and converting the ontology information into an ontology vector; obtaining the description information corresponding to the entity and converting the description information into a first description vector; obtaining the time information corresponding to the entity information, inputting the time information into an activation function to obtain a time vector, the activation function including the initial model parameters corresponding to the initial vector representation model; multiplying the first description vector and the time vector to obtain a second description vector embedded with time information; and concatenating the ontology vector and the second description vector to obtain an entity vector embedded with time information.

[0008] According to some embodiments of this application, the dimension of the ontology vector is a first preset dimension, and the dimension of the first description vector is N - the first preset dimension, so that the dimension of the entity vector is N-dimensional, where N is a positive integer greater than or equal to 2; the step of concatenating the ontology vector with the second description vector to obtain the entity vector with embedded time information includes: obtaining a first preset dimension adjustment instruction; adjusting the first preset dimension according to the first preset dimension adjustment instruction to adjust the dimension ratio of the ontology vector in the entity vector.

[0009] According to some embodiments of this application, the step of preprocessing the relations in the knowledge data using an initial vector representation model to form a relation vector embedded with time information includes: obtaining the relation and converting it to obtain a current relation vector; obtaining the preceding relation of the relation and converting it to obtain a preceding relation vector; the preceding relation is a relation that occurs before the relation; obtaining the following relation of the relation and converting it to obtain a following relation vector; the following relation is a relation that occurs after the relation; and concatenating the preceding relation vector, the current relation vector, and the following relation vector in sequence to obtain the relation vector embedded with time information.

[0010] According to some embodiments of this application, the dimension of the preceding relation vector is a first relation dimension, the dimension of the following relation vector is a second relation dimension, and the current vector relation is M - first relation dimension - second relation dimension, so that the dimension of the relation vector is M-dimensional; wherein, M is a positive integer greater than or equal to 3; the step of sequentially concatenating the preceding relation vector, the current relation vector, and the following relation vector to obtain the relation vector with embedded time information includes: obtaining a relation dimension adjustment instruction; adjusting the first relation dimension and / or the second relation dimension according to the relation dimension adjustment instruction to adjust the dimensional proportions of the preceding relation vector, the current relation vector, and the following relation vector in the relation vector.

[0011] According to some embodiments of this application, the step of training the initial vector representation model using the entity vectors and relation vectors in the training set to obtain multiple candidate vector representation models includes: obtaining multiple entity vectors and multiple relation vectors, as well as the knowledge composed of the entities and the relations, based on the training set; using the knowledge vector composed of the entity vectors and the relation vectors as the training target, replacing the entity vectors or relation vectors in the knowledge vectors with the corresponding entity vectors or relation vectors, and adjusting the initial model parameters corresponding to the initial vector representation model according to the training target to obtain a training model, which is one round of training, and repeating this step process for multiple rounds of training; counting the number of training rounds, stopping training when the number of training rounds reaches a preset number of rounds, and using the multiple training models saved during the training process as candidate vector representation models.

[0012] According to some embodiments of this application, the preset number of rounds includes a first number of training rounds and a second number of training rounds, wherein the second number of training rounds is greater than the first number of training rounds; the step of counting the number of training rounds, stopping training when the number of training rounds reaches the preset number of rounds, and using multiple training models saved during the training process as candidate vector representation models, includes: real-time counting of the number of training rounds, saving the current initial vector representation model every time the number of training rounds reaches the first number of training rounds; stopping training when the number of training rounds reaches the second number of training rounds, and obtaining candidate vector representation models based on the multiple training models saved during the training process.

[0013] According to some embodiments of this application, the step of validating multiple candidate vector representation models using the validation set to calculate the evaluation score of each candidate vector representation model and obtaining the target vector representation model based on the evaluation score includes: calculating the MRR index value corresponding to each of the multiple candidate vector representation models; determining the candidate vector representation model with the highest MRR index value as the target vector representation model; wherein the MRR index value corresponding to the candidate vector representation model is calculated by: replacing entities or relations in the validation set based on multiple entity vectors or relation vectors in the candidate vector representation model to obtain multiple replaced knowledge; scoring the multiple replaced knowledge using a scoring function; determining the ranking of the multiple replaced knowledge in the validation set based on the scores to calculate the MRR index value of the multiple replaced knowledge; and obtaining the MRR index value of the candidate vector representation model based on the MRR index value of the multiple replaced knowledge.

[0014] According to some embodiments of this application, the step of processing the entity vectors and relation vectors in the test set through the target vector representation model to construct multiple pieces of knowledge to be tested includes: obtaining entities and relations in the test set; inputting multiple entities or multiple relations into the target vector representation model to obtain multiple target entity vectors or multiple target relation vectors; and randomly combining the multiple target entity vectors or multiple target relation vectors to obtain multiple pieces of knowledge to be tested.

[0015] According to some embodiments of this application, the step of scoring and ranking multiple pieces of knowledge to be tested using a scoring function to obtain candidate knowledge includes: obtaining a scoring function corresponding to the target vector representation model; scoring multiple pieces of knowledge to be tested according to the scoring function to obtain a scoring result for each piece of knowledge to be tested; ranking the multiple pieces of knowledge to be tested according to the scoring results to obtain a ranking result; and selecting the knowledge to be tested corresponding to a preset ranking range as candidate knowledge according to the ranking result.

[0016] According to some embodiments of this application, the step of verifying the candidate knowledge, obtaining a verification result, and determining whether the candidate knowledge needs to be added to the knowledge graph based on the verification result includes: obtaining a preset knowledge base; comparing the candidate knowledge with preset knowledge in the preset knowledge base to obtain a verification result; analyzing the verification result; and if the candidate knowledge is consistent with the verification result of the preset knowledge, then adding the candidate knowledge to the knowledge graph.

[0017] According to some embodiments of this application, after analyzing the comparison results, the method further includes: if the candidate knowledge is inconsistent with the test results of the preset knowledge, then the candidate knowledge is transmitted to the test range; the correctness of the candidate knowledge is verified through the test range; if the candidate knowledge is verified to be correct, then the candidate knowledge is added to the knowledge graph.

[0018] According to some embodiments of this application, the acquisition of knowledge data includes: acquiring knowledge data from an internal database and an external database; uniformly numbering the knowledge data in the internal database and the external database according to a preset numbering rule to obtain an entity dictionary and a relation dictionary, wherein the entity dictionary contains a mapping relationship between entities and numbers, and the relation dictionary contains a mapping relationship between relations and numbers.

[0019] To achieve the above objectives, a second aspect of this application proposes a knowledge completion system for a knowledge graph. The system includes: a knowledge data acquisition module, configured to acquire knowledge data and divide the knowledge data into a training set, a validation set, and a test set; wherein the knowledge data includes entities, relations, and knowledge composed of the entities and relations; a preprocessing module, configured to preprocess the entities and relations in the knowledge data using an initial vector representation model to form entity vectors and relation vectors embedded with time information; a candidate vector representation model acquisition module, configured to train the initial vector representation model using the entity vectors and relation vectors in the training set to obtain multiple candidate vector representation models; and a target vector representation model acquisition module. The module for obtaining vector representation models is used to validate multiple candidate vector representation models using the validation set, calculate the evaluation score of each candidate vector representation model, and obtain the target vector representation model based on the evaluation score. The module for constructing knowledge to be tested is used to process the entity vectors and relation vectors in the test set using the target vector representation model to construct multiple knowledge to be tested. The module for obtaining candidate knowledge is used to score and rank the multiple knowledge to be tested using a scoring function to obtain candidate knowledge. The module for testing candidate knowledge is used to test the candidate knowledge, obtain the test results, and determine whether the candidate knowledge needs to be added to the knowledge graph based on the test results.

[0020] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the knowledge graph knowledge completion method described in the first aspect embodiment.

[0021] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the knowledge graph knowledge completion method described in the first aspect of the embodiment.

[0022] The knowledge completion method, system, electronic device, and storage medium proposed in this application can preprocess the data in the knowledge data to form entity vectors and relation vectors embedded with time information. These entity and relation vectors are divided into training, validation, and test sets. An initial vector representation model is trained using the training set, with the knowledge vectors composed of entity and relation vectors as the training target. The parameters of the training model are continuously adjusted. A target vector representation model is selected from multiple candidate vector representation models obtained through the validation set. The target vector representation model constructs and scores the entity and relation vectors in the test set, outputting valid security knowledge. This output is then compared with a public knowledge base to determine whether the corresponding security knowledge needs to be added to the security knowledge graph. Therefore, the embodiments of this application can embed time information into entities and relations in the security knowledge graph, thereby better revealing the evolutionary patterns of the security knowledge graph based on time information, strengthening the temporal correlation of entities and relations, and establishing a more complete security knowledge graph, providing more effective support for the prediction and prevention of security problems. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the structure of the knowledge graph knowledge completion system provided in the embodiments of this application;

[0024] Figure 2 This is a flowchart of the knowledge graph knowledge completion method provided in the embodiments of this application;

[0025] Figure 3 yes Figure 2 The flowchart of step S102 in the document;

[0026] Figure 4 yes Figure 3 The flowchart of step S205 in the document;

[0027] Figure 5 yes Figure 2 Another flowchart of step S102 in the process;

[0028] Figure 6 yes Figure 5 The flowchart of step S404 in the document;

[0029] Figure 7 yes Figure 2 The flowchart of step S103 in the process;

[0030] Figure 8 yes Figure 7 The flowchart of step S604 in the process;

[0031] Figure 9 yes Figure 2 The flowchart of step S104 in the process;

[0032] Figure 10 This is a diagram illustrating the calculation steps for the MRR index value;

[0033] Figure 11 yes Figure 2 The flowchart of step S105 in the process;

[0034] Figure 12 yes Figure 2 The flowchart of step S106 in the process;

[0035] Figure 13 yes Figure 2 The flowchart of step S107 in the process;

[0036] Figure 14 It is a flowchart that shows the results of the comparison analysis;

[0037] Figure 15 It is a flowchart for acquiring knowledge data;

[0038] Figure 16 This is a schematic diagram of the functional modules of the knowledge graph knowledge completion system provided in the embodiments of this application;

[0039] Figure 17 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0041] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0043] A security knowledge graph is a security knowledge base built on graph theory and artificial intelligence technology. It integrates and represents security knowledge and information in the form of a graph, including various security data sources such as threat intelligence, vulnerability information, attack behavior, and security device logs. Security knowledge graphs can automatically learn and reason about security knowledge, helping security teams achieve security management and operational tasks such as security situation awareness, threat warning, and incident response.

[0044] Embedding temporal information into security knowledge graphs can increase the timeliness and accuracy of security knowledge. Security events and threats are time-sensitive, meaning they change over time. Therefore, embedding temporal information into security knowledge graphs allows security data and knowledge to have a temporal sequence, better reflecting the changing trends and evolutionary patterns of security events and threats, and helping security teams to promptly discover and respond to security threats. For example, relationships can be sequentially pieced together according to their occurrence order, which can reconstruct the process of a security event to some extent. However, simply piecing together the sequential occurrence order of relationships in security knowledge cannot fully utilize temporal information in some special application scenarios, nor can it completely reflect the evolution of security knowledge over time.

[0045] For example, suppose there are two security events, A and B, where security event A occurred on May 6, 2021, and security event B occurred on December 15, 2022. Simply piecing them together in chronological order might yield a description like "Security event A occurred, then security event B occurred." However, this description doesn't provide specific time information for the occurrence of security events A and B, nor does it provide the time interval between them, failing to support the reconstruction of the security event timeline. Embedding time information into the entities of security events A and B provides a more complete description, such as "On May 6, 2021, security event A occurred, and then on December 15, 2022, security event B occurred." This description helps establish a timeline of security events, allowing understanding of their development and evolution trends.

