Knowledge graph construction method and device, electronic equipment and storage medium

Abstract

This application provides a knowledge graph construction method, apparatus, electronic device, and storage medium, belonging to the field of network security technology. The knowledge graph construction method includes: preprocessing multi-source network security data obtained from a network security database to obtain structured data; defining a relationship table between entity fields and attributes according to preset requirement rules and preset network security scenarios to obtain a network security relationship table; filtering corresponding extraction rules from a pre-established rule base based on network security entities to obtain target extraction rules; automatically identifying and extracting corresponding attribute data from the structured data according to the target extraction rules to obtain network security attribute data; constructing network security entities based on the network security attribute data; and associating network security entities to construct a network security knowledge graph, thus obtaining a target knowledge graph. This application embodiment can improve the speed of constructing multi-dimensional network security knowledge graphs.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a knowledge graph construction method and apparatus, electronic device and storage medium. Background Technology

[0002] Currently, existing cybersecurity knowledge graph construction combines various technologies such as natural language processing, data mining, and knowledge graph technology. Based on the knowledge graph construction technology that integrates multiple technologies, the data knowledge comes from diverse sources and includes entities and relationships across various dimensions.

[0003] However, due to the diversity of entity and relationship types, and the wide range of fields and scenarios involved, the complexity of entity and relationship types makes the knowledge graph construction process relatively slow.

[0004] In summary, how to efficiently construct knowledge graphs has become an urgent technical problem to be solved. Summary of the Invention

[0005] The main objective of this application is to propose a knowledge graph construction method, apparatus, electronic device, and storage medium, aiming to improve the speed of constructing multi-dimensional network security knowledge graphs.

[0006] To achieve the above objectives, a first aspect of this application proposes a knowledge graph construction method for network security, the knowledge graph construction method comprising:

[0007] Preprocessing of multi-source cybersecurity data obtained from databases in the cybersecurity field yields structured data;

[0008] Based on the preset requirements rules and preset network security scenarios, define the relationship table between entity fields and attributes to obtain the network security relationship table;

[0009] Based on the network security relationship table, the corresponding extraction rules are filtered from the pre-established rule base to obtain the target extraction rules;

[0010] According to the target extraction rules, the corresponding attribute data is automatically identified and extracted from the structured data to obtain network security attribute data;

[0011] Based on the network security attribute data, network security entities are constructed and associated to build a network security knowledge graph, thereby obtaining the target knowledge graph.

[0012] In some embodiments, the preprocessing of multi-source cybersecurity data obtained from databases in the cybersecurity field to obtain structured data includes:

[0013] Abnormal data is filtered and removed from the network security multi-source data to obtain the target multi-source data;

[0014] Unstructured data is obtained by filtering unstructured data from the target multi-source data;

[0015] Obtain the corresponding data information from the unstructured data to obtain feature data information;

[0016] The feature data information is matched with the corresponding structured data to transform the unstructured data into structured data, thus obtaining the structured data.

[0017] In some embodiments, the step of defining a relationship table between entity fields and attributes based on preset demand rules and preset network security scenarios to obtain a network security relationship table includes:

[0018] Based on the aforementioned requirement rules and the aforementioned network security scenario, the dimensions to be constructed are determined, thus obtaining the network security dimensions;

[0019] Based on the aforementioned requirement rules and network security dimensions, the entity to be constructed is determined, and the target entity fields are obtained.

[0020] Based on the network security dimension, data corresponding to the specified dimension is obtained from the structured data to obtain dimension attribute data;

[0021] The target entity field is defined with respect to the dimensional attribute data to construct a relationship table between entity fields and attributes, thereby obtaining the network security relationship table.

[0022] In some embodiments, after obtaining the corresponding dimension data from the structured data according to the network security dimension, the knowledge graph construction method further includes:

[0023] By successively filtering the dimensional attribute data, the target dimensional attribute data is obtained;

[0024] The necessity of the target dimension attribute data is identified according to the aforementioned requirement rules, and the necessity identification result is obtained.

[0025] If the necessity identification result indicates that the target dimension attribute data is necessary, then the target dimension attribute data is defined as necessary attribute data.

[0026] In some embodiments, after automatically identifying and extracting corresponding attribute data from the structured data according to the target extraction rules to obtain network security attribute data, the knowledge graph construction method further includes:

[0027] The network security attribute data is subjected to integrity identification based on the necessary attribute data to obtain the integrity identification result.

[0028] If the integrity identification result indicates that the data is incomplete, the missing necessary attribute data is re-identified and supplemented in the structured data to update the network security attribute data.

[0029] In some embodiments, the network security attribute data includes network security attributes and network security associations. The step of constructing network security entities based on the network security attribute data and associating the network security entities to construct a network security knowledge graph, thereby obtaining a target knowledge graph, includes:

[0030] The network security attributes are imported into the entity to be constructed to obtain the network security entity;

[0031] The network security entities are associated with each other based on the network security relationship to construct a network security knowledge graph and obtain the target knowledge graph.

[0032] In some embodiments, the knowledge graph construction method further includes:

[0033] Based on the aforementioned demand rules, the network security multi-source data is acquired in real time to obtain the current multi-source data;

[0034] Obtain the attributes of entities in the current multi-source data to obtain entity attribute data;

[0035] The rule base is updated based on the entity attribute data to optimize the rule base.

