Network security ontology construction method and device, electronic equipment and storage medium

Abstract

This application provides a method, apparatus, electronic device, and storage medium for constructing a network security ontology. The method includes: acquiring network security data corresponding to the construction requirements of the network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data; constructing an initial multi-branch tree corresponding to the structured network security data based on the structured network security data; updating the initial multi-branch tree based on the unstructured network security data to obtain an updated target multi-branch tree; and generating a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-branch tree. This overcomes the problems of existing technologies requiring manual construction, processing data from a single source, and handling data format compatibility issues, thereby improving the efficiency of generating ontology files.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method, apparatus, electronic device, and storage medium for constructing a network security ontology. Background Technology

[0002] In recent years, cyberattacks have occurred frequently and with diverse methods, posing a severe challenge to network security. The internet contains a vast amount of network security-related data, such as network security alerts from firewalls and intrusion detection systems, vulnerability databases established by network security research institutions or vendors, and security bulletins issued by internet security forums and vendors. However, due to the discrete and fragmented nature of this network security data, it is impossible to obtain a comprehensive understanding of the network security situation from it.

[0003] With the continuous development of science and technology, security ontology technology can be applied to network security. Security ontology technology uses a knowledge representation method called "ontology" to express knowledge in the security field in a shareable and unambiguous way. Its specific form is one or more files that meet specific structural requirements.

[0004] Currently, ontology construction requires manual work, which is not only time-consuming and labor-intensive, but also difficult to meet the needs of large-scale ontology construction. Therefore, how to achieve automatic ontology construction and improve the efficiency of ontology construction is an urgent problem to be solved. Summary of the Invention

[0005] The purpose of some embodiments of this application is to provide a method, apparatus, electronic device, and storage medium for constructing a network security ontology. Through the technical solutions of the embodiments of this application, network security data corresponding to the construction requirements of the network security ontology is obtained, wherein the network security data includes at least structured network security data and unstructured network security data; an initial multi-branch tree corresponding to the structured network security data is constructed based on the structured network security data; the initial multi-branch tree is updated based on the unstructured network security data to obtain an updated target multi-branch tree; and a network security ontology file corresponding to the construction requirements of the network security ontology is generated based on the target multi-branch tree. The embodiments of this application, by first constructing an initial multi-branch tree using structured network security data according to the construction requirements of the network security ontology, and then updating each node of the initial multi-branch tree using unstructured network security data to obtain a target multi-branch tree, and generating a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-branch tree, overcomes the problems of existing technologies requiring manual construction, processing single data sources, and poor data format compatibility, thus improving the efficiency of generating ontology files.

[0006] Firstly, some embodiments of this application provide a method for constructing a network security ontology, including:

[0007] Obtain network security data corresponding to the construction requirements of network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data;

[0008] Based on the structured network security data, construct an initial multi-branch tree corresponding to the structured network security data;

[0009] The initial multi-way tree is updated based on the unstructured network security data to obtain the updated target multi-way tree;

[0010] Based on the target multi-branch tree, generate a network security ontology file corresponding to the construction requirements of the network security ontology.

[0011] Some embodiments of this application, based on the construction requirements of the network security ontology, first construct an initial multi-branch tree using structured network security data, and then update each node of the initial multi-branch tree using unstructured network security data to obtain a target multi-branch tree. Based on the target multi-branch tree, a network security ontology file corresponding to the construction requirements of the network security ontology is generated. This overcomes the problems of existing technologies requiring manual construction, processing data from a single source, and processing data format compatibility issues, thereby improving the efficiency of generating ontology files.

[0012] Optionally, constructing an initial multi-way tree corresponding to the structured network security data based on the structured network security data includes:

[0013] The structured network security data is converted into a class package, wherein the class package includes at least a fully qualified class name, data attributes, method attributes, and constraints;

[0014] The nodes of the initial multi-branch tree are determined based on the complete class name, data attributes, method attributes, constraints, and inter-class relationships in the class package.

[0015] The initial multi-way tree is obtained by merging and deleting the nodes using a split hierarchical clustering method.

[0016] Some embodiments of this application can automatically convert multi-source heterogeneous network security data into an intermediate format that is easy to process by collecting structured and unstructured network security data. This is a key support for subsequent ontology concept extraction and ontology generation. Ontology elements, including concepts, hierarchical relationships between concepts, and non-hierarchical relationships between concepts, are extracted from the intermediate format of security data. The ontology model after extracting ontology elements is stored using a unified multi-branch tree data structure.

[0017] Optionally, extracting the attributes, methods, and inter-class relationships from the class package into nodes of the initial multi-way tree includes:

[0018] The complete class name is mapped to the node concept name of the initial multi-way tree, and the class name path is decomposed into nodes between the root node and the concept leaf node;

[0019] Map the data attributes in the class package to node data attributes, while preserving the names of the data attributes;

[0020] Map the method properties in the class package to node object properties, retaining the names of the method properties; convert the constraints into node axiom properties.

[0021] Some embodiments of this application focus on constructing concepts and relationships between concepts by corresponding multi-branch trees and ontology files, and innovatively use Java class packages as an intermediate form to preserve relatively complete data source semantic information.

[0022] Optionally, the step of employing a split hierarchical clustering method to merge and delete nodes to obtain the initial multi-way tree includes:

[0023] Obtain the concept nodes with the same name from all nodes in the initial multi-way tree;

[0024] The concept nodes with the same name and the identifiers corresponding to the concept nodes with the same name are grouped and stored as key-value pairs, and the concept nodes with the same name are processed in groups.

[0025] Calculate the semantic distance between the nodes with the same name;

[0026] Based on the semantic distance and the preset threshold, it is determined whether to cluster nodes with the same name, and the determination result is obtained.