[0046] Therefore, simply piecing together the relationships in security knowledge according to their order of occurrence is insufficient. It is also necessary to embed the entities of security knowledge with time information to provide complete security event information, support the reconstruction of the timeline of security events, and better address the issues of security event analysis and knowledge completion in the security knowledge graph.

[0047] Based on this, embodiments of this application provide a knowledge completion method, system, electronic device, and storage medium for knowledge graphs, which can enhance the temporal relevance of entities and relationships, thereby establishing a more complete security knowledge graph.

[0048] The knowledge completion method, system, electronic device, and storage medium for knowledge graphs provided in this application are specifically described through the following embodiments. First, the knowledge completion system for knowledge graphs in this application is described.

[0049] Please refer to Figure 1 The knowledge graph knowledge completion system in this embodiment includes a training module 101, a verification module 102, a testing module 103, a processing module 104, and a completion module 105.

[0050] In some embodiments, the training module 101 is used to input the knowledge (including entities and relations) in the training set into the initial vector representation model. The initial vector representation model embeds temporal information into entities and relations and converts them into entity vectors and relation vectors accordingly. In some embodiments, the training module 101 can continuously update the representation vectors of security knowledge through training to achieve better security knowledge vector representation results. In some embodiments, the training module 101 can also preset the number of training rounds to select candidate vector representation models from all training models, so that the verification module 102 can further select candidate vector representation models.

[0051] In some embodiments, the verification module 102 is used to input the knowledge in the verification set into the candidate vector representation model trained by the training module 101, calculate the MRR value (Mean Reciprocal Rank), and select the target vector representation model from the multiple candidate vector representation models trained by the training module 101, so that the test module 103 uses the target vector representation model for subsequent testing of knowledge by the test module 103.

[0052] In some embodiments, the testing module 103 is used to randomly replace and combine the knowledge in the test set using the target vector representation model selected by the verification module 102, and to score the output security knowledge representation vector to obtain candidate knowledge for the completion module 105 to complete.

[0053] It is understood that the processing module 104 may include a memory for storing instructions and data. For example, it may store instructions for dividing knowledge data into training, validation, and test sets, as well as instructions for inputting knowledge from the training, validation, and test sets into the corresponding models. In some embodiments, the memory in the processing module 104 is a cache memory. This memory can store instructions or data that the processing module 104 has just used or is reusing. If the processing module 104 needs to reuse an instruction or data, it can directly retrieve it from the memory, avoiding repeated access and reducing the waiting time of the processing module 104, thus improving system efficiency. In some embodiments, the processing module 104 may also control the training module 101, validation module 102, testing module 103, and completion module 105 according to operation instructions, so that the knowledge graph completion system can successfully complete the knowledge completion operation.

[0054] In some embodiments, the completion module 105 is used to verify candidate knowledge and determine whether the candidate knowledge needs to be added to the knowledge graph based on the verification result. Specifically, if the corresponding candidate knowledge already exists in the preset knowledge base, the completion module 105 can add the candidate knowledge to the knowledge graph; if the corresponding candidate knowledge does not exist in the preset knowledge base, the completion module 105 will first send the candidate knowledge to the target range for verification. If the candidate knowledge is valid, the candidate knowledge will be added to the knowledge graph.

[0055] The knowledge graph knowledge completion method in this application can be illustrated through the following embodiments.

[0056] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. For example, when obtaining user-stored data and user cached data access requests, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application need to obtain sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to a confirmation page. Only after obtaining the user's separate permission or consent is the necessary user-related data for the normal operation of embodiments of this application obtained.

[0057] Figure 2 This is an optional flowchart of the knowledge graph knowledge completion method provided in the embodiments of this application. Figure 2 The method may include, but is not limited to, steps S101 to S107.

[0058] Step S101: Obtain knowledge data and divide the knowledge data into training set, validation set and test set; wherein, knowledge data includes entities, relations and knowledge composed of entities and relations;

[0059] Step S102: The entities and relations in the knowledge data are preprocessed using the initial vector representation model to form entity vectors and relation vectors embedded with time information;

[0060] Step S103: Train the initial vector representation model using the entity vectors and relation vectors in the training set to obtain multiple candidate vector representation models;

[0061] Step S104: Validate multiple candidate vector representation models using a validation set to calculate the evaluation score of each candidate vector representation model, and obtain the target vector representation model based on the evaluation score.

[0062] Step S105: Process the entity vectors and relation vectors in the test set using the target vector representation model to construct multiple pieces of knowledge to be tested;

[0063] Step S106: Score and rank multiple pieces of knowledge to be tested using a scoring function to obtain candidate knowledge;

[0064] Step S107: Test the candidate knowledge, obtain the test results, and determine whether the candidate knowledge needs to be added to the knowledge graph based on the test results.

[0065] In some embodiments, knowledge data can refer to data in a security knowledge database or data in other knowledge databases. Examples include the CWE (Common Weakness Enumeration), CVE (Common Vulnerabilities and Exposures database), ENVD (Environment Variable and Development Libraries Vulnerabilities Database), OSVDB (Open Source Vulnerability Database), etc. These databases facilitate users' understanding and remediation of vulnerabilities by centrally collecting, organizing, and publishing vulnerability information, thereby reducing the risk of attacks. It is understood that knowledge data can be data collected within databases within each company, or knowledge data from widely accepted knowledge databases.

[0066] It is understood that the entities in this application include both head entities and tail entities. In some embodiments, knowledge data includes a dataset composed of head entities, tail entities, and relations. Head entities, tail entities, and relations constitute security knowledge, and multiple pieces of security knowledge constitute a security knowledge graph. In some embodiments, a security knowledge graph is an information representation method based on knowledge graphs, used to describe various entities, concepts, and relations in the security domain, wherein head entities, relations, and tail entities are important components of the security knowledge graph.

[0067] Specifically, a head entity typically represents the starting point of an entity or concept, such as a vulnerability, an attacker, or malware; a relation represents the semantic relationship between the head and tail entities, such as "attack," "exploitation," or "dependency"; and a tail entity represents the associated entity or concept of the head entity, such as a victim, a vulnerability remediation solution, or a security tool.

[0068] For example, in a security knowledge graph, "attacker" is the head entity, which can be a specific person or organization; "vulnerability" is the tail entity, which can be a victim's computer system, server, network device, etc.; and "attack" represents the relationship between the head and tail entities. In another embodiment, vulnerability is the head entity, exploitation behavior is the relationship, and attacker is the tail entity. Specifically, the head entity can be a specific vulnerability number or vulnerability name, the relationship can be "exploitation," "attack," etc., and the tail entity can be the attacker's identity, IP address, attack method, etc.

[0069] Understandably, by using head entities, relationships, and tail entities to represent security knowledge graphs, security researchers can better understand and analyze various security incidents, threats, and attack methods, thereby enabling them to better perform threat intelligence analysis, security vulnerability management, and attack detection.

[0070] Furthermore, since security knowledge is time-sensitive, embedding time information into the representation of security knowledge can enrich the expression of security information. In this application, time information is embedded into entities, and then relations are concatenated according to the order of occurrence, thereby realizing the simultaneous embedding of time information into entities and relations, so as to facilitate a more comprehensive analysis of security events through time information.

[0071] In some embodiments, the initial vector representation model can be the TransE model (Translating Embeddings Model), the DistMult model (Distributed Multi-Relation Embeddings Model), the SimpleE model (Simple Embeddings Model), etc. In this application embodiment, the TransE model is used to train, verify, and test security knowledge. It should be noted that the method of this application is also applicable to models other than the TransE model.

[0072] Understandably, the initial vector representation model is E. h +R=E t , of which E h R is the head entity vector, R is the relation vector, and E is the head entity vector. t The tail entity vector. In some embodiments, data from the knowledge data can be input into the initial vector representation model to obtain entity vectors and relation vectors embedded with time information.

[0073] Specifically, an entity can include ontology information and descriptive information. For example, ontology information can be the entity's own attributes, identifiers, and other relevant information, while the entity's descriptive information provides a more detailed description and explanation of the entity. In some embodiments, ontology information can refer to various entities, concepts, and objects in the security domain, such as vulnerabilities, attackers, victims, and malware; while the entity's descriptive information provides a more detailed description and explanation of the entity, including information about the entity's attributes, characteristics, behaviors, and impacts. For example, for an attacker entity, its ontology information can be basic attribute information such as the attacker's IP address, identity, and attack history, while its descriptive information can include more detailed information such as the attacker's attack methods, malicious behaviors, attack targets, and attack patterns.

[0074] Furthermore, the following formula illustrates how to embed time information into entities to form an entity vector with embedded time information:

[0075]

[0076] Here, E is the expression for the entity vector, consisting of two parts: the first part is an n-α dimensional vector e[n-α], and the second part is an α dimensional vector e[α]. That is, in some embodiments, ontology information can be represented in n-α dimensions, transformed into an ontology vector e[n-α]; description information can be represented in α dimensions, transformed into a first description vector e[α], and the second description vector, after embedding the description information into a time vector, is represented by e[α]*σ(at+b). In some embodiments, α can be set and adjusted as needed to adjust the dimensionality ratio of the ontology vector in the entity vector.

[0077] Generally, since ontology information is the foundation and core of security knowledge, the ontology vector corresponding to the ontology information should occupy more than 50% of the dimension in the entity information to ensure the effective expression of the ontology information. Therefore, assuming the overall dimension of the entity vector is n-dimensional, the value of α is generally less than n / 2. Further, σ, a, and b are the initial model parameters corresponding to the initial vector representation model used for vector transformation of entities, used to activate the temporal information in the description information and optimize the vector expression form of the description information. Further, σ is the activation function, which can be selected based on the performance of the training model in different scenarios. In network security applications, the sin function can be chosen as the activation function because it better simulates the changing state of temporal features. Further, a and b are parameters that are automatically adjusted by the model learning and are preset. In some embodiments, both a and b can be obtained from the initial vector representation model.

[0078] Further, t represents time information, specifically the year, month, and day corresponding to the time when the security knowledge occurred. More specifically, it can be accurate to the hour, minute, and second. This application embodiment does not impose specific limitations on this. In some embodiments, t is used to represent the year, month, and day when the security knowledge occurred: If the time when a piece of security knowledge occurred is December 15, 2021, after initializing the time information, the corresponding time information is represented as 2021, 12, and 15, respectively, and embedded into the entity's description information using formula (1). Then, the description information embedded with the time information is concatenated with the ontology information to form an entity vector embedded with time.

[0079] In some embodiments, a relationship can be divided into three parts: the relationship itself, its preceding relationships, and its following relationships. In some embodiments, a relationship can represent the direct connection between the head and tail entities of the current relationship; the preceding relationships represent the relationships between the current entity and other entities prior to the current entity; and the following relationships represent the relationships between the current entity and other entities subsequently. For example, in an attack event, the relationship can represent the attack behavior relationship between the attacker and the victim. The preceding relationships can represent the relationships between the attacker and other entities prior to the attack, such as the attacker having previously collaborated with other hacker groups or obtaining information about the victim through social engineering. The following relationships can represent the relationships between the attacker and other entities subsequently, such as the attacker selling the obtained confidential information to other hackers or organizations after a successful attack.