[0036] To achieve the above objectives, a second aspect of this application proposes a knowledge graph construction apparatus for network security, the knowledge graph construction apparatus comprising:

[0037] The multi-source data processing module is used to preprocess multi-source cybersecurity data obtained from databases in the cybersecurity field to obtain structured data;

[0038] The relation table definition module is used to define the relation table between entity fields and attributes according to preset requirement rules and preset network security scenarios, so as to obtain the network security relation table;

[0039] The extraction rule filtering module is used to filter the corresponding extraction rules in the pre-established rule base according to the network security relationship table to obtain the target extraction rule;

[0040] The attribute data extraction module is used to automatically identify and extract corresponding attribute data from the structured data according to the target extraction rules to obtain network security attribute data.

[0041] The knowledge graph construction module is used to construct network security entities based on the network security attribute data, and associate the network security entities to construct a network security knowledge graph and obtain the target knowledge graph.

[0042] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect.

[0043] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0044] The knowledge graph construction method, apparatus, electronic device, and storage medium proposed in this application acquire multi-source cybersecurity data from a database in the cybersecurity field, preprocess the multi-source cybersecurity data to convert it into structured data, determine the entities to be constructed and their corresponding attributes according to preset requirements and preset cybersecurity scenarios, define entity fields and attributes to construct a relationship table of entity fields and attributes, obtaining a cybersecurity relationship table, filter the attributes in the cybersecurity relationship table in a pre-established rule base to select extraction rules for each attribute, obtaining target extraction rules, automatically identify the structured data according to the target extraction rules to identify the required attribute data, extract the corresponding attribute data to obtain cybersecurity attribute data, construct entities based on the cybersecurity attribute data to construct cybersecurity entities, and associate the cybersecurity entities with each other to construct a cybersecurity knowledge graph, obtaining the target knowledge graph. By automatically matching the attributes of specific entities to the preprocessed structured data through the set extraction rules, the required attribute data can be identified. This can accurately match entity fields and corresponding attributes. Compared with complex model calculation techniques, matching the attributes of specific entities through extraction rules and directly extracting the attributes of specific entities can efficiently obtain the required attribute data, thereby improving the speed of building a multi-dimensional cybersecurity knowledge graph. Attached Figure Description

[0045] Figure 1 This is a flowchart of the knowledge graph construction method provided in the embodiments of this application;

[0046] Figure 2 yes Figure 1 The flowchart of step S101 in the text;

[0047] Figure 3yes Figure 1 The flowchart of step S102 in the document;

[0048] Figure 4 This is a flowchart of the knowledge graph construction method provided in the embodiments of this application;

[0049] Figure 5 This is a flowchart of the knowledge graph construction method provided in the embodiments of this application;

[0050] Figure 6 yes Figure 1 The flowchart of step S105 in the process;

[0051] Figure 7 This is a flowchart of the knowledge graph construction method provided in the embodiments of this application;

[0052] Figure 8 This is a schematic diagram of the knowledge graph construction apparatus provided in the embodiments of this application;

[0053] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application;

[0054] Figure 10 This is a schematic diagram of the spatiotemporal feature representation of the knowledge graph provided in the embodiments of this application.

[0055] Explanation of reference numerals in the attached figures:

[0056] Multi-source data processing module 801, relation table definition module 802, extraction rule filtering module 803, attribute data extraction module 804, knowledge graph construction module 805;

[0057] Processor 901, memory 902, input / output interface 903, communication interface 904, bus 905. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0059] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0061] First, let's analyze some of the terms used in this application:

[0062] A cybersecurity knowledge graph is a graphical model describing entities and relationships in the cybersecurity field. It helps people better understand cybersecurity knowledge and information, improving the efficiency and accuracy of cybersecurity efforts. It can be used for threat intelligence analysis, attack detection, security training, and policy development. By collecting and analyzing various threat intelligence, attackers, victims, and attack methods in cybersecurity incidents, publicly available network vulnerabilities and weaknesses, and defenders' defense strategies, multi-dimensional information can be integrated into a security knowledge graph. This allows for better identification of cybersecurity threats and risks, the development of response strategies, and the protection of an organization's cybersecurity.

[0063] Cyber ​​Range: A technology or product based on virtualization that simulates and reproduces the operational status and environment of network architecture, system equipment, business processes, etc. in real cyberspace, so as to more effectively realize learning, research, testing, competition, exercise and other activities related to network security, thereby improving the network security confrontation level of personnel and organizations.

[0064] Knowledge Graph: In the library and information science field, it is called knowledge domain visualization or knowledge domain mapping map. It is a series of different graphics that show the development process and structural relationships of knowledge. It uses visualization technology to describe knowledge resources and their carriers, and to mine, analyze, construct, draw and display knowledge and the interrelationships between them.

[0065] An entity is a concrete thing or abstract concept in the real world, which can be a person, place, organization, event, etc. In a knowledge graph, entities are identified by unique identifiers. For example, a person can use their name, ID number, or social network account as an identifier.

[0066] An entity type is a collection of entities that share similar attributes and characteristics, such as people, places, organizations, and events. Entity types are typically organized in a tree structure; for example, people can be divided into multiple subclasses such as students, teachers, and workers.

[0067] Entity properties are characteristics or descriptions of an entity, such as its name, age, gender, location, and contact information. Entity properties are typically stored as key-value pairs, such as attributes like "name," "age," and "gender."

[0068] Entity features are characteristics or attributes that describe an entity. They are usually statistically or computationally derived indicators, such as a person's occupation or the population density of their location. Entity features can serve as the basis for relationships between entities in a knowledge graph and can also be used for tasks such as entity classification and similarity calculation.

[0069] Entity Feature Instance: This is a specific instance of an entity's feature, such as an entity's occupation, the population density of its location, etc. Entity Feature Instances are typically stored in key-value pairs, such as "Occupation", "Doctor", "Local Population Density", "5000 people / square kilometer", etc.