[0027] Based on the judgment result, the nodes with the same name are merged and deleted to obtain the initial multi-branch tree.

[0028] Some embodiments of this application employ split hierarchical clustering and agglomerative hierarchical clustering methods, respectively targeting ontology learning for structured data and ontology learning for unstructured data, which can better handle the problems of concept duplication and conflict.

[0029] Optionally, updating the initial multi-way tree based on the unstructured network security data to obtain the updated target multi-way tree includes:

[0030] Natural language processing tools are used to process the unstructured security data to obtain conceptual information corresponding to the unstructured security data;

[0031] Calculate the semantic similarity between the concept information and each node in the initial multi-way tree;

[0032] Based on the semantic similarity and the preset string similarity threshold, determine whether to update the initial multi-way tree;

[0033] Based on the judgment result, the target multi-branch tree is determined.

[0034] Some embodiments of this application update the nodes on the multi-way tree with unstructured secure data based on the established structured secure data. This allows different types of data to be processed, making the generated multi-way tree cover more comprehensive data.

[0035] Optionally, determining whether to update the initial multi-way tree based on the semantic similarity and a preset string similarity threshold includes:

[0036] If the semantic similarity is greater than or equal to the preset string, the concept information and the initial multi-way tree are aggregated.

[0037] If the semantic similarity is less than the preset string, the conceptual information is used as a child node of the current node of the initial multi-way tree, and the initial multi-way tree is updated.

[0038] Some embodiments of this application calculate the similarity between unstructured security data and nodes on the multi-branch tree based on the established structured security data, and then aggregate and delete nodes on the multi-branch tree according to the similarity to obtain a more accurate multi-branch tree.

[0039] Optionally, generating a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-way tree includes:

[0040] Based on the ontology factory model, create ontology instance objects;

[0041] According to the mapping rules from the target multi-branch tree to the ontology instance object, the conceptual information in the target multi-branch tree is mapped to the ontology instance object;

[0042] Perform a level-order traversal of the target multi-way tree and map each node of the target multi-way tree to an ontology instance object;

[0043] The ontology output interface is called, and the ontology instance object is passed in as an actual parameter to obtain the network security ontology file corresponding to the construction requirements of the network security ontology.

[0044] Some embodiments of this application, from the mapping and output logic of the target multi-way tree to the ontology file, can output the stored target multi-way tree as an ontology file. The generated ontology conforms to the OWL DL (Web Ontology Language) specification and meets the requirements of consistency and correctness.

[0045] Secondly, some embodiments of this application provide an apparatus for constructing a network security ontology, including:

[0046] The acquisition module is used to acquire network security data corresponding to the construction requirements of the network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data;

[0047] A construction module is used to construct an initial multi-branch tree corresponding to the structured network security data based on the structured network security data;

[0048] An update module is used to update the initial multi-way tree based on the unstructured network security data to obtain the updated target multi-way tree;

[0049] The generation module is used to generate a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-branch tree.

[0050] Some embodiments of this application, based on the construction requirements of the network security ontology, first construct an initial multi-branch tree using structured network security data, and then update each node of the initial multi-branch tree using unstructured network security data to obtain a target multi-branch tree. Based on the target multi-branch tree, a network security ontology file corresponding to the construction requirements of the network security ontology is generated. This overcomes the problems of existing technologies requiring manual construction, processing data from a single source, and processing data format compatibility issues, thereby improving the efficiency of generating ontology files.

[0051] Optionally, the building module is used for:

[0052] The structured network security data is converted into a class package, wherein the class package includes at least a fully qualified class name, data attributes, method attributes, and constraints;

[0053] The nodes of the initial multi-branch tree are determined based on the complete class name, data attributes, method attributes, constraints, and inter-class relationships in the class package.

[0054] The initial multi-way tree is obtained by merging and deleting the nodes using a split hierarchical clustering method.

[0055] Some embodiments of this application can automatically convert multi-source heterogeneous network security data into an intermediate format that is easy to process by collecting structured and unstructured network security data. This is a key support for subsequent ontology concept extraction and ontology generation. Ontology elements, including concepts, hierarchical relationships between concepts, and non-hierarchical relationships between concepts, are extracted from the intermediate format of security data. The ontology model after extracting ontology elements is stored using a unified multi-branch tree data structure.

[0056] Optionally, the building module is used for:

[0057] The complete class name is mapped to the node concept name of the initial multi-way tree, and the class name path is decomposed into nodes between the root node and the concept leaf node;

[0058] Map the data attributes in the class package to node data attributes, while preserving the names of the data attributes;

[0059] Map the method properties in the class package to node object properties, retaining the names of the method properties; convert the constraints into node axiom properties.

[0060] Some embodiments of this application focus on constructing concepts and relationships between concepts by corresponding multi-branch trees and ontology files, and innovatively use Java class packages as an intermediate form to preserve relatively complete data source semantic information.

[0061] Optionally, the building module is used for:

[0062] Obtain the concept nodes with the same name from all nodes in the initial multi-way tree;

[0063] The concept nodes with the same name and the identifiers corresponding to the concept nodes with the same name are grouped and stored as key-value pairs, and the concept nodes with the same name are processed in groups.

[0064] Calculate the semantic distance between the nodes with the same name;

[0065] Based on the semantic distance and the preset threshold, it is determined whether to cluster nodes with the same name, and the determination result is obtained.

[0066] Based on the judgment result, the nodes with the same name are merged and deleted to obtain the initial multi-branch tree.

[0067] Some embodiments of this application employ split hierarchical clustering and agglomerative hierarchical clustering methods, respectively targeting ontology learning for structured data and ontology learning for unstructured data, which can better handle the problems of concept duplication and conflict.