[0080] In another embodiment, in a vulnerability exploitation scenario, a relationship can be represented as the relationship between a vulnerability and its exploitation. Further, the preceding relationships can represent the relationships between the vulnerability and other preceding entities; for example, a vulnerability might be due to programmer negligence or a design flaw. The following relationships can represent other security problems that may arise after the vulnerability is exploited; for example, an attacker might use the vulnerability to obtain confidential information or control the victim's computer system. It is understood that by analyzing and processing relationships, their preceding relationships, and their following relationships, a more comprehensive and in-depth understanding of security events and threats can be achieved, thereby enabling better security event analysis and threat intelligence research.

[0081] Furthermore, the following formula illustrates how to concatenate relationships sequentially according to their occurrence order to form a relationship vector embedding time information.

[0082]

[0083] Here, R is the expression for the relation vector, consisting of three parts: the first part is a β-dimensional vector r[β], the second part is an m-2β-dimensional vector r[m-2β], and the third part is a β-dimensional vector r[β]. That is, in some embodiments, the preceding relation can be represented by β dimensions, transformed into the preceding relation vector r[β]; the relation can be represented by an m-2β vector, transformed into the current relation vector r[m-2β]; and the following relation can be represented by β dimensions, transformed into the following relation vector r[β]. In some embodiments, β can be set and adjusted as needed to adjust the dimensional proportions of the preceding, current, and following relation vectors in the relation vector.

[0084] For ease of understanding, both the preorder and postorder relations of a relation are represented using β dimensions. However, this does not mean that the β dimensions representing the preorder and postorder relations are the same; it is simply to illustrate that the relation, its preorder and postorder relations, and their corresponding current, preorder, and postorder relation vectors are concatenated into an m-dimensional vector (m is a positive integer greater than or equal to 3). In some embodiments, a relation can be represented using m-2β dimensions, and both the preorder and postorder relations can be represented using β dimensions. Furthermore, the current relation vector can be represented by r[m-2β], and the preorder and postorder relation vectors can be represented by r[β].

[0085] In some embodiments, knowledge data can be divided into a training set, a validation set, and a test set. The knowledge in the training set is used to train an initial vector representation model, resulting in multiple trained models. Multiple candidate vector representation models are then selected from these trained models. In some embodiments, a target candidate vector representation model is selected from the multiple candidate models using the validation set. In some embodiments, knowledge data from the test set is used to test the target candidate vector representation model, thereby obtaining candidate knowledge.

[0086] In some embodiments, negative sampling can be used, that is, head entities, tail entities or relations can be randomly selected from the knowledge data of the training set, and these head entities, tail entities or relations can be input into the initial vector representation model to output entity vectors embedded in time or relation vectors concatenated in chronological order.

[0087] Specifically, entities in knowledge data can be represented by an initial vector model, and the output of equation (1) becomes an entity vector with embedded time information. Relationships in knowledge can be represented by an input initial vector model, and the output of equation (2) becomes a relation vector that is sequentially concatenated according to the order of occurrence in time.

[0088] In some embodiments, the initial vector representation model can be trained by selecting different entities and relations from the training set as inputs. That is, head entities, tail entities, or relations can be randomly selected from the knowledge data in the training set and input into the initial vector representation model, while continuously performing replacement training to generate multiple training models. By continuously adjusting the model parameters, the knowledge representation vector updated during training can achieve Ei. h +R=E t The representation effect, where E h R is the head entity vector, R is the relation vector, and E is the head entity vector. t This is the tail entity vector.

[0089] Furthermore, a preset number of rounds can be set, and the training model is saved every time the first training round is reached. For example, the preset number of rounds can be set to save the training model at the 20th training round as a candidate vector representation model every 20 rounds. When the cumulative number of the first training rounds reaches the second training round, the training of the initial vector representation model is stopped, and the multiple candidate vector representation models saved during the training process are summarized and saved.

[0090] In some embodiments, knowledge from the validation set can be used to perform replacement validation on multiple candidate vector representation models, and an evaluation score can be calculated for each candidate vector representation model. Specifically, the MRR (Mean Reciprocal Rank) or NDCG (Normalized Discounted Cumulative Gain) value can be calculated for multiple candidate vector representation models, and the calculated value is the score of each model. Further, the candidate vector representation model with the highest MRR or NDCG value can be selected as the target vector representation model. Alternatively, depending on the requirements, it is not necessary to select the vector representation model with the highest score as the target vector representation model; selection can be made according to the needs. It is understood that multiple target vector representation models can also be selected, and this application embodiment does not impose specific limitations on this.

[0091] In some embodiments, after selecting a target vector representation model, the model can be tested using knowledge data from a test set. Specifically, entities or relations from the test set can be input into the target vector representation model to obtain target entity vectors and target relation vectors. The target entity vectors and target relation vectors can then be constructed using the target vector representation model to obtain multiple pieces of knowledge to be tested. It is understood that after randomly or sequentially constructing and combining the target entity vectors and target relation vectors, multiple pieces of knowledge E are obtained. h +R=E t Or approaching knowledge E h +R=E t The expression is used as the knowledge to be tested, where E h R is the head entity vector, R is the relation vector, and E is the head entity vector. t This is the tail entity vector.

[0092] Furthermore, the scoring function of the TransE model can be used to score and rank multiple pieces of knowledge to be tested, and the knowledge with the highest score can be selected as candidate knowledge. Furthermore, the scoring functions of the DistMult model and the SimpleE model can also be used to score and rank multiple pieces of knowledge to be tested; this application does not impose specific limitations on this.

[0093] In some embodiments, candidate knowledge can be compared with public knowledge bases, such as the CWE (Common Weakness Enumeration), CVE (Common Vulnerabilities and Exposures Database), ENVD (Environment Variable and Development Library Vulnerabilities Database), OSVDB (OpenSourced Vulnerability Database), etc. Furthermore, if the comparison result shows that the candidate knowledge exists in a corresponding public knowledge base, it indicates that the corresponding candidate knowledge is valid. At this point, the candidate knowledge is added to the knowledge graph. This knowledge graph can be one set up and run internally by the enterprise or laboratory, or it can be a knowledge graph in a public knowledge base that is yet to be improved.

[0094] Furthermore, if the candidate knowledge cannot be found in the public knowledge base, meaning the corresponding candidate knowledge does not exist in the public knowledge base, then the candidate knowledge can be verified on the virtual simulation platform of the test range. If the verification on the virtual simulation platform of the test range is successful, the candidate knowledge is valid and can be added to the knowledge graph. If the verification on the virtual simulation platform of the test range is unsuccessful, the candidate knowledge can be verified repeatedly up to a preset number of times. If the candidate knowledge is verified as valid in the test range within the preset number of times, then the candidate knowledge is valid and can be added to the knowledge graph. If the candidate knowledge is verified as unsuccessful in the test range after the preset number of times, then the corresponding candidate knowledge is invalid and should be discarded.

[0095] The knowledge completion method, system, electronic device, and storage medium proposed in this application can preprocess the data in the knowledge data to form entity vectors and relation vectors embedded with time information. These entity and relation vectors are divided into training, validation, and test sets. An initial vector representation model is trained using the training set, with the knowledge vectors composed of entity and relation vectors as the training target. The parameters of the training model are continuously adjusted. A target vector representation model is selected from multiple candidate vector representation models obtained through the validation set. The target vector representation model constructs and scores the entity and relation vectors in the test set, outputting valid security knowledge. This output is then compared with a public knowledge base to determine whether the corresponding security knowledge needs to be added to the security knowledge graph. Therefore, the embodiments of this application can embed time information into entities and relations in the security knowledge graph, thereby better revealing the evolutionary patterns of the security knowledge graph based on time information, strengthening the temporal correlation of entities and relations, and establishing a more complete security knowledge graph, providing more effective support for the prediction and prevention of security problems.

[0096] Reference Figure 3 In some embodiments, the entity includes ontology information and description information; step S102 includes, but is not limited to, steps S201 to S205:

[0097] Step S201: Obtain the ontology information corresponding to the entity and convert the ontology information into an ontology vector;

[0098] Step S202: Obtain the description information corresponding to the entity and convert the description information into a first description vector;

[0099] Step S203: Obtain the time information corresponding to the entity information, input the time information into the activation function to obtain the time vector, and the activation function contains the initial vector representing the initial model parameters corresponding to the model;

[0100] Step S204: Multiply the first description vector and the time vector to obtain the second description vector after embedding time information;

[0101] Step S205: Concatenate the ontology vector with the second description vector to obtain the entity vector with embedded time information.

[0102] In some embodiments, the expression for obtaining the entity vector after embedding time information into the entity is as follows:

[0103]

[0104] Here, E is the expression for the entity vector, consisting of two parts: the first part is an n-α dimensional vector e[n-α], and the second part is an α dimensional vector e[α]. That is, in some embodiments, ontology information can be represented in n-α dimensions, transformed into an ontology vector e[n-α]; description information can be represented in α dimensions, transformed into a first description vector e[α], and the second description vector, after embedding the description information into a time vector, is represented by e[α]*σ(at+b). In some embodiments, α can be set and adjusted as needed to adjust the dimensionality ratio of the ontology vector in the entity vector.

[0105] Generally, since ontology information is the foundation and core of security knowledge, the ontology vector corresponding to the ontology information should occupy more than 50% of the dimension in the entity information to ensure the effective expression of the ontology information. Therefore, assuming the overall dimension of the entity vector is n-dimensional, the value of α is generally less than n / 2. Further, σ, a, and b are the initial model parameters corresponding to the initial vector representation model used for vector transformation of entities, used to activate the temporal information in the description information and optimize the vector expression form of the description information. Further, σ is the activation function, which can be selected based on the performance of the training model in different scenarios. In network security applications, the sin function can be chosen as the activation function because it better simulates the changing state of temporal features. Further, a and b are parameters that are automatically adjusted by the model learning and are preset. In some embodiments, both a and b can be obtained from the initial vector representation model.

[0106] Further, t represents time information, specifically the year, month, and day corresponding to the time when the security knowledge occurred. More specifically, it can be accurate to the hour, minute, and second. This application embodiment does not impose specific limitations on this. In some embodiments, t is used to represent the year, month, and day when the security knowledge occurred: If the time when a piece of security knowledge occurred is December 15, 2021, after initializing the time information, the corresponding time information is represented as 2021, 12, and 15, respectively, and embedded into the entity's description information using formula (1). Then, the description information embedded with the time information is concatenated with the ontology information to form an entity vector embedded with time.

[0107] Furthermore, 2021, 12, and 15 can be substituted as t into e[α]*σ(at+b) respectively to obtain e[α]*σ(2021a+b), e[α]*σ(12a+b), and e[α]*σ(2021a+b). These three equations are then added together, i.e., e[α]*σ(2021a+b)+e[α]*σ(12a+b)+e[α]*σ(2021a+b). The result is then concatenated with e[n-α] to obtain the entity vector with embedded time information.

[0108] It is understandable that the above expression can be used to transform either the head entity or the tail entity, thereby forming a head entity vector or a tail entity vector with embedded time information.

[0109] In some embodiments, the dimension of the ontology vector is a first preset dimension, and the dimension of the first description vector is N - the first preset dimension, so that the first preset dimension plus the dimension of the first description vector equals N dimensions, that is, the dimension of the entity vector is N dimensions. Furthermore, since entity information is divided into ontology information and description information, entity information includes at least two dimensions; therefore, N is a positive integer greater than or equal to 2.

[0110] Understandably, by inputting time information into an activation function to obtain a time vector, and then embedding this time vector into the entity's description information, the time when security knowledge occurs can be recorded. This establishes a connection with relationships concatenated sequentially, enabling timely updates and maintenance of security knowledge. Furthermore, by embedding time information into the entities and relationships of security knowledge, security events can be traced and their origins identified, allowing for better prevention and response to similar incidents.