[0070] Currently, existing cybersecurity knowledge graph construction methods combine natural language processing, data mining, and knowledge graph technologies. Based on this hybrid approach, the data knowledge sources are diverse, encompassing entities and relationships across various dimensions. However, the types of entities and relationships are complex. Due to their diversity and the wide range of domains and scenarios involved, the knowledge graph construction process is slow. Therefore, efficiently constructing knowledge graphs based on entity and attribute information across various dimensions has become a pressing technical problem.

[0071] Based on this, in order to construct cybersecurity knowledge graphs more accurately, efficiently and quickly, embodiments of this application provide a knowledge graph construction method and apparatus, electronic device and storage medium, and a scalable network range knowledge graph entity information extraction technology, which aims to improve the speed of constructing multi-dimensional cybersecurity knowledge graphs.

[0072] This application's embodiments include scalable entity attribute definitions and rule-based entity attribute extraction. By acquiring information from multiple data sources, and through rule recognition and information extraction, it can be quickly processed into structured data. Furthermore, the customizable and scalable nature of entity attributes allows for rapid changes in entity attributes according to different scenario requirements. Based on the characteristics of the MDATA knowledge graph, custom entity attributes can include temporal, spatial, and other features.

[0073] Rule-based entity information extraction uses predefined entity attribute templates to identify various defined entities contained in text through matching and extraction. The rules are customizable and extensible, and can quickly preprocess large amounts of data to rapidly identify useful information.

[0074] The customizable and extensible nature of entity attributes allows for the accurate extraction of information of greater business relevance by defining entities with different dimensions and attributes. This also enriches the knowledge information dimensions of the cybersecurity knowledge graph. MDATA knowledge graphs include spatiotemporal attributes; by defining topological node information within a scenario, traditional static knowledge graphs can be expanded to include spatial information. Furthermore, by extending the temporal attributes of some custom entities, the knowledge graph can be enriched into an MDATA knowledge graph encompassing both temporal and spatial dimensions.

[0075] The knowledge graph construction method, apparatus, electronic device, and storage medium provided in this application are specifically described through the following embodiments. First, the knowledge graph construction method in this application is described.

[0076] The knowledge graph construction method provided in this application relates to the field of network security technology. This method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the knowledge graph construction method, but is not limited to the above forms.

[0077] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0078] Figure 1 This is an optional flowchart of the knowledge graph construction method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S105.

[0079] Step S101: Preprocess the multi-source network security data obtained from the database in the field of network security to obtain structured data;

[0080] Step S102: Define the relationship table between entity fields and attributes according to the preset requirement rules and preset network security scenarios to obtain the network security relationship table;

[0081] Step S103: Based on the network security relationship table, filter the corresponding extraction rules in the pre-established rule base to obtain the target extraction rules;

[0082] Step S104: Automatically identify and extract corresponding attribute data from structured data according to target extraction rules to obtain network security attribute data;

[0083] Step S105: Construct network security entities based on network security attribute data, and associate network security entities to construct a network security knowledge graph and obtain the target knowledge graph.

[0084] Steps S101 to S105 of this embodiment involve obtaining multi-source network security data from a database in the network security field, preprocessing the multi-source network security data to convert it into structured data, determining the entities to be constructed and their corresponding attributes based on preset requirements and preset network security scenarios, defining entity fields and attributes to construct a relationship table of entity fields and attributes, obtaining a network security relationship table, filtering the attributes in the network security relationship table in a pre-established rule base to select extraction rules for each attribute, obtaining target extraction rules, automatically identifying the structured data according to the target extraction rules to identify the required attribute data, extracting the corresponding attribute data to obtain network security attribute data, constructing entities based on the network security attribute data, and associating network security entities with each other to construct a network security knowledge graph, obtaining a target knowledge graph. By automatically matching the attributes of specific entities to the preprocessed structured data through the set extraction rules, the required attribute data can be identified. This can accurately match entity fields and corresponding attributes. Compared with complex model calculation techniques, matching the attributes of specific entities through extraction rules and directly extracting the attributes of specific entities can efficiently obtain the required attribute data, thereby improving the speed of building a multi-dimensional cybersecurity knowledge graph.

[0085] In step S101 of some embodiments, the data sources in the field of network security include the following databases: a database of network topology data, a database of alarm events based on security feature devices, publicly available vulnerability knowledge bases, and databases of network security reports from publicly available organizations such as forums. The data sources are not limited to these. Specifically, the topology data is structured JSON data, security alarm events and security reports are text or HTML format data, and the network knowledge base is JSON data from interface query parameters.

[0086] Please see Figure 2 In some embodiments, preprocessing of multi-source cybersecurity data obtained from databases in the cybersecurity field to obtain structured data may include, but is not limited to, steps S201 to S204:

[0087] Step S201: Filter and remove abnormal data from the network security multi-source data to obtain the target multi-source data;

[0088] Step S202: Filter unstructured data from the target multi-source data to obtain unstructured data;

[0089] Step S203: Obtain the corresponding data information from the unstructured data to obtain the feature data information;

[0090] Step S204: Match the feature data information with the corresponding structured data to transform the unstructured data into structured data, thus obtaining structured data.