[0068] Optionally, the update module is used to:

[0069] Natural language processing tools are used to process the unstructured security data to obtain conceptual information corresponding to the unstructured security data;

[0070] Calculate the semantic similarity between the concept information and each node in the initial multi-way tree;

[0071] Based on the semantic similarity and the preset string similarity threshold, determine whether to update the initial multi-way tree;

[0072] Based on the judgment result, the target multi-branch tree is determined.

[0073] Some embodiments of this application update the nodes on the multi-way tree with unstructured secure data based on the established structured secure data. This allows different types of data to be processed, making the generated multi-way tree cover more comprehensive data.

[0074] Optionally, the update module is used to:

[0075] If the semantic similarity is greater than or equal to the preset string, the concept information and the initial multi-way tree are aggregated.

[0076] If the semantic similarity is less than the preset string, the conceptual information is used as a child node of the current node of the initial multi-way tree, and the initial multi-way tree is updated.

[0077] Some embodiments of this application calculate the similarity between unstructured security data and nodes on the multi-branch tree based on the established structured security data, and then aggregate and delete nodes on the multi-branch tree according to the similarity to obtain a more accurate multi-branch tree.

[0078] Optionally, the generation module is used for:

[0079] Based on the ontology factory model, create ontology instance objects;

[0080] According to the mapping rules from the target multi-branch tree to the ontology instance object, the conceptual information in the target multi-branch tree is mapped to the ontology instance object;

[0081] Perform a level-order traversal of the target multi-way tree and map each node of the target multi-way tree to an ontology instance object;

[0082] The ontology output interface is called, and the ontology instance object is passed in as an actual parameter to obtain the network security ontology file corresponding to the construction requirements of the network security ontology.

[0083] Some embodiments of this application, from the mapping and output logic of the target multi-way tree to the ontology file, can output the stored target multi-way tree as an ontology file. The generated ontology conforms to the OWL DL (Web Ontology Language) specification and meets the requirements of consistency and correctness.

[0084] Thirdly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method for constructing a network security ontology as described in any embodiment of the first aspect.

[0085] Fourthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method for constructing a network security ontology as described in any embodiment of the first aspect.

[0086] Fifthly, some embodiments of this application provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the network security ontology construction method as described in any embodiment of the first aspect. Attached Figure Description

[0087] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0088] Figure 1 A flowchart illustrating a method for constructing a network security ontology as provided in an embodiment of this application;

[0089] Figure 2 This is a schematic diagram of the structure of a multi-branch tree provided in an embodiment of this application;

[0090] Figure 3 This is a schematic diagram of the node structure of a multi-branch tree provided in an embodiment of this application;

[0091] Figure 4 A schematic diagram illustrating the output process of the network security ontology provided in this application embodiment;

[0092] Figure 5 This is an example diagram of structured data transformation provided in the embodiments of this application;

[0093] Figure 6 Example diagram of the converted class package provided in the embodiments of this application;

[0094] Figure 7 An example diagram of the initialization ontology multi-branch tree provided in the embodiments of this application;

[0095] Figure 8 Example diagrams of the same concept provided for embodiments of this application;

[0096] Figure 9 Example diagram of concept similarity matrix provided for embodiments of this application;

[0097] Figure 10 A schematic diagram of the editing distance provided for embodiments of this application;

[0098] Figure 11 This is an example diagram of the ontology resource operation chain provided in the embodiments of this application;

[0099] Figure 12 Example diagram of generated ontology provided for embodiments of this application;

[0100] Figure 13 Example diagram of generating ontology metric information provided in the embodiments of this application;

[0101] Figure 14 Example diagram of the generated ontology part structure information provided in the embodiments of this application;

[0102] Figure 15 A schematic diagram of a network security ontology construction device provided in an embodiment of this application;

[0103] Figure 16 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0104] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0105] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0106] In recent years, cyberattacks have occurred frequently and with diverse methods, posing a severe challenge to network security. The internet contains a vast amount of network security-related data, such as network security alerts from firewalls and intrusion detection systems, vulnerability databases established by network security research institutions or vendors, and security bulletins issued by internet security forums and vendors. However, due to the discrete and fragmented nature of this network security data, it is impossible to obtain a comprehensive understanding of the network security situation from it.

[0107] With the continuous development of science and technology, security ontology technology can be applied to network security.

[0108] Security ontology technology uses a knowledge representation method called "ontology" to express knowledge in the security field in a shareable and unambiguous way. Its specific form is one or more files that meet specific structural requirements.

[0109] Currently, ontology construction requires manual work, which is not only time-consuming and labor-intensive but also difficult to meet the needs of large-scale ontology construction. Therefore, some embodiments of this application provide a method for constructing a network security ontology. This method obtains network security data corresponding to the construction requirements of the network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data; constructs an initial multi-branch tree corresponding to the structured network security data based on the structured network security data; updates the initial multi-branch tree based on the unstructured network security data to obtain an updated target multi-branch tree; and generates a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-branch tree. This embodiment overcomes the problems of existing technologies requiring manual construction, processing data from a single source, and handling poor data format compatibility, thus improving the efficiency of generating ontology files.

[0110] like Figure 1 As shown, embodiments of this application provide a method for constructing a network security ontology, the method comprising:

[0111] S101. Obtain network security data corresponding to the construction requirements of the network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data;

[0112] Specifically, the terminal device obtains the actual needs for building the network security ontology, and based on the building needs, obtains the data sources related to the network security field corresponding to the building needs, namely network security data, and classifies and lists the network security data according to structured, unstructured and source.

[0113] For example, in this embodiment of the application, the requirements analysis for the construction of the network security ontology is performed in accordance with the requirements analysis specifications of software engineering, mainly considering the specific scope that the network security ontology needs to cover.