[0111] Reference Figure 4 Step S205 includes, but is not limited to, steps S301 to S302:

[0112] Step S301: Obtain the first preset dimension adjustment instruction;

[0113] Step S302: Adjust the first preset dimension according to the first preset dimension adjustment instruction to adjust the dimension ratio of the ontology vector in the entity vector.

[0114] In some embodiments, an entity may include ontology information and descriptive information, and the first preset dimension is the dimension of the ontology vector. In some embodiments, the dimension of the ontology vector may refer to the number of features contained in the ontology vector. These features may be attributes, relationships, semantics, etc. of the ontology. Different numbers of features will affect the expressive power of the ontology vector and the training effect of the model. For example, if the number of features of the ontology is too large, it may lead to an excessively high dimension of the ontology vector, thereby increasing the complexity of training the initial vector representation model. Conversely, if the number of features of the ontology is too small, it may lead to an inaccurate representation of the ontology vector, resulting in inaccurate prediction results of the model. Therefore, during the training of various initial vector representation models, candidate vector representation models, etc. of this application, the first preset dimension of the entity can be appropriately adjusted to supplement missing ontology information, delete redundant ontology information, or readjust the dimension of the ontology vector to optimize the expressive effect of the model and increase the accuracy of the initial vector representation model training.

[0115] In some embodiments, the ontology vector can also be adjusted based on changes in entities within the security knowledge. It is understood that the ontology vector can be adjusted manually or through a machine model trained on a neural network. Furthermore, the dimensionality ratio of the ontology vector within the entity vector can be adjusted through feature selection, feature scaling, feature combination, and other methods.

[0116] In some embodiments, the first preset dimension can be adjusted according to a first preset dimension adjustment command issued during the training process of the initial vector, thereby adjusting the dimensionality ratio of the ontology vector in the entity vector. In another embodiment, the first preset dimension adjustment command can be issued manually to adjust the first preset dimension. Furthermore, the dimension of the first description vector or the second description vector can also be adjusted; the specific adjustment method is the same as described above for adjusting the first preset dimension, and will not be repeated here.

[0117] Please refer to Figure 5 In another embodiment, step S102 includes, but is not limited to, steps S401 to S404:

[0118] Step S401: Obtain the relation and transform it to obtain the current relation vector;

[0119] Step S402: Obtain the preceding relation of the relation, and transform it into a preceding relation vector; the preceding relation is the relation that occurred before the relation.

[0120] Step S403: Obtain the subsequent relation of the relation, and transform it into a subsequent relation vector; the subsequent relation is the relation that occurs after the relation.

[0121] Step S404: The preceding relation vector, the current relation vector, and the following relation vector are concatenated sequentially to obtain a relation vector with embedded time information.

[0122] Specifically, the preceding relationship in a relation refers to the connection between a preceding element and a following element. For example, in an attack, an attacker typically exploits vulnerabilities to attack a victim's system; therefore, the preceding relationship between the attacker and the victim is a "vulnerability exploitation relationship." Conversely, the following relationship in a relation refers to the connection between a following element and a preceding element. For instance, in a network, routers are often used to connect different network devices; therefore, the following relationship between the router and other devices is a "connection relationship." For example, suppose an attack occurs on a corporate system where an attacker exploits a vulnerability to attack a server within the company and steals sensitive information. The relationship between the attacker and the victim server is an "attack relationship," the preceding relationship is a "vulnerability exploitation relationship," and the following relationship is a "victimized relationship." It is understandable that in the field of security protection, analyzing relationships, their preceding relationships, and their following relationships can help detect and prevent similar attacks in a timely manner.

[0123] Furthermore, the preceding relation vector, the current relation vector, and the following relation vector can be concatenated sequentially to obtain a relation vector embedding time information, as shown in the following expression (2):

[0124]

[0125] Here, R is the expression for the relation vector, consisting of three parts: the first part is a β-dimensional vector r[β], the second part is an m-2β-dimensional vector r[m-2β], and the third part is a β-dimensional vector r[β]. That is, in some embodiments, the preceding relation can be represented by β dimensions, transformed into the preceding relation vector r[β]; the relation can be represented by an m-2β vector, transformed into the current relation vector r[m-2β]; and the following relation can be represented by β dimensions, transformed into the following relation vector r[β]. In some embodiments, β can be set and adjusted as needed to adjust the dimensional proportions of the preceding, current, and following relation vectors in the relation vector.

[0126] For ease of understanding, both the preorder and postorder relations of a relation are represented using β dimensions. However, this does not mean that the β dimensions representing the preorder and postorder relations are the same; it is simply to illustrate that the relation, its preorder and postorder relations, and their corresponding current, preorder, and postorder relation vectors are concatenated into an m-dimensional vector (m is a positive integer greater than or equal to 3). In some embodiments, a relation can be represented using m-2β dimensions, and both the preorder and postorder relations can be represented using β dimensions. Furthermore, the current relation vector can be represented by r[m-2β], and the preorder and postorder relation vectors can be represented by r[β].

[0127] In some embodiments, the dimension of the preceding relation vector is the first relation dimension, the dimension of the following relation vector is the second relation dimension, and the current vector relation is M - the first relation dimension - the second relation dimension. Further, the first relation dimension, the second relation dimension, and the current vector relation are added together to obtain M, meaning the relation vector has M dimensions. It is understandable that, since a relation is at least divided into a relation, its preceding relation, and its following relation, M should be set to a positive integer greater than or equal to 3.

[0128] Please refer to Figure 6 Step S404 includes, but is not limited to, steps S501 to S502:

[0129] Step S501: Obtain the relationship dimension adjustment instruction;

[0130] Step S502: According to the relation dimension adjustment instruction, adjust the first relation dimension and / or the second relation dimension to adjust the dimensional proportions of the preceding relation vector, the current relation vector, and the subsequent relation vector in the relation vector.

[0131] Understandably, because security knowledge is constantly updated, and the dimensions of relationships can be manually defined or modified by machine learning models, incorrect relationship dimension definition can lead to situations where security knowledge fails to adequately represent the connections between relationships and entities, thus impacting the predictive performance during model training. Therefore, it is possible to receive relationship dimension adjustment instructions sent internally to the system or during model training to readjust the relationship dimensions and optimize the performance of the trained model.

[0132] Therefore, during the training of various initial vector representation models and candidate vector representation models of this application, the first relation dimension and / or the second relation dimension can be appropriately adjusted to optimize the model's expressive effect and increase the accuracy of the initial vector representation model training.

[0133] In some embodiments, the dimension of the preceding relation vector is the first relation dimension, and the dimension of the following relation vector is the second relation dimension. Further, the dimension of the preceding relation vector, the dimension of the following relation vector, or both can be adjusted according to relation dimension adjustment instructions. Further, the relation dimensions can be adjusted using rules of thumb, visualization methods, or methods based on the characteristics of the knowledge data and task requirements.

[0134] Please refer to Figure 7 Step S103 includes, but is not limited to, steps S601 to S604:

[0135] Step S601: Based on the training set, obtain multiple entity vectors and multiple relation vectors;

[0136] Step S602: Using the knowledge vector composed of entity vectors and relation vectors as the training target, replace the vectors or relation vectors in the knowledge vector with multiple entity vectors or multiple relation vectors respectively.

[0137] Step S603: Adjust the initial vector representation of the initial model parameters according to the training objective to obtain the training model, which is one round of training. Repeat this process for multiple rounds of training.

[0138] Step S604: Count the number of training rounds. When the number of training rounds reaches the preset number of rounds, stop training and use the multiple training models saved during the training process as candidate vector representation models.

[0139] In some embodiments, the knowledge vector is E h +R=E t , is the canonical expression for entity vector, relation vector, and tail entity vector.

[0140] In some embodiments, a subset of samples can be obtained from the training set, and each sample can be negatively sampled. In some embodiments, multiple entities or relations from the training set can be input into the initial vector representation model to obtain a knowledge vector composed of corresponding entity vectors and relation vectors. In some embodiments, entity vectors or relation vectors in the initial vector representation model can be used to replace entity vectors or relation vectors in the knowledge vector during training. The initial vector representation model adjusts the replaced head entity vectors, tail entity vectors, or relation vectors based on the unreplaced head entity vectors, tail entity vectors, or relation vectors in the knowledge vector. The adjustment is made by continuously adjusting the initial model parameters so that the equation formed by the replaced head entity vectors, tail entity vectors, or relation vectors and the unreplaced head entity vectors, tail entity vectors, or relation vectors can approach the knowledge vector E. h +R=E tThe expressive effect.

[0141] For example, if the knowledge vector is head entity vector #1 + relation vector #1 = tail entity vector #1, then replacing head entity vector #1 in the knowledge vector with head entity vector #2 from the training set yields the new equation: head entity vector #2 + relation vector #1 = tail entity vector #1. Therefore, to ensure that the equation obtained by replacing head entity vector #1 with head entity vector #2 still satisfies the condition of knowledge vector E... h +R=E t If true, the initial vector means that the model will continuously adjust the initial model parameters to make the knowledge vector true.

[0142] Understandably, the initial vector representation model is one where the equation formed by the replaced head entity vector, tail entity vector, or relation vector, and the unreplaced head entity vector, tail entity vector, or relation vector most closely approximates the knowledge vector E. h +R=E t With the goal of training, by continuously replacing the head entity vector, tail entity vector, or relation vector in the knowledge vector and constantly adjusting the initial model parameters, multiple training models will be obtained. That is to say, during the training of the initial vector representation model, the model's output data can be used to determine whether it achieves Ei. h +R=E t The representation effect is adjusted in real time to optimize the training model's parameters, thereby ensuring that the input initial vector represents each piece of knowledge in the model to achieve E. h +R=E t The representation effect is used to obtain multiple different, continuously optimized training models. In some embodiments, negative sampling can be used during the training of the initial vector representation model, allowing the initial vector representation model to learn more knowledge information. In some embodiments, when the training model has difficulty converging, the model parameters can be adjusted to achieve the purpose of rapid training, thereby obtaining multiple different, continuously optimized training models.

[0143] In some embodiments, entity vectors or relation vectors in the training set can be replaced accordingly, and the initial vectors representing the initial model parameters can be adjusted according to the training objective to obtain the training model, which serves as one round of training. It is understood that when the preset number of training rounds has not been reached, this process needs to be repeated to perform multiple rounds of training to obtain multiple training models.

[0144] In some embodiments, the number of training epochs can be counted, and multiple training models obtained during the training process can be saved. Further, when the number of training epochs reaches a preset number, such as 200 training epochs, the training of the initial vector representation model is stopped, and the multiple training models saved during the training process are used as candidate vector representation models.

[0145] It is understandable that the initial vector representation model obtains a large number of samples through negative sampling, including knowledge from the training set, validation set, and test set. Therefore, each training model can contain knowledge vectors corresponding to all knowledge in the training set, validation set, and test set, as well as the corresponding numbers of all knowledge vectors obtained through entity dictionary and relation dictionary.

[0146] Please refer to Figure 8 In some embodiments, the preset number of rounds includes a first training round and a second training round, wherein the second training round is greater than the first training round; step S604 includes, but is not limited to, steps S701 to S702:

[0147] Step S701: Real-time statistics of training rounds; when the number of training rounds reaches the first training round, save the current initial vector representation model.

[0148] Step S702: When the number of training rounds reaches the second training round, stop training and obtain the candidate vector representation model based on the multiple training models saved during the training process.