[0091] In steps S201 to S204 of this embodiment, the currently acquired multi-source network security data is judged one by one to filter out abnormal data and remove it, resulting in the remaining multi-source network security data, i.e., the target multi-source data. The target multi-source data is then filtered according to its data format to remove unstructured data, resulting in unstructured data. Corresponding data information is then filtered and obtained from the data information contained in the unstructured data to obtain feature data information. This feature data information is mapped to corresponding structured data fields, allowing attribute matching between the feature data information and the corresponding structured data to transform the unstructured data into structured data, resulting in structured data. By removing abnormal data and converting unstructured data into structured data, attribute extraction becomes easier.

[0092] It should be noted that structured data also includes structured data in the target multi-source data. The target multi-source data is filtered according to its data format to select structured data. Specifically, if the data format of the currently acquired target multi-source data is structured, the currently acquired target multi-source data is filtered out to obtain structured data, and the structured data is defined as structured data.

[0093] In step S201 of some embodiments, abnormal data includes duplicate data and data with missing attributes. The currently acquired network security multi-source data is compared with other network security multi-source data in the dataset. If the currently acquired network security multi-source data is identical to any other network security multi-source data, then the currently acquired network security multi-source data is defined as duplicate data and removed from the network security multi-source data dataset. Additionally, based on preset requirement rules, the currently acquired network security multi-source data is judged for missing attributes. If the currently acquired network security multi-source data lacks an attribute required by the requirement rules, then the currently acquired network security multi-source data is defined as data with missing attributes and removed from the network security multi-source data dataset.

[0094] In step S202 of some embodiments, if the data format of the currently acquired target multi-source data is unstructured data, then the currently acquired target multi-source data is filtered out to obtain unstructured data, and the unstructured data is defined as unstructured data.

[0095] In step S203 of some embodiments, the data information contained in the unstructured data is filtered according to preset attributes, and the data information corresponding to the preset attributes is obtained to obtain feature data information.

[0096] Please see Figure 3 In some embodiments, a network security relationship table is obtained by defining a relationship table between entity fields and attributes according to preset demand rules and preset network security scenarios. This may include, but is not limited to, steps S301 to S304:

[0097] Step S301: Determine the dimensions to be constructed based on the requirements rules and network security scenarios to obtain the network security dimensions;

[0098] Step S302: Determine the entity to be constructed based on the requirements rules and network security dimensions to obtain the target entity fields;

[0099] Step S303: Obtain the corresponding dimension data from the structured data according to the network security dimension to obtain the dimension attribute data;

[0100] Step S304: Define the attributes of the target entity fields based on the dimension attribute data to construct a relationship table between entity fields and attributes, thereby obtaining a network security relationship table.

[0101] Steps S301 to S304 of this embodiment involve retrieving dimensions related to the network security scenario, and simultaneously filtering out the dimensions to be constructed based on the user's requirements set on the dimensions in the requirement rules, thus obtaining network security dimensions. Entities related to the current network security dimensions are then retrieved. After sequentially retrieving several network security dimensions, entities to be constructed are filtered from several entities in each network security dimension based on the user's requirements on the entities in the requirement rules, and corresponding fields are obtained to represent the entities to be constructed, thus obtaining target entity fields. Data for the corresponding dimension is filtered in structured data based on the current network security dimension. After sequentially filtering in structured data based on several network security dimensions, dimension attribute data is obtained. Attributes of the target entity fields for the corresponding dimensions are defined based on the dimension attribute data, so that the dimension attribute data matches the target entity fields for the corresponding dimensions, thereby constructing a relationship table between the target entity fields and the dimension attribute data, thus obtaining a network security relationship table. By clearly defining the network security dimensions and entities to be constructed based on the user's needs and the network security scenario of the application, and obtaining the entity data in the corresponding dimensions, constructing a relationship table facilitates the efficient construction of the required entities.

[0102] It should be noted that the requirement rules include: the representation format of the knowledge graph to be created, or the knowledge dimensions and structure to be expressed in a specific scenario, as well as user-specified or general graph representation information. The initial requirement rules are pre-defined by the user to form a configuration template. If the current cybersecurity scenario is the same, the configuration template can be directly imported for subsequent use. If the current cybersecurity scenario is different, the requirement rules are reconstructed for use, and the reconstructed requirement rules are set as the configuration template.

[0103] The target entity field includes the type of entity. For example, at the attack behavior level, basic attack (BA), complex attack (CA), and attack event (AE) entity types are defined. At the vulnerability level, vulnerabilities (CVE) and weaknesses (CWE) are defined. At the asset level, entity types such as software, hardware, operating system, and host are defined. At the topology level, entity types such as terminal, router, and switch are defined.

[0104] Please see Figure 4 In some embodiments, after obtaining the corresponding dimension data from the structured data according to the network security dimension and obtaining the dimension attribute data, the knowledge graph construction method may also include, but is not limited to, steps S401 to S403:

[0105] Step S401: Filter the dimension attribute data one by one to obtain the target dimension attribute data;

[0106] Step S402: Based on the requirements rules, identify the necessity of the target dimension attribute data to obtain the necessity identification results;

[0107] Step S403: If the necessity identification result indicates that the target dimension attribute data is necessary, then the target dimension attribute data is defined as necessary attribute data.

[0108] Steps S401 to S403, as illustrated in this embodiment, use the currently selected dimension attribute data as the target dimension attribute data. Based on the user's necessity requirements in the requirement rules, the necessity of the target dimension attribute data is identified to determine its necessity within the entity, thus obtaining a necessity result. If the necessity identification result indicates that the target dimension attribute data is a necessary attribute within the entity, then the target dimension data is defined as necessary attribute data. By determining the necessity of attributes and selecting necessary attribute data, it is possible to identify missing necessary attributes in the constructed cybersecurity knowledge graph, thereby improving the accuracy of constructing the cybersecurity knowledge graph.