[0114] S102. Based on the structured network security data, construct an initial multi-branch tree corresponding to the structured network security data;

[0115] Specifically, for structured network security data, the terminal device uses a data preprocessing strategy to convert the structured network security data into an object-oriented class model, specifically using Java class packages; while for unstructured network security data, natural language processing is used to extract terms, concepts, and conceptual relationships from the unstructured network security data to obtain conceptual information corresponding to the unstructured network security data.

[0116] The terminal device constructs an initial multi-branch tree, or ontology multi-branch tree, based on Java class packages. This ontology multi-branch tree includes multiple nodes, each corresponding to a class package, and each node includes node attributes. The conceptual information corresponding to unstructured network security data is the node attribute information of the unstructured network security data after processing.

[0117] During the construction of the initial multi-way tree, nodes with the same name are deleted and merged to obtain the initial multi-way tree.

[0118] S103. Update the initial multi-way tree based on the unstructured network security data to obtain the updated target multi-way tree;

[0119] Specifically, after obtaining the initial multi-branch tree, the terminal device calculates the similarity between the conceptual information corresponding to the unstructured network security data and the node attribute information of each node in the initial multi-branch tree, and merges and updates the nodes in the initial multi-branch tree according to the similarity value, thereby obtaining the updated target multi-branch tree.

[0120] S104. Based on the target multi-branch tree, generate a network security ontology file corresponding to the construction requirements of the network security ontology.

[0121] Specifically, the target multi-branch tree generated by the terminal device, i.e. the ontology multi-branch tree, is a temporary storage form of the target ontology in the system for learning network security ontology. The ontology multi-branch tree needs to be converted into a data structure that can directly write ontology and output as the target ontology. The target ontology is saved as a file with the .OWL extension and meets the .OWL DL specification to obtain the network security ontology file.

[0122] In the specific implementation process, the mapping and output process requires two format conversions of the ontology multi-way tree. First, it is converted into Jena's OntModel structure, and then the output logic of Jena's RDFDataMgr is used to complete the output of the target ontology.

[0123] Some embodiments of this application, based on the construction requirements of the network security ontology, first construct an initial multi-branch tree using structured network security data, and then update each node of the initial multi-branch tree using unstructured network security data to obtain a target multi-branch tree. Based on the target multi-branch tree, a network security ontology file corresponding to the construction requirements of the network security ontology is generated. This overcomes the problems of existing technologies requiring manual construction, processing data from a single source, and processing data format compatibility issues, thereby improving the efficiency of generating ontology files.

[0124] Another embodiment of this application further supplements the description of the method for constructing the network security ontology provided in the above embodiments.

[0125] Optionally, based on the structured network security data, an initial multi-branch tree corresponding to the structured network security data is constructed, including:

[0126] Step A1: Convert the structured network security data into a class package, wherein the class package includes at least a fully qualified class name, data attributes, method attributes, and constraints;

[0127] Specifically, starting from structured network security data sources, the pattern information of the structured network security data is extracted, and the structured network security data is transformed into Java class packages.

[0128] Among them, structured network security data sources include mainstream formats such as CSV, XML, XSD, and JSON. CSV stores information in tabular form, and its schema information is contained in the column names; XML format is similar to XSD format, where XSD is the schema description of XML; JSON is a typical structured data exchange format.

[0129] Step A2: Determine the nodes of the initial multi-branch tree based on the fully qualified class name, data attributes, method attributes, constraints, and inter-class relationships in the class package;

[0130] Specifically, it includes:

[0131] Map the full class name to the node concept name of the initial multi-way tree, and decompose the class name path into nodes between the root node and the concept leaf node;

[0132] Map data attributes in the class package to node data attributes, while preserving the names of the data attributes;

[0133] Map method properties in the class package to node object properties, preserving the names of the method properties; convert constraints into node axiom properties.

[0134] Each node contains a nodeId identifier, a concept, and other information. The concept represents the concept that the node represents, while the data attributes and object attributes stored under NodeData are the data attributes and object attributes corresponding to the concept, which are key descriptive information in the concept stage. After initialization, the ontology multi-way tree contains several duplicate concepts, that is, nodes with the same concept but different nodeIds.

[0135] Some embodiments of this application focus on constructing concepts and relationships between concepts by corresponding multi-branch trees and ontology files, and innovatively use Java class packages as an intermediate form to preserve relatively complete data source semantic information.

[0136] Step A3: Use the split hierarchical clustering method to merge and delete nodes to obtain the initial multi-way tree.

[0137] This process involves initializing the ontology multi-branch tree, whose hierarchical structure corresponds to the hierarchical structure of the ontology file, and whose nodes correspond to the concept nodes of the ontology. Reflection is used to extract the attributes, methods, and inter-class relationships of Java class packages into ontology multi-branch tree nodes.

[0138] In the process of constructing the ontology multi-branch tree, the method for extracting the ontology multi-branch tree structure from the Java class package is as follows: the fully qualified class name is mapped to the node concept name, and the class name path is decomposed into nodes between the root node and the concept leaf node; reflection is used to extract data attributes, method attributes, constraints, etc. in the class, and the data attributes are mapped to node data attributes, retaining the name of the data attributes; the method attributes are mapped to node object attributes, retaining the name of the method attributes; and the constraints are converted into node axiom attributes.

[0139] Methods for initializing an ontology multi-way tree structure based on conceptual information include:

[0140] After the structured network security data is extracted, the concept information is updated on the ontology multi-branch tree. First, it is checked whether there are duplicate concepts on the ontology multi-branch tree. If there are no duplicates, the concept information is initialized as an ontology tree node. Second, the similarity between the concept to be updated and the existing concepts on the ontology multi-branch tree is calculated using semantic similarity as a metric, and the calculation results are sorted from high to low. Finally, the concept to be updated is inserted as a child node of the node with the highest similarity. Thus, the ontology multi-branch tree initialization is completed.