[0149] In some embodiments, the number of training epochs can be counted in real time or periodically. In some embodiments, the first number of training epochs can be set to 20, and the second number of training epochs can be set to 500. It is understood that the first number of training epochs refers to the number of epochs in which the candidate vector representation model is selected, for example, the training epochs are saved every 20 epochs. It is understood that the second number of training epochs refers to the total number of training epochs for the candidate vector representation model, such as 500 epochs. It is understood that when the first number of training epochs is 20 and the second number of training epochs is 500, a total of 25 training models are saved.

[0150] In some embodiments, to avoid selecting too many training epochs, only a portion of the training models can be selected during the training process. In some embodiments, to ensure even selection of training models, the training models can be selected every first training epoch during the training of the initial vector representation model. For example, the first training epoch is 20. During the training of the initial vector representation model, the training model of the 20th epoch is saved every 20 epochs, and then the training model is saved every 20 epochs thereafter.

[0151] Understandably, when the initial vector representation model has been trained for 500 rounds, training is stopped, and the training model saved every 20 rounds in these 500 rounds is obtained. The multiple training models saved during the training process are then summarized as candidate vector representation models.

[0152] In some embodiments, multiple candidate vector representation models can be obtained, and then a target vector representation model can be selected from the multiple candidate vector representation models, so as to save computing resources while selecting the target model.

[0153] Please refer to Figure 9 In some embodiments, step S104 includes, but is not limited to, steps S801 to S802:

[0154] Step S801: Calculate the MRR index values ​​corresponding to the multiple candidate vector representation models respectively;

[0155] Step S802: The candidate vector representation model with the highest MRR index value is determined as the target vector representation model;

[0156] Please refer to Figure 10 In some embodiments, the candidate vector represents the MRR index value corresponding to the model, which can be obtained through steps S901 to S904:

[0157] Step S901: Based on multiple entity vectors or relation vectors in the candidate vector representation model, the entities or relations in the verification set are replaced to obtain multiple replaced knowledge.

[0158] Step S902: Use a scoring function to score the multiple replaced pieces of knowledge;

[0159] Step S903: Determine the ranking of the multiple replaced knowledge in the verification set based on the scoring, so as to calculate the MRR index value of the multiple replaced knowledge;

[0160] Step S904: Based on the MRR index values ​​of the multiple replaced knowledge, obtain the MRR index value of the candidate vector representation model.

[0161] It is understood that the MRR (Mean Reciprocal Rank) metric of a candidate vector representation model refers to the MRR metric calculated after processing a given dataset (the validation set in this embodiment) using the corresponding candidate vector representation model. In some embodiments, the MRR metric is one of the important indicators for measuring the performance of a candidate vector representation model. The higher the MRR metric of a candidate vector representation model, the closer the knowledge vector corresponding to the candidate vector representation model is to E. h+R=E t The effect of expression.

[0162] In some embodiments, each piece of knowledge in the validation set can be input into the candidate vector representation model. The knowledge's identifier in the entity dictionary and relation dictionary is obtained, and the corresponding head entity vector or tail entity vector is found in the candidate vector representation model based on the identifier. This yields the corresponding knowledge vector, which consists of the head entity vector, relation vector, and tail entity vector. In some embodiments, multiple knowledge vectors can be obtained by replacing the head entity vector or tail entity vector corresponding to the knowledge with all entity vectors in the candidate vector representation model. A scoring function is then used to score the knowledge vectors, and the scores of each knowledge are ranked. Finally, the MRR (Mean Relationship Ratio) value of the corresponding candidate vector representation model is calculated.

[0163] For example, suppose there are 5 candidate vector representation models, which are numbered as Model A, Model B, Model C, Model D, and Model E. Specifically, taking Model A as an example, suppose there are 15 knowledge items in the validation set, numbered from knowledge item 1 to knowledge item 15. The process of calculating the MRR index value of Model A is as follows: Input knowledge item 1 into Model A to obtain knowledge item vector E. h +R=E t Using the head entity vector E of model A h1 (In some embodiments, it can also be a tail entity vector or a relation vector) Replace the head entity vector in knowledge vector #1 to obtain the replaced knowledge vector #1 E. h1 +R=E t At this point, the scoring function is used to evaluate knowledge vector E (number 1). h1 +R=E t Scoring is performed. It is understood that Model A is used to process the remaining knowledge points 2 to 15 in the same way as knowledge point 1, and this embodiment of the application will not elaborate on this.

[0164] It is understood that the scoring function can be the scoring function of the TransE model, and in some embodiments, the scoring function of the DistMult model or the SimplE model can also be used, without any specific restrictions.

[0165] Understandably, after scoring knowledge points 1 through 15, a score can be obtained for each knowledge point. For example, knowledge point 1 is 0.91, knowledge point 2 is 0.64, knowledge point 3 is 0.88, knowledge point 4 is 0.66, knowledge point 5 is 0.57, knowledge point 6 is 0.79, knowledge point 7 is 0.99, knowledge point 8 is 0.85, knowledge point 9 is 0.92, knowledge point 10 is 0.93, knowledge point 11 is 0.81, knowledge point 12 is 0.83, knowledge point 13 is 0.86, knowledge point 14 is 0.85, and knowledge point 15 is 0.96. The MRR (Mean Responsibility Rank) value for each knowledge point is calculated by ranking it among all knowledge points in the validation set.

[0166] In some embodiments, the MRR (Mean Reciprocal Rank) value of each candidate vector representing the model can be calculated using the following formula.

[0167]

[0168] Where S represents the number of knowledge items in the validation set, i represents each corresponding knowledge item (e.g., knowledge item 1), and rank... i This represents the ranking of the scores of the replaced knowledge vector among all knowledge vectors in the validation set.

[0169] In some embodiments, using the above embodiments, i represents knowledge 1, and knowledge 1 receives a score of 0.91, ranking 5th out of 15 knowledge items. Therefore, the number of knowledge items in the validation set S = 15, the ranking rank1 = 5, and the MRR value corresponding to knowledge 1 is... It is understandable that formula (3) can be used to calculate the MRR index values ​​of the 15 knowledge points in the validation set corresponding to the candidate vector model, i.e., model A. Then, by summing the MRR index values ​​of the 15 knowledge points, the MRR index value of model A can be obtained. In some embodiments, the MRR index value of model A can be expressed as MRR. 模型A express,

[0170]

[0171] Understandably, calculating the MRR index value for multiple knowledge points of each model, i.e., accumulating the MRR index value using multiple samples, results in a more accurate target vector representation model compared to calculating the MRR index value using only one sample. This avoids the randomness of selecting the target vector representation model.

[0172] Understandably, by using the above calculation method, we can obtain the MRR index values ​​of models B, C, D, and E, and select the model with the highest MRR index value as the target vector representation model.

[0173] In some embodiments, the candidate vector representation model with the highest MRR value may not be selected as the target vector representation model. For example, the candidate vector representation model with the second highest MRR value may be selected as the target vector representation model.

[0174] It is understandable that, in addition to selecting the target vector representation model by calculating the MRR value of each candidate vector representation model, the target vector representation model can also be selected by calculating the NDCG (Normalized Discounted Cumulative Gain), MAP (Mean Average Precision), and MAP@k (Mean Average Precision at k) of each candidate vector representation model. This application does not impose specific restrictions on this.

[0175] Please refer to Figure 11 In some embodiments, step S105 includes, but is not limited to, steps S1001 to S1002:

[0176] Step S1001: Obtain the entities and relationships in the test set;

[0177] Step S1002: Input multiple entities or multiple relations into the target vector representation model to obtain multiple target entity vectors or multiple target relation vectors, and randomly combine the multiple target entity vectors or multiple target relation vectors to obtain multiple knowledge to be tested.

[0178] In some embodiments, entities and relations in a test set can be obtained, and multiple entity vectors or multiple relation vectors of the same type can be found and input into the target vector representation model based on the entity dictionary and relation dictionary. The corresponding knowledge vector is then found in the target vector representation model based on the number in the entity dictionary. In some embodiments, multiple entity vectors or multiple relation vectors in the target vector representation model can also be used to randomly combine knowledge vectors. Furthermore, multiple head entity vectors, multiple tail entity vectors, and multiple relation vectors can be randomly or sequentially constructed and combined to obtain multiple knowledge vectors E. h +R=E t Or approaching knowledge E h +R=E t The expression is used as the knowledge to be tested.

[0179] It is understandable that randomly or sequentially constructing and combining multiple head entity vectors, multiple tail entity vectors, and multiple relation vectors can provide more ways to combine the constructed knowledge to be tested, so that after the subsequent scoring function scores the knowledge to be tested, it can obtain the knowledge to be tested with a higher score as candidate knowledge.

[0180] Please refer to Figure 12 In some embodiments, step S106 includes, but is not limited to, steps S1101 to S1104:

[0181] Step S1101: Obtain the scoring function corresponding to the target vector representation model;

[0182] Step S1102: Based on the scoring function, score multiple pieces of knowledge to be tested to obtain the scoring result for each piece of knowledge to be tested;

[0183] Step S1103: Based on the scoring results, sort the multiple knowledge items to be tested to obtain the sorting results;

[0184] Step S1104: Based on the sorting results, select the knowledge to be tested corresponding to the preset sorting range as candidate knowledge.

[0185] In some embodiments, multiple pieces of knowledge to be tested can be scored and ranked using the scoring function of the TransE model, and the knowledge with the highest score can be selected as candidate knowledge. Furthermore, the scoring functions of the DistMult model and the SimpleE model can also be used to score and rank multiple pieces of knowledge to be tested; this application does not impose specific limitations on this.

[0186] This application uses the scoring function of the TransE model as an example to score and rank multiple pieces of knowledge to be tested. Specifically, the scoring function formula is as follows:

[0187] f(h,r,t)=||E h +R r -E t || l1 / l2

[0188] Where r represents the relationship between the head entity h and the tail entity t, R r E represents the relation vector at the embedding time of relation r. h E represents the head entity vector at the embedding time of the head entity h. t Let represent the tail entity vector at the embedding time of the tail entity t, l1 / l2 represent the norm l1 or l2 regularization of the TransE model, and f(h,r,t) represent the scoring function representation for the head entity vector, relation and tail entity vector.

[0189] In some embodiments, the relation vectors, head entity vectors, and tail entity vectors of multiple knowledge to be tested can be substituted into the scoring function of the TransE model. The scoring function scores each knowledge to be tested and outputs the scoring result of each knowledge to be tested one by one.

[0190] In some embodiments, the knowledge to be tested can be sorted sequentially or in reverse order based on the scoring results. In some embodiments, assuming there are 6 knowledge items to be tested, they are numbered 1 to 6 respectively. The corresponding scoring results are: 1: 0.813, 2: 0.721, 3: 0.833, 4: 0.521, 5: 0.884, and 6: 0.776. Specifically, the knowledge item with the highest score can be ranked first, the knowledge item with the second highest score can be ranked second, and so on, until the knowledge item with the lowest score is ranked last. Thus, the sorting result is: 5: 0.884, 3: 0.833, 1: 0.813, 6: 0.776, 2: 0.721, and 4: 0.521.

[0191] Furthermore, after obtaining the ranking results of multiple knowledge items to be tested, the knowledge items to be tested corresponding to the preset ranking range are selected. If the preset ranking range requires the first-ranked knowledge item to be tested to be selected as the candidate knowledge, then the fifth knowledge item to be tested is selected. If the preset ranking range requires the top three knowledge items to be tested to be selected, then the fifth, third, and first knowledge items to be tested are selected as the candidate knowledge.