[0109] It should be noted that if the necessity identification result indicates that the target dimension attribute data is optional, then the target dimension attribute data is defined as optional attribute data.

[0110] The configuration file is read to categorize the attributes of each entity into required and optional attributes, and the required and optional attribute data obtained after categorization are placed in corresponding lists. Before extracting entities and their relationships, the configuration file is automatically loaded. Based on a specific field key in the configuration file, the required and optional attribute data in the lists are identified. The values ​​of the required attribute data in the lists are set as the required attribute fields of the entity to be created, and the values ​​of the optional attribute data in the lists are set as the optional attribute fields of the entity to be created.

[0111] Essential attribute fields are the necessary attribute fields to constitute a complete entity, such as the unique identifier of a CVE vulnerability in the cybersecurity field, CVE-2022-42248. Essential attribute data serves as an indicator of entity data completeness, while optional attribute data serves as additional or supplementary attributes of the entity, used to expand and enrich the entity's attribute information. Referring to Table 1, which is a cybersecurity relationship table derived from the dimensions and attributes of entities in the cybersecurity field, examples of entities that can be established, along with their essential and optional attribute data, are provided.

[0112] Table 1. Knowledge Dimensions and Examples of Entities that Can Be Established in the Field of Cybersecurity

[0113]

[0114]

[0115] Based on user requirements according to the demand rules, the types of entities can be expanded. For example, basic attacks considering offensive and defensive behavioral knowledge can be incorporated, along with descriptions of various tactics and strategies from ATT&CK, used for entity representation in the attack dimension, and their attribute features extracted. Expandable domains also include industry-specific domain dimensions, such as common infrastructure in the energy and power sector, such as transformers and electromagnetic controllers, allowing entities to be extended to richer industry scenarios. User requirements originate from user input, including requirements for scene graph construction. Furthermore, the initial expandable entities and attributes are directly set by the user, and can be subsequently imported from pre-configured templates or general configuration templates.

[0116] Common entity dimensions that can be established in the field of cybersecurity include: network topology, assets, vulnerabilities and weaknesses, attack behavior, and defense behavior. These can be further expanded into attack tool dimensions and attack-based defense tool dimensions by combining attack behavior characteristics. For example, in the network topology dimension, and in terms of customizable entity attributes, the IP address, MAC address, and gateway of devices can be defined based on the types of devices involved in the actual network. In the asset dimension, this includes the associated unique node ID. In the attack tool dimension, the defense coverage of attack tools can be analyzed based on the tactics, techniques, and defense methods of the attack dimension, abstracting the attack characteristic attributes of the tools.

[0117] For specific industry dimensions, this can be extended to specific scenarios, and entities and attributes can be modeled. For example, in the field of automotive communication, topological nodes in the automotive domain can be established, including: engine control unit (ECU), brake control unit (BCU), body control unit (BCU), transmission control unit (TCU), etc. The characteristics and modeling of the communication domain require establishing the attributes of the nodes, including: the types of connected sensors and actuators, supported communication protocols and data transmission rates, control algorithms and logic characteristics, etc.

[0118] Following step S102 in some embodiments, the knowledge graph construction method further includes: constructing a rule base. Rule selection typically requires construction based on human experience, domain knowledge, machine learning, etc. This involves analyzing multi-source data to obtain common features and establishing appropriate rules based on these features. Commonly used rules include regular expression rules, dictionary matching rules, syntax analysis rules, and statistical learning rules. For example, for a person's name entity, regular expression rules can be constructed using the structural features of the name (surname, given name) and the contextual information. For a location entity, dictionary matching rules can be constructed by collecting place name dictionaries and using rule matching.

[0119] It should be noted that target extraction rules include regular expression rules, dictionary matching rules, syntax analysis rules, statistical learning rules, etc. For example, the rule for extracting the IP address in a node uses regular expression matching of the field number, with each number being between 0 and 255; the gateway address of a node uses dictionary matching rules, obtaining the gateway address of the node by parsing the key-value pairs of specific fields in the structured JSON data. Semantic analysis and statistical learning methods are often used for text attribute extraction, used to parse attribute data of complex language structures and expressions.

[0120] In step S104 of some embodiments, attribute fields are matched based on predefined rules, relationship fields are matched based on predefined rules, specific fields between entities are associated, and relationships are identified and established using rules.

[0121] It should be noted that semantically informative entities are extracted from multi-source data. An extraction method based on target extraction rules is used to extract entities and attributes, specifically for preprocessed structured data. Furthermore, a target extraction rule-based method is employed to extract relationships between entities, including regular expressions, template matching, and keyword matching. For entity types with complex attributes, a combination of multiple rules is used for attribute extraction. This rule-based approach enables efficient batch data extraction during the extraction process.

[0122] Please see Figure 5 In some embodiments, after automatically identifying and extracting corresponding attribute data from structured data according to target extraction rules to obtain network security attribute data, the knowledge graph construction method may also include, but is not limited to, steps S501 to S502:

[0123] Step S501: Perform integrity identification on the network security attribute data based on the necessary attribute data to obtain the integrity identification result;

[0124] Step S502: If the integrity identification result indicates that the data is incomplete, then the missing necessary attribute data is re-identified and supplemented in the structured data to update the network security attribute data.