[0141] Specifically, firstly, the terminal device collects structured data in the field of network security. For publicly available downloadable data, it can be downloaded directly, while for non-downloadable page data, a web crawler is used to crawl it.

[0142] Structured network security data is converted into Java class packages by defining mapping rules and invoking transformation tools. Since Java class packages are easily integrated into ontology generation systems and Java classes themselves conform to the formal description specifications of UML, and are highly similar to ontology structures, Java class packages are used as an intermediate transformation form for structured data sources.

[0143] The mapping and conversion methods for structured network security data in different formats are as follows:

[0144] For structured network security data in CSV format, the corresponding conversion method is as follows:

[0145] Scenario 1: No filename specified (e.g., a file with a number as its title in the CAPEC dataset). Map the attribute columns to class names, with the fully qualified class name prefix matching the path prefix of the data source file.

[0146] Scenario 2: A specific filename is provided (e.g., threat.csv, indicating that the file contains data related to threat). Map the filename to the class name, the attribute columns to the class's data members, the data member type to match the attribute value type, and the full class name prefix to match the path prefix of the data source file.

[0147] For structured network security data in XML, the corresponding conversion method is as follows:

[0148] Extract the XSD format file describing the XML specification, and perform class package conversion based on the XSD format file.

[0149] For XSD's structured network security data, the corresponding transformation method is as follows:

[0150] First, data preprocessing is performed. The main contents of preprocessing are: 1. Remove namespace conflicts of associated XSDs; 2. Complete the localization of online XSDs (in the case where an XSD references other XSDs and the resources of other XSDs are on the network); 3. Remove type name conflicts within XSDs.

[0151] Then, the XJC tool is used for conversion, the binding rules for the conversion are defined, and the conversion is completed using an XJB format file. The command format is as follows:

[0152] xjc-p"[package name]"-d"[output directory]"-encoding utf-8-bXXX.xjbYYY.xsd;

[0153] This uses the Fastjson library to process JSON, implementing Java serialization of JSON, and ensuring that the fully qualified class name prefix of the generated class matches the path prefix of the data source file.

[0154] For JSON-structured network security data, the corresponding conversion method is as follows:

[0155] After completing the class package conversion, the class packages are imported in batches into the relevant file paths of the automated network security ontology construction system. An ontology multi-branch tree is then constructed, initialized using reflection, and class names are mapped to concepts. The ontology multi-branch tree structure is as follows: Figure 2 As shown, the ontology multi-branch tree node structure is as follows: Figure 3 As shown.

[0156] Some embodiments of this application can automatically convert multi-source heterogeneous network security data into an intermediate format that is easy to process by collecting structured and unstructured network security data. This is a key support for subsequent ontology concept extraction and ontology generation. Ontology elements, including concepts, hierarchical relationships between concepts, and non-hierarchical relationships between concepts, are extracted from the intermediate format of security data. The ontology model after extracting ontology elements is stored using a unified multi-branch tree data structure.

[0157] Optionally, a split hierarchical clustering method is used to merge and delete nodes to obtain an initial multi-way tree, including:

[0158] Retrieve the nodes with the same name from all nodes in the initial multi-way tree;

[0159] Store concept nodes with the same name and their corresponding identifiers in key-value pairs, and process concept nodes with the same name in groups.

[0160] Calculate the semantic distance between nodes with the same name;

[0161] Based on semantic distance and a preset threshold, determine whether to cluster nodes with the same name and obtain the judgment result.

[0162] Based on the judgment results, nodes with the same name are merged and deleted to obtain the initial multi-branch tree.

[0163] Specifically, the terminal device traverses the ontology multi-way tree to obtain all child concept nodes with the same name (i.e., concept names that are the same but have different complete class paths), and records the node IDs of all child concept nodes with the same name. It then calculates the similarity between child nodes with the same name, uses a split hierarchical clustering method, merges nodes with high similarity, updates the merged nodes, and deletes the remaining child nodes with the same name, thus completing the pruning process.

[0164] Clustering nodes with the same concept using a split-hierarchical clustering method, as shown below: (Includes:)

[0165] Step 1: Traverse the initialized multi-branch tree of the ontology and obtain all concepts with the same name (same class name, but different nodeId).

[0166] Step 2: Group and store concepts with the same name and their respective nodeIds in key-value pairs, process concepts with the same name in groups, and find the concept node on the multi-branch tree by nodeId.

[0167] Step 3: Using the semantic distance between concepts as the distance measure, calculate and record the semantic distance between all concepts with the same name.

[0168] Step 4: If the semantic distance between the two furthest concepts is greater than a certain threshold, they are placed in different clusters. At this time, the cluster splits, and the number of splits is exactly one. The number of concept clusters is greater than 1. If the semantic distance between all concepts is less than a certain threshold, all concepts are directly recorded as the same cluster. At this time, the cluster does not split, and the number of concept clusters is equal to 1.

[0169] Step 5: Terminate concept cluster splitting and perform concept aggregation, merging concepts within the same cluster. During the merging process, data attributes and object attributes are overlaid. When the number of clusters is greater than one, the concepts are renamed simultaneously, distinguished by a numerical suffix.

[0170] Because some concepts contain special types that are themselves type descriptions, such as concepts named "*Type" or "*Enum" (where * represents any string), they are themselves a type of conceptual attribute. These conceptual types require special handling: first, pruning, and then using them as attributes of parent nodes in the ontology tree. At this point, the initialization of the network security ontology tree based on structured network security data is complete, i.e., the initial multi-branch tree. The initialized network security ontology tree does not contain duplicate conceptual nodes and has initially established the conceptual hierarchy of the network security ontology.

[0171] Some embodiments of this application employ split hierarchical clustering and agglomerative hierarchical clustering methods, respectively targeting ontology learning for structured data and ontology learning for unstructured data, which can better handle the problems of concept duplication and conflict.