[0192] Please refer to Figure 13 In some embodiments, step S107 includes, but is not limited to, steps S1201 to S1203:

[0193] Step S1201: Obtain the preset knowledge base;

[0194] Step S1202: Compare the candidate knowledge with the preset knowledge in the preset knowledge base to obtain the test results;

[0195] Step S1203: Analyze the test results. If the test results of the candidate knowledge are consistent with those of the preset knowledge, then the candidate knowledge is added to the knowledge graph.

[0196] In some embodiments, the preset knowledge base can be a CWE (Common Weakness Enumeration), a CVE (Common Vulnerabilities and Exposures database), an ENVD (Environment Variable and Development Libraries Vulnerabilities Database), an OSVDB (Open Sourced Vulnerability Database), etc. In some embodiments, the preset knowledge base can also be a security knowledge database established within an enterprise or platform. Further, the preset knowledge refers to knowledge verified as correct within the corresponding preset knowledge base. Further, candidate knowledge can be compared with the preset knowledge in the preset knowledge base. When the comparison result shows that the candidate knowledge exists in a corresponding public knowledge base, it indicates that the corresponding candidate knowledge is valid, and at this time, the candidate knowledge is added to the knowledge graph. For example, if the output security knowledge is "SQL (Structured Query Language) injection attack, exploit, CVE-XXX, 2012-07-21", after comparison, if the preset knowledge base contains "SQL injection attack exploit CVE-XXX", it means that the candidate knowledge does exist in the preset knowledge base. Therefore, the verification result of the candidate knowledge is valid, and the candidate knowledge is added to the knowledge graph.

[0197] It is understandable that the knowledge graph referred to here can be one set up and operated internally by an enterprise or laboratory, or it can be a knowledge graph in a public knowledge base that is yet to be improved.

[0198] In some embodiments, candidate knowledge can be compared with preset knowledge in a preset knowledge base to obtain a comparison result. In some embodiments, if the comparison result is consistent with the comparison result of the preset knowledge, that is, if there is preset knowledge corresponding to the candidate knowledge in the preset knowledge base, then the candidate knowledge is valid, and the corresponding candidate knowledge can be added to the knowledge graph.

[0199] In some embodiments, the comparison result may be that there is no security knowledge corresponding to the candidate knowledge in the preset knowledge base. In this case, it means that the candidate knowledge is invalid and the candidate knowledge can be sent to the test range for verification.

[0200] Please refer to Figure 14 After comparing and analyzing the results, the process also includes, but is not limited to, steps S1301 to S1302:

[0201] Step S1301: If the test results of the candidate knowledge and the preset knowledge are inconsistent, the candidate knowledge is transmitted to the target range.

[0202] Step S1302: Verify the correctness of the candidate knowledge through the test range. If the candidate knowledge is verified to be correct, then add the candidate knowledge to the knowledge graph.

[0203] In some embodiments, a target range refers to a virtual environment used for training or testing security knowledge. The target range can simulate various security vulnerabilities and attack scenarios, which can verify the feasibility of security knowledge; that is, they can verify whether candidate knowledge is valid. Understandably, target ranges typically contain various types of vulnerabilities and attack scenarios, such as network vulnerabilities, network attacks, and mobile device security.

[0204] In some embodiments, if the verification results of candidate knowledge and preset knowledge are inconsistent, the candidate knowledge can be transmitted to a test range for verification. The test range simulates the corresponding scenario to verify whether the candidate knowledge is valid. Furthermore, if the candidate knowledge is verified correctly, it is added to the knowledge graph.

[0205] Understandably, if the candidate knowledge is not correctly verified in the testing range, a number of re-verification attempts can be set to avoid verification errors. For example, the number of re-verification attempts could be set to 2, 3, etc., and this application does not impose specific limitations on this. Furthermore, if the number of re-verification attempts is 3, then if the relevant candidate knowledge is verified correctly within 3 attempts, the corresponding candidate knowledge can be added to the knowledge graph. Further, if the verification fails after more than three attempts, it indicates that the candidate knowledge is incorrectly verified, and the corresponding candidate knowledge will be reclaimed.

[0206] Please refer to Figure 15 In some embodiments, acquiring knowledge data includes, but is not limited to, steps S1401 to S1402:

[0207] Step S1401: Obtain knowledge data from internal and external databases;

[0208] Step S1402: According to the preset numbering rules, the knowledge data in the internal database and the external database are uniformly numbered to obtain an entity dictionary and a relation dictionary. The entity dictionary contains the mapping relationship between entities and numbers, and the relation dictionary contains the mapping relationship between relations and numbers.

[0209] In some embodiments, knowledge data can be acquired from internal and external databases. Specifically, the internal database is a database running within the enterprise or platform, while the external database can be a publicly available security knowledge database. It is understood that, regardless of whether it is an internal or external database, the knowledge data within it is verified as valid security knowledge.

[0210] In some embodiments, to ensure the uniqueness and readability of the numbers, a set of numbering rules is typically preset, and knowledge data in internal and external databases is numbered according to these rules. Numbering the knowledge data facilitates its management and processing. Furthermore, based on the numbering, entity dictionaries and relation dictionaries can be established. The entity dictionary contains mappings between entities and numbers, and the relation dictionary contains mappings between relations and numbers. It is understood that establishing entity and relation dictionaries allows entities and relations to be found and represented using numbers, facilitating knowledge representation and reasoning. It is also understood that, to ensure the universality and queryability of knowledge, naming conventions for various security detection devices and security-related assets can be retained.

[0211] For example, entities can be numbered using the following rules: In a security knowledge base, all vulnerability information can be numbered using CVE or CWE database numbers, and all attack entities can be numbered using ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) numbers, etc. In some embodiments, attack entities can also be represented and numbered according to type and characteristics. For example, attacks detected by a vendor can be identified and stored as follows: SQL (Structured Query Language) injection attacks are numbered 123456; then, attack breaches are numbered 1, network service attacks are numbered 12, Web (World Wide Web) attacks are numbered 123, and SQL injection attacks are numbered 123456. It is understood that the numbering rule can be to first number the major categories, and then refine the numbers one by one, so as to find the corresponding security knowledge according to the major category.

[0212] Furthermore, the entity can be expanded into two parts: one part is the entity itself, such as in an SQL injection attack, and the other part is the entity's descriptive information, such as in a PostgreSQL (PostgreSQL object-relational database management system) database delayed injection attack. Further, these two fields can be identified using an n-α dimensional vector and an α dimensional vector, respectively. The two-dimensional vectors are then concatenated sequentially to form the initial feature vector of the entity.

[0213] In some embodiments, the following numbering rules may be used to number relationships:

[0214] It is understandable that, since most sophisticated attacks have a fixed chronological order, the relationships can be numbered according to the order in which they occur. For example, the typical sequence of events in a sophisticated attack to steal sensitive files is: scanning and probing, such as scanning sensitive hosts and servers, which is numbered 1 in this embodiment; attack and breach, such as using weak passwords, which is numbered 2 in this embodiment; and installation and control, such as installing remote control tools, which is numbered 3 in this embodiment.

[0215] Furthermore, numbers 1, 2, and 3 are concatenated sequentially according to the chronological order in which the relationships occur, representing the typical order of occurrence for complex attacks on the corresponding relationships. Furthermore, the relationship occurrence sequence, i.e., the three fields corresponding to numbers 1, 2, and 3, can be represented using β-dimensional / n-2β-dimensional / β-dimensional methods. The vectors are identified and then concatenated sequentially.

[0216] Understandably, through preprocessing, this application establishes a dictionary of entities and their corresponding numbers, as well as relations and their corresponding numbers, and obtains a one-to-one mapping relationship between each entity vector and relation vector and its corresponding number.

[0217] Understandably, after establishing dictionaries of entities and their corresponding numbers, and of relations and their corresponding numbers, when training the initial vector representation model and screening the candidate vector identification model, the corresponding entities or relations can be selected directly from the entity dictionary and the number dictionary according to their numbers, thus improving the efficiency of training and validating the model.

[0218] Please see Figure 16 This application also provides a knowledge graph knowledge completion system, which can implement the above-mentioned knowledge graph knowledge completion method. The knowledge graph knowledge completion system includes:

[0219] The knowledge data acquisition module 1601 is used to acquire knowledge data and divide the knowledge data into training set, validation set and test set; wherein, the knowledge data includes entities, relations and knowledge composed of entities and relations;

[0220] Preprocessing module 1602 is used to preprocess entities and relations in knowledge data using an initial vector representation model to form entity vectors and relation vectors embedded with time information;

[0221] The candidate vector representation model acquisition module 1603 is used to train an initial vector representation model using entity vectors and relation vectors in the training set, and obtain multiple candidate vector representation models.

[0222] The target vector representation model acquisition module 1604 is used to validate multiple candidate vector representation models using a validation set, calculate the evaluation score of each candidate vector representation model, and obtain the target vector representation model based on the evaluation score.

[0223] The knowledge construction module 1605 is used to process entity vectors and relation vectors in the test set through the target vector representation model to construct multiple knowledge items to be tested.

[0224] The candidate knowledge acquisition module 1606 is used to score and rank multiple pieces of knowledge to be tested using a scoring function to obtain candidate knowledge.

[0225] The candidate knowledge verification module 1607 is used to verify candidate knowledge, obtain verification results, and determine whether candidate knowledge needs to be added to the knowledge graph based on the verification results.

[0226] In some embodiments, knowledge data can refer to data in a security knowledge database or data in other knowledge databases. Examples include the CWE (Common Weakness Enumeration), CVE (Common Vulnerabilities and Exposures database), ENVD (Environment Variable and Development Libraries Vulnerabilities Database), OSVDB (Open Source Vulnerability Database), etc. These databases facilitate users' understanding and remediation of vulnerabilities by centrally collecting, organizing, and publishing vulnerability information, thereby reducing the risk of attacks. It is understood that knowledge data can be data collected within databases within each company, or knowledge data from widely accepted knowledge databases.

[0227] It is understood that the entities in this application include both head entities and tail entities. In some embodiments, knowledge data includes a dataset composed of head entities, tail entities, and relations. Head entities, tail entities, and relations constitute security knowledge, and multiple pieces of security knowledge constitute a security knowledge graph. In some embodiments, a security knowledge graph is an information representation method based on knowledge graphs, used to describe various entities, concepts, and relations in the security domain, wherein head entities, relations, and tail entities are important components of the security knowledge graph.

[0228] Specifically, a head entity typically represents the starting point of an entity or concept, such as a vulnerability, an attacker, or malware; a relation represents the semantic relationship between the head and tail entities, such as "attack," "exploitation," or "dependency"; and a tail entity represents the associated entity or concept of the head entity, such as a victim, a vulnerability remediation solution, or a security tool.

[0229] For example, in a security knowledge graph, "attacker" is the head entity, which can be a specific person or organization; "vulnerability" is the tail entity, which can be a victim's computer system, server, network device, etc.; and "attack" represents the relationship between the head and tail entities. In another embodiment, vulnerability is the head entity, exploitation behavior is the relationship, and attacker is the tail entity. Specifically, the head entity can be a specific vulnerability number or vulnerability name, the relationship can be "exploitation," "attack," etc., and the tail entity can be the attacker's identity, IP address, attack method, etc.

[0230] Understandably, by using head entities, relationships, and tail entities to represent security knowledge graphs, security researchers can better understand and analyze various security incidents, threats, and attack methods, thereby enabling them to better perform threat intelligence analysis, security vulnerability management, and attack detection.

[0231] Furthermore, since security knowledge is time-sensitive, embedding time information into the representation of security knowledge can enrich the expression of security information. In this application, time information is embedded into entities, and then relations are concatenated according to the order of occurrence, thereby realizing the simultaneous embedding of time information into entities and relations, so as to facilitate a more comprehensive analysis of security events through time information.