[0125] Steps S501 to S502, as illustrated in this embodiment, compare the necessary attribute data with the extracted network security attribute data to identify the completeness of the necessary attribute data contained in the network security attribute data, obtaining a completeness identification result. If the completeness identification result indicates that the necessary attribute data contained in the network security attribute data is incomplete, the process returns to step S104 to re-identify and extract the necessary attribute data from the structured data, extracting the missing necessary attribute data and supplementing it into the network security attribute data to update the current network security attribute data. By performing completeness identification on the extracted network security attribute data to determine its completeness, and thus improving the accuracy of identifying the constructed entities, the accuracy of the constructed network security knowledge graph can be enhanced.

[0126] It should be noted that there are several corresponding extraction rules for the defined entities and attributes in the rule base. The extraction rule to be used is determined based on the source of the data. When an entity extraction instruction is received, the original data of the extraction rule is automatically loaded, and the actual value of the entity's attribute is obtained by matching the extraction rule.

[0127] Specifically, entity identification and attribute extraction are performed on structured data. The process involves identifying whether all extracted cybersecurity attribute data includes necessary attribute data. If all cybersecurity attribute data includes necessary attribute data, feature instances of the corresponding entities are constructed based on the cybersecurity attribute data, and optional attribute data is set in the feature instances of the entities. If the cybersecurity attribute data does not include any necessary attribute data, the cybersecurity attribute data is returned to step S104 for re-identification and extraction. Missing necessary attribute data is extracted using extraction rules or data completion. If the cybersecurity attribute data still does not include any necessary attribute data, the cybersecurity attribute data is discarded.

[0128] Furthermore, the system identifies whether each attribute field in the extracted network security attribute data is empty. Based on the necessary attribute data mentioned in the configuration file, if the actual values ​​of all attributes in the network security relationship table are extracted, the constructed entity instance is valid; if any necessary attribute data field is empty or does not exist, the constructed entity instance is invalid. By using extraction rules for rapid attribute matching and extraction, the efficiency of entity extraction is improved. Moreover, the extraction rules are optimized and adjusted for specific tasks, which can improve the accuracy of entity extraction.

[0129] For example, taking a Chinese news article as an example, assuming we need to extract personal names and place names, we can do so through the following steps:

[0130] By collecting news articles and other data from multiple sources, and performing word segmentation and part-of-speech tagging on the collected news articles and other data according to the required rules, each word is matched using dictionary rules to determine whether it is a person's name or a place name. If it is a person's name or a place name, the current word is extracted to obtain network security attribute data. Specifically, for person's name entities, regular expression rules can be constructed based on the structural features of the name to match common Chinese names. For place name entities, matching can be performed based on a place name dictionary, such as "Beijing", "Shanghai", and "Guangzhou".

[0131] Please see Figure 6 In some embodiments, network security attribute data includes network security attributes and network security associations. Network security entities are constructed based on the network security attribute data, and these entities are associated to build a network security knowledge graph. The resulting target knowledge graph includes, but is not limited to, steps S601 to S602:

[0132] Step S601: Import network security attributes into the entity to be constructed to obtain the network security entity;

[0133] Step S602: Associate network security entities according to network security relationship to construct a network security knowledge graph and obtain the target knowledge graph.

[0134] Steps S601 to S602, as illustrated in this embodiment, map network security attributes to fields of the entity to be constructed, importing network security attributes into the entity, setting the attributes of the entity to be constructed, obtaining network security entities, and associating network security entities according to network security relationships to construct a network security knowledge graph, thus obtaining the target knowledge graph. By accurately associating network security attributes with network security relationships to construct a complete knowledge graph, the construction of the network security knowledge graph can be accurately completed.

[0135] It should be noted that the relationships between entities of the same dimension and across dimensions are associated based on the established network security entities.

[0136] In some embodiments, the entity construction process includes: determining the entity type, collecting entity data, labeling entity data, and building entity models and indexes. Entity data is obtained through web crawling, API interfaces, natural language processing, etc., and then data cleaning, deduplication, labeling, and other operations are performed to ultimately build entity models and indexes to support fast querying and retrieval.

[0137] Entity relationships are established by analyzing the relationships between entities and determining association rules based on shared attributes or business logic. These relationships are automatically analyzed after the extraction process and represented as edges in the knowledge graph. Knowledge graph construction connects the constructed entities and their relationships, representing them through knowledge information. The construction process relies on data storage in the form of a graph and does not involve entity extraction or the logic for expressing relationships.

[0138] This paper adds network topology dimension information to the cybersecurity knowledge graph, establishes associations between topology nodes, and represents physically reachable connections in the actual network topology. The spatial characteristics of the cybersecurity knowledge graph are represented through network topology information. By preprocessing security events from multi-source data, attack associations between two topology nodes are extracted and expressed as edges connecting the topology nodes. The edge attributes record the time and type of the attack event. Here, a single topology node is an entity, and the connections between multiple topology nodes are relationships.

[0139] Please see Figure 10 , Figure 10 This is a schematic diagram illustrating the spatiotemporal features of a knowledge graph. Figure 10All circles in the diagram represent entities, such as CVE-2010 as a vulnerability-dimensional entity, web server 'a' as an asset-dimensional entity, SQL injection and command execution as attack-dimensional entities, external and internal as topological-dimensional features, and the attack sequence of the bielliptic expression as a set of relations in the time dimension. The representation of the relations is shown in the diagram.

[0140] Please see Figure 7 In some embodiments, the knowledge graph construction method may also include, but is not limited to, steps S701 to S702:

[0141] Step S701: Obtain multi-source network security data in real time according to the demand rules to obtain the current multi-source data;

[0142] Step S702: Obtain the attributes of entities in the current multi-source data to obtain entity attribute data;

[0143] Step S703: Update the rule base based on the entity attribute data to optimize the rule base.