[0172] Optionally, the initial multi-way tree is updated based on unstructured network security data to obtain an updated target multi-way tree, including:

[0173] Natural language processing tools are used to process unstructured security data to obtain conceptual information corresponding to the unstructured security data;

[0174] Specifically, starting from unstructured network security data sources, NLP (Natural Language Processing) tools are used to extract terminology information from the unstructured data. Based on the terminology information, conceptual information is obtained by combining domain text topics and context analysis and filtering.

[0175] Unstructured network security data sources mainly refer to text data related to the security field. By using the word segmentation function of NLP tools to obtain lexical information in the text data, security-related terms are filtered out. The terms are then filtered based on their frequency of occurrence in the domain text, and conceptual information is further extracted.

[0176] Calculate the semantic similarity between the conceptual information and each node in the initial multi-way tree;

[0177] Based on semantic similarity and a preset string similarity threshold, determine whether to update the initial multi-way tree;

[0178] Specifically, if the semantic similarity is greater than or equal to the preset string, the conceptual information and the initial multi-branch tree are aggregated;

[0179] If the semantic similarity is less than the preset string, the conceptual information is used as the child node of the current node in the initial multi-way tree, and the initial multi-way tree is updated.

[0180] Based on the judgment results, the target multi-branch tree is determined.

[0181] Some embodiments of this application update the nodes on the multi-way tree with unstructured secure data based on the established structured secure data. This allows different types of data to be processed, making the generated multi-way tree cover more comprehensive data.

[0182] Specifically, after the terminal device completes the initial multi-branch tree construction, it needs to collect unstructured data in the field of cybersecurity, mainly security text datasets and security-related blogs, in English.

[0183] The main steps in processing unstructured secure data include:

[0184] Step 1) Use the part-of-speech segmentation tool to obtain word tags. Based on the word tags, remove stop words and function words, and extract terms mainly from noun words.

[0185] Step 2) Term filtering: Set filtering criteria, using domain relevance and domain consistency as the measure of concept relevance, and select terms with high relevance as concepts.

[0186] Step 3) Use the agglomerative hierarchical clustering method to obtain the hierarchical relationships of concepts.

[0187] Step 4) Traverse the concepts obtained in Step 2), checking one by one whether the concept has appeared in the ontology tree extracted from the structured data. If it has appeared, check whether the sub-concepts of the concept have appeared in the ontology tree, and repeat this step; if it has not appeared, calculate the semantic distance between the current concept node and the existing concepts in the ontology tree, set the maximum threshold parameter α for the semantic distance between hyponyms and hypernyms, take the ontology tree node with the smallest semantic distance, and take the current concept node as its child node; if the semantic distance is greater than α, take the current concept node as the child node of the Thing concept (root node), and update the ontology tree.

[0188] In step 1), the focus is on extracting noun phrases, which are then filtered based on labels generated by POS. Step 2) uses domain relevance and domain consistency metrics, which are widely used in concept extraction. Step 3 employs agglomerative hierarchical clustering, primarily to obtain the hierarchical relationships between concepts, i.e., each concept has its potential parent and child concepts, providing a basis for updating the ontology tree in step 4.

[0189] The agglomerative hierarchical clustering method used in step 3 has the following specific steps:

[0190] Step B1: Initialize the state, with all terms treated as a single cluster.

[0191] Step B2: Calculate the semantic distance between clusters based on text co-occurrence.

[0192] Step B3: Merge the nearest clusters. Repeat step 2 until only one cluster remains.

[0193] This completes the initialization of the network security ontology tree based on unstructured network security data. Since the processing of unstructured data is performed after the processing of structured data, the network security ontology tree has absorbed both structured and unstructured security domain data, possessing a relatively complete hierarchical relationship of network security ontology concepts, and can be output as a network security ontology file as needed.

[0194] Some embodiments of this application calculate the similarity between unstructured security data and nodes on the multi-branch tree based on the established structured security data, and then aggregate and delete nodes on the multi-branch tree according to the similarity to obtain a more accurate multi-branch tree.

[0195] Optionally, based on the target multi-way tree, a network security ontology file corresponding to the construction requirements of the network security ontology is generated, including:

[0196] Based on the ontology factory model, create ontology instance objects;

[0197] Based on the mapping rules from the target multi-branch tree to the ontology instance object, the conceptual information in the target multi-branch tree is mapped to the ontology instance object;

[0198] Perform a level-order traversal of the target multi-branch tree, mapping each node of the target multi-branch tree to an ontology instance object;

[0199] Call the ontology output interface, pass the ontology instance object as an argument, and obtain the network security ontology file corresponding to the construction requirements of the network security ontology.

[0200] Specifically, firstly, the network security ontology output is introduced. This technical solution takes multi-source heterogeneous network security domain data as input, processes it to obtain a network security ontology, and outputs the network security ontology as an ontology description file conforming to OWL2 DL, such as... Figure 4 As shown.

[0201] The network security ontology generation system implements the steps in Method 1, generates a network security ontology tree, and integrates relevant concepts and conceptual hierarchy relationships from network security data sources.

[0202] The terminal device outputs the network security ontology tree as an ontology description file, and the steps are as follows:

[0203] Step C1: Import the Jena library and create the output RDFDataMgr ontology IO object.

[0204] Step C2: Based on the ontology factory model (the ModelFactory class provided by Jena), create an ontology instance object using the OWL_DL_MEM mode.

[0205] Step C3: By setting the mapping rules from the ontology tree to ontology instance objects, the concepts in the ontology tree are mapped to the resources and attributes in the model.

[0206] Step C4: Perform a level-wise traversal of the ontology tree, mapping each node in the ontology tree to an ontology instance object.