[0232] In some embodiments, the initial vector representation model can be the TransE model (Translating Embeddings Model), the DistMult model (Distributed Multi-Relation Embeddings Model), the SimpleE model (Simple Embeddings Model), etc. In this application embodiment, the TransE model is used to train, verify, and test security knowledge. It should be noted that the method of this application is also applicable to models other than the TransE model.

[0233] Understandably, the initial vector representation model is E. h +R=E t , of which E h R is the head entity vector, R is the relation vector, and E is the head entity vector. t The tail entity vector. In some embodiments, data from the knowledge data can be input into the initial vector representation model to obtain entity vectors and relation vectors embedded with time information.

[0234] Specifically, an entity can include ontology information and descriptive information. For example, ontology information can be the entity's own attributes, identifiers, and other relevant information, while the entity's descriptive information provides a more detailed description and explanation of the entity. In some embodiments, ontology information can refer to various entities, concepts, and objects in the security domain, such as vulnerabilities, attackers, victims, and malware; while the entity's descriptive information provides a more detailed description and explanation of the entity, including information about the entity's attributes, characteristics, behaviors, and impacts. For example, for an attacker entity, its ontology information can be basic attribute information such as the attacker's IP address, identity, and attack history, while its descriptive information can include more detailed information such as the attacker's attack methods, malicious behaviors, attack targets, and attack patterns.

[0235] Furthermore, the following formula illustrates how to embed time information into entities to form an entity vector with embedded time information:

[0236]

[0237] Here, E is the expression for the entity vector, consisting of two parts: the first part is an n-α dimensional vector e[n-α], and the second part is an α dimensional vector e[α]. That is, in some embodiments, ontology information can be represented in n-α dimensions, transformed into an ontology vector e[n-α]; description information can be represented in α dimensions, transformed into a first description vector e[α], and the second description vector, after embedding the description information into a time vector, is represented by e[α]*σ(at+b). In some embodiments, α can be set and adjusted as needed to adjust the dimensionality ratio of the ontology vector in the entity vector.

[0238] Generally, since ontology information is the foundation and core of security knowledge, the ontology vector corresponding to the ontology information should occupy more than 50% of the dimension in the entity information to ensure the effective expression of the ontology information. Therefore, assuming the overall dimension of the entity vector is n-dimensional, the value of α is generally less than n / 2. Further, σ, a, and b are the initial model parameters corresponding to the initial vector representation model used for vector transformation of entities, used to activate the temporal information in the description information and optimize the vector expression form of the description information. Further, σ is the activation function, which can be selected based on the performance of the training model in different scenarios. In network security applications, the sin function can be chosen as the activation function because it better simulates the changing state of temporal features. Further, a and b are parameters that are automatically adjusted by the model learning and are preset. In some embodiments, both a and b can be obtained from the initial vector representation model.

[0239] Further, t represents time information, specifically the year, month, and day corresponding to the time when the security knowledge occurred. More specifically, it can be accurate to the hour, minute, and second. This application embodiment does not impose specific limitations on this. In some embodiments, t is used to represent the year, month, and day when the security knowledge occurred: If the time when a piece of security knowledge occurred is December 15, 2021, after initializing the time information, the corresponding time information is represented as 2021, 12, and 15, respectively, and embedded into the entity's description information using formula (1). Then, the description information embedded with the time information is concatenated with the ontology information to form an entity vector embedded with time.

[0240] In some embodiments, a relationship can be divided into three parts: the relationship itself, its preceding relationships, and its following relationships. In some embodiments, a relationship can represent the direct connection between the head and tail entities of the current relationship; the preceding relationships represent the relationships between the current entity and other entities prior to the current entity; and the following relationships represent the relationships between the current entity and other entities subsequently. For example, in an attack event, the relationship can represent the attack behavior relationship between the attacker and the victim. The preceding relationships can represent the relationships between the attacker and other entities prior to the attack, such as the attacker having previously collaborated with other hacker groups or obtaining information about the victim through social engineering. The following relationships can represent the relationships between the attacker and other entities subsequently, such as the attacker selling the obtained confidential information to other hackers or organizations after a successful attack.

[0241] In another embodiment, in a vulnerability exploitation scenario, a relationship can be represented as the relationship between a vulnerability and its exploitation. Further, the preceding relationships can represent the relationships between the vulnerability and other preceding entities; for example, a vulnerability might be due to programmer negligence or a design flaw. The following relationships can represent other security problems that may arise after the vulnerability is exploited; for example, an attacker might use the vulnerability to obtain confidential information or control the victim's computer system. It is understood that by analyzing and processing relationships, their preceding relationships, and their following relationships, a more comprehensive and in-depth understanding of security events and threats can be achieved, thereby enabling better security event analysis and threat intelligence research.

[0242] Furthermore, the following formula illustrates how to concatenate relationships sequentially according to their occurrence order to form a relationship vector embedding time information.

[0243]

[0244] Here, R is the expression for the relation vector, consisting of three parts: the first part is a β-dimensional vector r[β], the second part is an m-2β-dimensional vector r[m-2β], and the third part is a β-dimensional vector r[β]. That is, in some embodiments, the preceding relation can be represented by β dimensions, transformed into the preceding relation vector r[β]; the relation can be represented by an m-2β vector, transformed into the current relation vector r[m-2β]; and the following relation can be represented by β dimensions, transformed into the following relation vector r[β]. In some embodiments, β can be set and adjusted as needed to adjust the dimensional proportions of the preceding, current, and following relation vectors in the relation vector.

[0245] For ease of understanding, both the preorder and postorder relations of a relation are represented using β dimensions. However, this does not mean that the β dimensions representing the preorder and postorder relations are the same; it is simply to illustrate that the relation, its preorder and postorder relations, and their corresponding current, preorder, and postorder relation vectors are concatenated into an m-dimensional vector (m is a positive integer greater than or equal to 3). In some embodiments, a relation can be represented using m-2β dimensions, and both the preorder and postorder relations can be represented using β dimensions. Furthermore, the current relation vector can be represented by r[m-2β], and the preorder and postorder relation vectors can be represented by r[β].

[0246] In some embodiments, knowledge data can be divided into a training set, a validation set, and a test set. The knowledge in the training set is used to train an initial vector representation model, resulting in multiple trained models. Multiple candidate vector representation models are then selected from these trained models. In some embodiments, a target candidate vector representation model is selected from the multiple candidate models using the validation set. In some embodiments, knowledge data from the test set is used to test the target candidate vector representation model, thereby obtaining candidate knowledge.

[0247] In some embodiments, negative sampling can be used, that is, head entities, tail entities or relations can be randomly selected from the knowledge data of the training set, and these head entities, tail entities or relations can be input into the initial vector representation model to output entity vectors embedded in time or relation vectors concatenated in chronological order.

[0248] Specifically, entities in knowledge data can be represented by an initial vector model, and the output of equation (1) becomes an entity vector with embedded time information. Relationships in knowledge can be represented by an input initial vector model, and the output of equation (2) becomes a relation vector that is sequentially concatenated according to the order of occurrence in time.

[0249] In some embodiments, the initial vector representation model can be trained by selecting different entities and relations from the training set as inputs. That is, head entities, tail entities, or relations can be randomly selected from the knowledge data in the training set and input into the initial vector representation model, while continuously performing replacement training to generate multiple training models. By continuously adjusting the model parameters, the knowledge representation vector updated during training can achieve Ei. h +R=E t The representation effect, where E h R is the head entity vector, R is the relation vector, and E is the head entity vector. t This is the tail entity vector.

[0250] Furthermore, a preset number of rounds can be set, and the training model is saved every time the first training round is reached. For example, the preset number of rounds can be set to save the training model at the 20th training round as a candidate vector representation model every 20 rounds. When the cumulative number of the first training rounds reaches the second training round, the training of the initial vector representation model is stopped, and the multiple candidate vector representation models saved during the training process are summarized and saved.

[0251] In some embodiments, knowledge from the validation set can be used to perform replacement validation on multiple candidate vector representation models, and an evaluation score can be calculated for each candidate vector representation model. Specifically, the MRR (Mean Reciprocal Rank) or NDCG (Normalized Discounted Cumulative Gain) value can be calculated for multiple candidate vector representation models, and the calculated value is the score of each model. Further, the candidate vector representation model with the highest MRR or NDCG value can be selected as the target vector representation model. Alternatively, depending on the requirements, it is not necessary to select the vector representation model with the highest score as the target vector representation model; selection can be made according to the needs. It is understood that multiple target vector representation models can also be selected, and this application embodiment does not impose specific limitations on this.

[0252] In some embodiments, after selecting a target vector representation model, the model can be tested using knowledge data from a test set. Specifically, entities or relations from the test set can be input into the target vector representation model to obtain target entity vectors and target relation vectors. The target entity vectors and target relation vectors can then be constructed using the target vector representation model to obtain multiple pieces of knowledge to be tested. It is understood that after randomly or sequentially constructing and combining the target entity vectors and target relation vectors, multiple pieces of knowledge E are obtained. h +R=E t Or approaching knowledge Eh +R=E t The expression is used as the knowledge to be tested, where E h R is the head entity vector, R is the relation vector, and E is the head entity vector. t This is the tail entity vector.

[0253] Furthermore, the scoring function of the TransE model can be used to score and rank multiple pieces of knowledge to be tested, and the knowledge with the highest score can be selected as candidate knowledge. Furthermore, the scoring functions of the DistMult model and the SimpleE model can also be used to score and rank multiple pieces of knowledge to be tested; this application does not impose specific limitations on this.

[0254] In some embodiments, candidate knowledge can be compared with public knowledge bases, such as the CWE (Common Weakness Enumeration), CVE (Common Vulnerabilities and Exposures Database), ENVD (Environment Variable and Development Library Vulnerabilities Database), OSVDB (OpenSourced Vulnerability Database), etc. Furthermore, if the comparison result shows that the candidate knowledge exists in a corresponding public knowledge base, it indicates that the corresponding candidate knowledge is valid. At this point, the candidate knowledge is added to the knowledge graph. This knowledge graph can be one set up and run internally by the enterprise or laboratory, or it can be a knowledge graph in a public knowledge base that is yet to be improved.

[0255] Furthermore, if the candidate knowledge cannot be found in the public knowledge base, meaning the corresponding candidate knowledge does not exist in the public knowledge base, then the candidate knowledge can be verified on the virtual simulation platform of the test range. If the verification on the virtual simulation platform of the test range is successful, the candidate knowledge is valid and can be added to the knowledge graph. If the verification on the virtual simulation platform of the test range is unsuccessful, the candidate knowledge can be verified repeatedly up to a preset number of times. If the candidate knowledge is verified as valid in the test range within the preset number of times, then the candidate knowledge is valid and can be added to the knowledge graph. If the candidate knowledge is verified as unsuccessful in the test range after the preset number of times, then the corresponding candidate knowledge is invalid and should be discarded.

[0256] The knowledge completion method, system, electronic device, and storage medium proposed in this application can preprocess the data in the knowledge data to form entity vectors and relation vectors embedded with time information. These entity and relation vectors are divided into training, validation, and test sets. An initial vector representation model is trained using the training set, with the knowledge vectors composed of entity and relation vectors as the training target. The parameters of the training model are continuously adjusted. A target vector representation model is selected from multiple candidate vector representation models obtained through the validation set. The target vector representation model constructs and scores the entity and relation vectors in the test set, outputting valid security knowledge. This output is then compared with a public knowledge base to determine whether the corresponding security knowledge needs to be added to the security knowledge graph. Therefore, the embodiments of this application can embed time information into entities and relations in the security knowledge graph, thereby better revealing the evolutionary patterns of the security knowledge graph based on time information, strengthening the temporal correlation of entities and relations, and establishing a more complete security knowledge graph, providing more effective support for the prediction and prevention of security problems.