[0144] Steps S701 to S703, as illustrated in this embodiment, involve acquiring new multi-source cybersecurity data in real-time from a database in the cybersecurity field according to demand rules, obtaining current multi-source data, and acquiring the attributes used to construct entities from the current multi-source data to obtain entity attribute data. The extraction rules in the rule base are then modified based on the entity attribute data to optimize the rule base. By acquiring new multi-source data in real-time and obtaining the attribute data for constructing entities from the multi-source data, and updating the rule base based on the attribute data, the accuracy and efficiency of entity extraction can be improved, thereby enhancing the accuracy of constructing a cybersecurity knowledge graph.

[0145] It should be noted that the rule base consists of predefined rules for extracting the attributes of various entity types, and it is built using either manual writing or automatic learning methods. In practical applications, the rule base usually needs to be continuously updated and optimized to improve the accuracy and efficiency of entity extraction.

[0146] In some embodiments, updating the rule base includes the following iterative steps:

[0147] Collect new data: Continuously collect new data based on actual needs to update the extraction rules for entity types and attributes in the rule base. This can be accomplished through methods such as web scraping, web crawling, and data acquisition.

[0148] Data analysis: Analyze newly collected data to find new entity types and attributes, or to identify deficiencies and problems in existing entity type and attribute extraction rules, so as to update and optimize the rule base.

[0149] Design and update rules: Based on new entity types and attributes, or the shortcomings and problems of existing rules, design new rules or update existing rules to improve the accuracy and efficiency of entity extraction.

[0150] Debugging and testing rules: Use a certain test dataset to debug and test new or updated rules to verify their accuracy and usability.

[0151] Deployment rules: Deploy new or updated rules to the production environment to update and optimize entity extraction.

[0152] Monitoring and feedback: Monitor and provide feedback on entity extraction results to promptly identify and resolve issues, further optimize the rule base, and improve the quality and efficiency of entity extraction.

[0153] The above steps involve continuously updating and optimizing the rule base to adapt to constantly changing data and actual needs, thereby improving the efficiency and accuracy of entity extraction.

[0154] Please see Figure 8 This application also provides a knowledge graph construction device that can implement the above-mentioned knowledge graph construction method and be applied to network security. The knowledge graph construction device includes: a multi-source data processing module 801, a relation table definition module 802, an extraction rule filtering module 803, an attribute data extraction module 804, and a knowledge graph construction module 805. The multi-source data processing module 801, the relation table definition module 802, the extraction rule filtering module 803, the attribute data extraction module 804, and the knowledge graph construction module 805 are all communicatively connected.

[0155] The multi-source data processing module 801 preprocesses multi-source cybersecurity data obtained from databases in the cybersecurity field to obtain structured data. The relation table definition module 802 defines a relation table between entity fields and attributes based on preset requirement rules and preset cybersecurity scenarios to obtain a cybersecurity relation table. The extraction rule filtering module 803 filters corresponding extraction rules from a pre-established rule base based on the cybersecurity relation table to obtain target extraction rules. The attribute data extraction module 804 automatically identifies and extracts corresponding attribute data from the structured data according to the target extraction rules to obtain cybersecurity attribute data. The knowledge graph construction module 805 constructs cybersecurity entities based on the cybersecurity attribute data and associates these entities to build a cybersecurity knowledge graph, obtaining the target knowledge graph.

[0156] The multi-source data processing module 801 acquires multi-source network security data from a database in the network security field and preprocesses the data to convert it into structured data. The relation table definition module 802 determines the entities to be constructed and their corresponding attributes based on preset requirements and network security scenarios, and defines the entity fields and attributes to construct a relation table of entity fields and attributes, thus obtaining a network security relation table. The extraction rule filtering module 803 filters the attributes in the network security relation table from a pre-established rule base to select extraction rules for each attribute, thus obtaining target extraction rules. The attribute data extraction module 804 automatically identifies the structured data according to the target extraction rules to identify the required attribute data and extracts the corresponding attribute data, thus obtaining network security attribute data. The knowledge graph construction module 805 constructs entities based on the network security attribute data to build network security entities, and associates these entities with each other to construct a network security knowledge graph, thus obtaining the target knowledge graph. By automatically matching the attributes of specific entities to the preprocessed structured data through the set extraction rules, the required attribute data can be identified. This can accurately match entity fields and corresponding attributes. Compared with complex model calculation techniques, matching the attributes of specific entities through extraction rules and directly extracting the attributes of specific entities can efficiently obtain the required attribute data, thereby improving the speed of building a multi-dimensional cybersecurity knowledge graph.

[0157] The specific implementation of this knowledge graph construction device is basically the same as the specific implementation of the knowledge graph construction method described above, and will not be repeated here.

[0158] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned knowledge graph construction method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0159] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0160] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0161] The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the knowledge graph construction method of the embodiments of this application.

[0162] The input / output interface 903 is used to implement information input and output;

[0163] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0164] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0165] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0166] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described knowledge graph construction method.

[0167] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0168] The knowledge graph construction method, knowledge graph construction device, electronic device and storage medium provided in this application embodiment, by layering and classifying knowledge in the field of network security, define types representing different entities, and expand the attribute fields of various entities, more accurately describe heterogeneous knowledge in the field of network security, and can build network security knowledge graphs of different dimensions according to different scenario requirements, so as to better meet the needs of the scenario.

[0169] By combining expert knowledge to establish important attribute extraction rules for different entities, rapid entity identification can be performed on preprocessed multi-source data. Combined with the attribute extraction rules of existing entities, entity instances can be extracted efficiently and automatically.