[0207] Step C5: Call the ontology output interface of the RDFDataMgr object, pass the ontology instance object as the actual parameter, and complete the ontology output.

[0208] Step C6: Save the output content of the main body as an OWL file.

[0209] After the ontology output is completed, the secure ontology needs to be verified using a combination of manual verification and inference engine verification. The verification process utilizes the visualization tools provided by the Protégé tool, with manual checks for errors in the concept hierarchy. The Hermit inference engine is then used for ontology consistency verification. If the verification passes, it indicates that the generated ontology does not contain any logical consistency errors.

[0210] This embodiment analyzes the construction requirements of a network security ontology, collects various forms of security data according to these requirements, and automatically constructs the ontology based on this data. The security data is categorized into structured and unstructured data according to its format. For structured security data, a data preprocessing strategy is used to convert it into an object-oriented class model, specifically using Java class packages. For unstructured security data, natural language processing is used to extract terms, concepts, and concept relationships, resulting in a basic security ontology architecture. Finally, a multi-branch tree is used to describe the ontology data structure. The extraction results of both structured and unstructured data are stored in the ontology multi-branch tree. Concept filtering and clustering are implemented based on the multi-branch tree. The multi-branch tree is pruned based on the filtering and clustering results, and the ontology generation is achieved based on the output logic of Jena (a Java API used to support semantic web applications).

[0211] This application provides a data-driven automated construction method and system for cybersecurity ontology. Taking the generation of a specific cybersecurity ontology as an example, it forms a complete solution from data source to final target security ontology, including automatic security data conversion, ontology element extraction, and ontology generation functions.

[0212] 1) The automatic security data conversion function collects structured and unstructured security data and can automatically convert multi-source heterogeneous security data into an intermediate format that is easy to process. This is a key support for subsequent ontology concept extraction and ontology generation.

[0213] 2) Ontology element extraction function: Extract ontology elements from the intermediate format of secure data, including concepts, hierarchical relationships between concepts, and non-hierarchical relationships between concepts, and use a unified ontology multi-branch tree data structure to store the ontology model after extracting ontology elements.

[0214] 3) Ontology generation function, which has the mapping and output logic from ontology multi-branch tree to ontology, can output the stored ontology multi-branch tree as ontology file, and the generated ontology conforms to OWL DL (Web Ontology Language) specification, and meets the requirements of consistency and correctness.

[0215] Some embodiments of this application, from the mapping and output logic of the target multi-way tree to the ontology file, can output the stored target multi-way tree as an ontology file. The generated ontology conforms to the OWL DL (Web Ontology Language) specification and meets the requirements of consistency and correctness.

[0216] For example:

[0217] I. Collect the data sources required for building the network security ontology. The collected data is shown in Table 1. The network security ontology is built based on this data.

[0218] Table 1

[0219]

[0220]

[0221] Second, for different data sources, complete the conversion from structured data sources to Java class packages. For example, using XJC to convert class packages, such as... Figure 5 As shown.

[0222] The converted structured data is stored in the project path, and the path is consistent with the namespace of the class package, such as... Figure 6 As shown, structured network security data such as CAPEC, CCE, CEE, CPE, and STIX were converted into Java classes. The semantic information of the structured data source was retained in the Java classes, totaling 21,419 Java classes.

[0223] Third, for unstructured data sources, the part-of-speech tool is used for word segmentation and annotation to obtain cybersecurity-related concepts from the text, which are then stored locally. Subsequently, the ontology multi-branch tree is initialized by traversing and parsing class packages. The initialized ontology multi-branch tree contains duplicate concept nodes, so concept clustering is required to complete concept merging and ontology tree pruning.

[0224] like Figure 7 As shown, the initialized ontology multi-branch tree structure is complex with numerous nodes. A concept data structure Map is maintained in the ontology tree. The initialized Map contains 1756 concepts, of which those with a size greater than 1 have the same name. It is necessary to cluster the concepts with the same name and remove the redundant concepts with the same name.

[0225] Fourth, concept aggregation is performed for concepts with the same name. The aggregation process uses split hierarchical clustering to remove all concepts with the same name, retaining only one. Each concept is identified by a unique nodeId generated using a unique identifier (UUID). Concept searches and deletions can be performed on the ontology tree based on the nodeId. After concept aggregation, there are no longer any concepts with the same name in the ontology multi-branch tree. For example... Figure 8As shown, there are 6 concepts with the same name "NetworkInterfaceType", which are identified by different nodeIds.

[0226] Calculate the semantic distance between concepts with the same name, and set the aggregation threshold to 0.3. That is, if the semantic distance is greater than 0.3, the concept cluster is split; otherwise, all are aggregated. The concept similarity matrix is ​​as follows: Figure 9 As shown, at this point, only one concept cluster is needed, meaning five are deleted and only one is retained.

[0227] Following the steps above, all concepts with duplicate names are processed. The ontology tree is updated using concepts extracted from the unstructured data, again using concept names as the primary basis for updates, and similarity is calculated using string edit distance. If concept names are duplicated, they are directly aggregated; if concept names are not duplicated but the string similarity is greater than 85%, the concepts are aggregated; if concept names are not duplicated but the string similarity is less than 85%, they are updated as sub-concepts in the ontology tree. The logic for calculating similarity based on edit distance is as follows: Figure 10 As shown.

[0228] Fifth, the updated ontology tree is mapped to ontology model instances and output as an ontology file in OWL2 DL format. First, the ontology tree is traversed, converting the concepts, data attributes, and object attributes in the ontology tree into operation chains of model instances, such as operations like ".addProperty()" and ".createResource()". These are then cascaded to form a complete ontology resource, such as... Figure 11 As shown.