[0257] The specific implementation of the knowledge completion system for this knowledge graph is basically the same as the specific embodiments of the knowledge completion method for knowledge graphs described above, and will not be repeated here. Provided that the requirements of the embodiments of this application are met, the knowledge completion system for the knowledge graph can also be equipped with other functional modules to implement the knowledge completion method for knowledge graphs in the above embodiments.

[0258] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the knowledge completion method for the knowledge graph described above. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0259] Please see Figure 17 , Figure 17 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0260] The processor 1701 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0261] The memory 1702 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1702 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1702, and the processor 1701 calls and executes the knowledge graph knowledge completion method of the embodiments of this application.

[0262] The input / output interface 1703 is used to implement information input and output;

[0263] The communication interface 1704 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0264] Bus 1705 transmits information between various components of the device (e.g., processor 1701, memory 1702, input / output interface 1703, and communication interface 1704);

[0265] The processor 1701, memory 1702, input / output interface 1703 and communication interface 1704 are connected to each other within the device via bus 1705.

[0266] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the knowledge completion method for the knowledge graph described above.

[0267] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0268] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0269] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0270] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0271] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0272] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0273] It should be understood that in this application, "at least one" and "several" refer to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0274] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0275] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0276] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0277] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0278] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for knowledge completion of a knowledge graph, characterized in that, The method comprises: acquiring knowledge data, dividing the knowledge data into a training set, a validation set and a test set; wherein the knowledge data is data in a security knowledge database, and the knowledge data comprises entities, relationships and knowledge composed of the entities and the relationships; preprocessing the entities and the relationships in the knowledge data by using an initial vector representation model to form entity vectors and relationship vectors embedding time information; wherein the entities comprise ontology information and description information, the ontology information is a vulnerability, an attacker, a victim or malicious software in the security field, and the description information is attributes, characteristics, behaviors or influences of the entities; preprocessing the entities in the knowledge data by using the initial vector representation model to form entity vectors embedding time information comprises: acquiring the ontology information corresponding to the entities and converting the ontology information into ontology vectors; acquiring the description information corresponding to the entities and converting the description information into first description vectors; acquiring time information corresponding to the entities, inputting the time information into an activation function to obtain a time vector, the activation function containing initial model parameters corresponding to the initial vector representation model; multiplying the first description vectors and the time vector to obtain second description vectors embedding time information; and splicing the ontology vectors and the second description vectors to obtain entity vectors embedding time information; training the initial vector representation model by using the entity vectors and the relationship vectors in the training set to obtain a plurality of candidate vector representation models; verifying the plurality of candidate vector representation models by using the validation set to calculate evaluation scores of the candidate vector representation models, and obtaining a target vector representation model according to the evaluation scores; processing the entity vectors and the relationship vectors in the test set by using the target vector representation model to construct a plurality of to-be-inspected knowledge; scoring and ranking the plurality of to-be-inspected knowledge by using a scoring function to obtain candidate knowledge; inspecting the candidate knowledge to obtain an inspection result, and determining whether the candidate knowledge needs to be supplemented into a knowledge graph according to the inspection result. 2.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, The dimension of the ontology vector is a first preset dimension, and the dimension of the first description vector is N-first preset dimension, so that the dimension of the entity vector is N dimensions, wherein N is a positive integer greater than or equal to 2; the splicing of the ontology vector and the second description vector to obtain the entity vector embedding time information comprises: acquiring a first preset dimension adjustment instruction; adjusting the first preset dimension according to the first preset dimension adjustment instruction to adjust the dimension proportion of the ontology vector in the entity vector. 3.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, the preprocessing of the relationships in the knowledge data by using the initial vector representation model to form relationship vectors embedding time information comprises: acquiring the relationships and converting to obtain current relationship vectors; acquiring a previous relationship of the relationships and converting the previous relationship to obtain a previous relationship vector according to the previous relationship; the previous relationship is a relationship occurring before the relationship; obtaining a post-sequential relation of the relation, and converting the post-sequential relation to obtain a post-sequential relation vector; the post-sequential relation is a relation occurring after the relation; sequentially concatenating the pre-sequential relation vector, the current relation vector and the post-sequential relation vector to obtain the relation vector with the embedded time information. 4.The knowledge completion method of the knowledge graph according to claim 3, characterized in that, The pre-sequential relation vector has a first relation dimension, the post-sequential relation vector has a second relation dimension, and the current relation vector has M- the first relation dimension-second relation dimension, so that the relation vector has an M dimension; wherein the M is a positive integer greater than or equal to 3; The sequentially concatenating the pre-sequential relation vector, the current relation vector and the post-sequential relation vector to obtain the relation vector with the embedded time information comprises: obtaining a relation dimension adjustment instruction; adjusting the first relation dimension and / or the second relation dimension according to the relation dimension adjustment instruction to adjust the dimension proportion of the pre-sequential relation vector, the current relation vector and the post-sequential relation vector in the relation vector. 5.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, The training the initial vector representation model with the entity vector and the relation vector in the training set to obtain a plurality of candidate vector representation models comprises: obtaining a plurality of the entity vectors and a plurality of the relation vectors according to the training set; taking the knowledge vector composed of the entity vector and the relation vector as a training target, and replacing the entity vector or the relation vector in the knowledge vector with a plurality of the entity vectors or a plurality of the relation vectors; adjusting the initial model parameter corresponding to the initial vector representation model according to the training target to obtain a training model as a round of training, and repeating the step process to the training model for multiple rounds of training; counting the training rounds, and stopping training when the training rounds reach a preset round number, and saving a plurality of the training models in the training process as candidate vector representation models. 6.The knowledge completion method of the knowledge graph according to claim 5, characterized in that, The preset round number comprises a first training round number and a second training round number, and the second training round number is greater than the first training round number; The counting the training rounds, and stopping training when the training rounds reach a preset round number, and saving a plurality of the training models in the training process as candidate vector representation models comprises: counting the training rounds in real time, and saving the current initial vector representation model when the training rounds reach the first training round number; stopping training when the training rounds reach the second training round number, and obtaining a candidate vector representation model according to a plurality of the training models saved in the training process. 7.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, The verifying a plurality of the candidate vector representation models with the verification set to calculate an evaluation score of each of the candidate vector representation models, and obtaining a target vector representation model according to the evaluation score comprises: calculating an MRR index value corresponding to each of the candidate vector representation models; determining the candidate vector representation model with the highest MRR index value as the target vector representation model; The MRR index value corresponding to the candidate vector representation model is calculated by the following method: According to a plurality of entity vectors or relation vectors in the candidate vector representation model, entities or relations in the verification set are replaced to obtain a plurality of replaced knowledge; The replaced knowledge is scored by using a scoring function; According to the scoring, the ranking of the replaced knowledge in the verification set is determined to calculate the MRR index value of the replaced knowledge; According to the MRR index value of the replaced knowledge, the MRR index value of the candidate vector representation model is obtained. 8.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, The processing of the entity vector and the relation vector in the test set by the target vector representation model to construct a plurality of to-be-inspected knowledge includes: Obtaining entities and relations in the test set; The plurality of entities or the plurality of relations are input into the target vector representation model to obtain a plurality of target entity vectors or a plurality of target relation vectors, and the plurality of target entity vectors or the plurality of target relation vectors are randomly combined to obtain a plurality of to-be-inspected knowledge. 9.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, The scoring and sorting of the plurality of to-be-inspected knowledge by the scoring function to obtain candidate knowledge includes: Obtaining a scoring function corresponding to the target vector representation model; According to the scoring function, the scoring result of each to-be-inspected knowledge is obtained; According to the scoring result, the plurality of to-be-inspected knowledge is sorted to obtain a sorting result; According to the sorting result, the to-be-inspected knowledge corresponding to a preset sorting range is selected as candidate knowledge. 10.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, The inspection of the candidate knowledge to obtain an inspection result, and the judgment of whether the candidate knowledge needs to be supplemented into the knowledge graph according to the inspection result includes: Obtaining a preset knowledge base; Comparing the candidate knowledge with the preset knowledge in the preset knowledge base to obtain an inspection result; If the inspection result of the candidate knowledge and the preset knowledge is consistent, the candidate knowledge is supplemented into the knowledge graph. 11.The knowledge completion method of the knowledge graph according to claim 10, characterized in that, After analyzing the inspection result, the method further includes: If the inspection result of the candidate knowledge and the preset knowledge is inconsistent, the candidate knowledge is transmitted to a target field; The correctness of the candidate knowledge is verified by the target field, and if the candidate knowledge is verified to be correct, the candidate knowledge is supplemented into the knowledge graph. 12.The knowledge completion method of the knowledge graph according to claim 1, characterized in that, The knowledge data includes: Obtaining knowledge data from an internal database and an external database; According to a preset numbering rule, the knowledge data of the internal database and the external database is uniformly numbered to obtain an entity dictionary and a relation dictionary, the entity dictionary contains a mapping relationship between entities and numbers, and the relation dictionary contains a mapping relationship between relations and numbers. 13.A knowledge completion system of a knowledge graph, characterized in that, The system includes: A knowledge data acquisition module is configured to acquire knowledge data and divide the knowledge data into a training set, a verification set and a test set; wherein the knowledge data is data in a security knowledge database, and the knowledge data includes entities, relations and knowledge composed of the entities and the relations; The preprocessing module is configured to preprocess entities and relationships in the knowledge data by using an initial vector representation model to form entity vectors and relationship vectors embedding time information, wherein the entities include ontology information and description information, the ontology information is a vulnerability, an attacker, a victim, or malware in a security field, and the description information is an attribute, a feature, a behavior, or an impact of the entity; preprocessing the entities in the knowledge data by using the initial vector representation model to form the entity vectors embedding time information includes: obtaining the ontology information corresponding to the entities and converting the ontology information into ontology vectors; obtaining the description information corresponding to the entities and converting the description information into first description vectors; obtaining time information corresponding to the entities, inputting the time information into an activation function to obtain time vectors, the activation function including initial model parameters corresponding to the initial vector representation model; multiplying the first description vectors and the time vectors to obtain second description vectors embedding time information; and splicing the ontology vectors and the second description vectors to obtain the entity vectors embedding time information. The candidate vector representation model acquisition module is configured to train the initial vector representation model by using the entity vectors and the relationship vectors in the training set to obtain a plurality of candidate vector representation models. The target vector representation model acquisition module is configured to verify the plurality of candidate vector representation models by using the verification set to calculate evaluation scores of the candidate vector representation models, and obtain a target vector representation model according to the evaluation scores. The to-be-inspected knowledge construction module is configured to process the entity vectors and the relationship vectors in the test set by using the target vector representation model to construct a plurality of to-be-inspected knowledge. The candidate knowledge acquisition module is configured to score and sort the to-be-inspected knowledge by using a scoring function to obtain candidate knowledge. The candidate knowledge inspection module is configured to inspect the candidate knowledge to obtain an inspection result, and determine whether the candidate knowledge needs to be supplemented into the knowledge graph according to the inspection result.

14. An electronic device, comprising: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the knowledge completion method of the knowledge graph in any one of claims 1 to 12 when executing the computer program.

15. A computer readable storage medium, the storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the knowledge completion method of the knowledge graph in any one of claims 1 to 12.

Images