[0170] Entity attribute extraction employs a completeness check based on required fields, while simultaneously defining a series of optional attribute fields. When defining attributes for various entities, it is determined which attributes are essential for constituting the entity. When all required fields in entity extraction are satisfied, the creation of the instance is triggered. Optional attribute fields serve as supplementary features for the entity, and are added after the instance is constructed.

[0171] By integrating rule-based entity attribute extraction and multi-dimensional entity attribute definition technologies, a cybersecurity knowledge graph can be constructed quickly and accurately even with multi-source data. Entity attributes are extensible, allowing for the definition of entity nodes with a topological dimension containing spatial information, and attack behavior entities and their relationships with a time-series dimension. This also allows for the accurate construction of an MDATA knowledge graph with spatiotemporal attributes, providing foundational data support for threat intelligence analysis, security policy formulation, and situational awareness.

[0172] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0173] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0174] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0175] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0176] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0177] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0178] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0179] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0180] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0181] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0182] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for constructing a knowledge graph, characterized in that, Applied to network security, the knowledge graph construction method includes: Preprocessing of multi-source cybersecurity data obtained from databases in the cybersecurity field yields structured data; The dimensions to be constructed are determined based on the preset requirements rules and preset network security scenarios, thus obtaining the network security dimensions; wherein, the requirements rules include the knowledge dimensions and structures that need to be expressed under the network security scenarios; Based on the aforementioned requirement rules and network security dimensions, the entity to be constructed is determined, and the target entity fields are obtained. Based on the network security dimension, data corresponding to the specified dimension is obtained from the structured data to obtain dimension attribute data; The target entity fields are defined according to the dimensional attribute data to construct a relationship table between entity fields and attributes, thereby obtaining a network security relationship table. Based on the network security relationship table, the corresponding extraction rules are filtered from the pre-established rule base to obtain the target extraction rules; According to the target extraction rules, the corresponding attribute data is automatically identified and extracted from the structured data to obtain network security attribute data; Based on the network security attribute data, network security entities are constructed and associated to build a network security knowledge graph, thereby obtaining the target knowledge graph.

2. The knowledge graph construction method according to claim 1, characterized in that, The process of preprocessing multi-source cybersecurity data obtained from databases in the cybersecurity field to obtain structured data includes: Abnormal data is filtered and removed from the network security multi-source data to obtain the target multi-source data; Unstructured data is obtained by filtering unstructured data from the target multi-source data; Obtain the corresponding data information from the unstructured data to obtain feature data information; The feature data information is matched with the corresponding structured data to transform the unstructured data into structured data, thus obtaining the structured data.

3. The knowledge graph construction method according to claim 1, characterized in that, After obtaining the corresponding dimension data from the structured data according to the network security dimension, the knowledge graph construction method further includes: By successively filtering the dimensional attribute data, the target dimensional attribute data is obtained; The necessity of the target dimension attribute data is identified according to the aforementioned requirement rules, and the necessity identification result is obtained. If the necessity identification result indicates that the target dimension attribute data is necessary, then the target dimension attribute data is defined as necessary attribute data.

4. The knowledge graph construction method according to claim 3, characterized in that, After automatically identifying and extracting corresponding attribute data from the structured data according to the target extraction rules to obtain network security attribute data, the knowledge graph construction method further includes: The network security attribute data is subjected to integrity identification based on the necessary attribute data to obtain the integrity identification result. If the integrity identification result indicates that the data is incomplete, the missing necessary attribute data is re-identified and supplemented in the structured data to update the network security attribute data.

5. The knowledge graph construction method according to claim 4, characterized in that, The network security attribute data includes network security attributes and network security associations. The step of constructing network security entities based on the network security attribute data and associating these entities to build a network security knowledge graph, thereby obtaining the target knowledge graph, includes: The network security attributes are imported into the entity to be constructed to obtain the network security entity; The network security entities are associated with each other based on the network security relationship to construct a network security knowledge graph and obtain the target knowledge graph.

6. The knowledge graph construction method according to claim 1, characterized in that, The knowledge graph construction method also includes: Based on the aforementioned demand rules, the network security multi-source data is acquired in real time to obtain the current multi-source data; Obtain the attributes of entities in the current multi-source data to obtain entity attribute data; The rule base is updated based on the entity attribute data to optimize the rule base.

7. A knowledge graph construction device, characterized in that, For use in network security, the knowledge graph construction apparatus includes: The multi-source data processing module is used to preprocess multi-source cybersecurity data obtained from databases in the cybersecurity field to obtain structured data; The relationship table definition module is used to determine the dimensions to be constructed based on preset requirement rules and preset network security scenarios, thereby obtaining network security dimensions; wherein, the requirement rules include the knowledge dimensions and structures that need to be expressed under the network security scenario; determine the entities to be constructed based on the requirement rules and the network security dimensions, thereby obtaining target entity fields; obtain the corresponding dimension data from the structured data based on the network security dimensions, thereby obtaining dimension attribute data; define the attributes of the target entity fields based on the dimension attribute data to construct a relationship table between entity fields and attributes, thereby obtaining a network security relationship table; The extraction rule filtering module is used to filter the corresponding extraction rules in the pre-established rule base according to the network security relationship table to obtain the target extraction rule; The attribute data extraction module is used to automatically identify and extract corresponding attribute data from the structured data according to the target extraction rules to obtain network security attribute data. The knowledge graph construction module is used to construct network security entities based on the network security attribute data, and associate the network security entities to construct a network security knowledge graph and obtain the target knowledge graph.

8. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the knowledge graph construction method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the knowledge graph construction method according to any one of claims 1 to 6.

Images