[0229] The generated ontology model instance is output through the `write()` method of `RDFDataMgr`, such as... Figure 12 As shown, due to the excessive length of the ontology string, the output ontology file can be opened using Protégé to view its metric information, concept hierarchy information, etc. Figure 13 As shown.

[0230] Let's take a simple ontology as an example. Similarly, the network security ontology multi-way tree can be converted into a model instance and then output as an ontology file, such as... Figure 14 As shown, this is the final output file.

[0231] Sixth, the generated ontology is manually inspected, and unreasonable conceptual hierarchy relationships are corrected.

[0232] In the embodiments of this application:

[0233] 1) The data-driven automated construction method and system for network security ontology proposed in this application, compared with the existing solutions, forms a relatively complete technical route from network security data source to network security ontology for the network security field.

[0234] The reason is that existing solutions do not focus on the cybersecurity domain for ontology construction, and the results of ontology extraction vary across different domains. However, the cybersecurity domain has well-structured and publicly available datasets that serve as important bases for constructing cybersecurity ontology. This solution's ontology construction strategy of first extracting structured data and then unstructured data aligns with the characteristics of knowledge in the cybersecurity domain.

[0235] 2) The embodiments of this application focus on the construction of the ontology skeleton. Compared with the existing solutions, the key is to complete the construction of concepts and the relationships between concepts. It innovatively uses Java class packages as an intermediate form and retains relatively complete data source semantic information.

[0236] The reason is that this application's embodiments innovatively extract concepts and conceptual hierarchy relationships from multiple aspects, such as inter-class relationships, class package namespaces, and class member function interactions. Furthermore, the conversion from data source to class package can largely preserve the information from the data source and reduce semantic loss during the conversion process. Currently, there are no existing methods that use Java class packages as an intermediate form; therefore, the method in this application's embodiments has a certain degree of innovation.

[0237] 3) In terms of concept aggregation, the embodiments of this application combine two hierarchical clustering methods, namely split hierarchical clustering and agglomerative hierarchical clustering, which are respectively designed for ontology learning of structured data and ontology learning of unstructured data, and can better handle the problems of concept duplication and conflict.

[0238] The reason is as follows: During the construction of the ontology tree, a large number of concepts with the same name will appear. These concepts can be categorized into two types: identical and synonymous, or identical but different. In this case, the identical-named concepts should be treated as a single concept cluster, and split hierarchical clustering should be used to separate them. If they are identical and synonymous, they are not split; if they are identical but different, they are split. During the updating of the ontology tree, identical-named concepts have already been removed, but the updated concept may still share the same name as an existing concept. Therefore, the updated concept needs to be added to the ontology tree. Initially, each concept to be updated is treated as a cluster, and the semantic distance between it and existing concepts in the ontology tree is calculated. Based on the semantic distance, it is determined whether to aggregate with existing concepts. Completing these steps resolves the problems of concept duplication and conflict.

[0239] The main improvements in the embodiments of this application are:

[0240] 1) The ontology automated construction method and system for the cybersecurity field constructed in this application embodiment focuses on the cybersecurity field and leverages the advantages of the cybersecurity field in terms of existing public standards. It mainly uses structured data to construct the ontology and uses unstructured data to update the ontology as a supplement, thereby assisting in the construction of cybersecurity ontology.

[0241] 2) This application embodiment implements a method for constructing the main data structure using Java class packages as intermediate forms and an ontology multi-branch tree as the ontology. The construction process utilizes reflection mechanism and revolves around the construction and updating of the ontology tree, which can greatly preserve the semantic information of the data source and reduce semantic loss.

[0242] 3) In terms of concept aggregation, this application embodiment designs and implements a method that combines agglomerative hierarchical clustering and split hierarchical clustering to deal with the situations of concept deduplication and concept updating respectively, and finally completes concept aggregation.

[0243] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0244] Another embodiment of this application provides a network security ontology construction apparatus for executing the network security ontology construction method provided in the above embodiments.

[0245] like Figure 15 The diagram shown is a structural schematic of a network security ontology construction apparatus provided in an embodiment of this application. The network security ontology construction apparatus includes an acquisition module 1501, a construction module 1502, an update module 1503, and a generation module 1504, wherein:

[0246] The acquisition module 1501 is used to acquire network security data corresponding to the construction requirements of the network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data;

[0247] The construction module 1502 is used to construct an initial multi-branch tree corresponding to the structured network security data based on the structured network security data;

[0248] The update module 1503 is used to update the initial multi-way tree based on unstructured network security data to obtain the updated target multi-way tree;

[0249] The generation module 1504 is used to generate a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-branch tree.

[0250] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0251] Some embodiments of this application, based on the construction requirements of the network security ontology, first construct an initial multi-branch tree using structured network security data, and then update each node of the initial multi-branch tree using unstructured network security data to obtain a target multi-branch tree. Based on the target multi-branch tree, a network security ontology file corresponding to the construction requirements of the network security ontology is generated. This overcomes the problems of existing technologies requiring manual construction, processing data from a single source, and processing data format compatibility issues, thereby improving the efficiency of generating ontology files.

[0252] Another embodiment of this application further illustrates the network security ontology construction apparatus provided in the above embodiments.

[0253] Optionally, the building module is used for:

[0254] Transform structured network security data into class packages, wherein the class package includes at least a fully qualified class name, data attributes, method attributes, and constraints;

[0255] The nodes of the initial multi-branch tree are determined based on the fully qualified class name, data attributes, method attributes, constraints, and inter-class relationships in the class package.

[0256] A split-level clustering method is used to merge and delete nodes to obtain an initial multi-way tree.

[0257] Some embodiments of this application can automatically convert multi-source heterogeneous network security data into an intermediate format that is easy to process by collecting structured and unstructured network security data. This is a key support for subsequent ontology concept extraction and ontology generation. Ontology elements, including concepts, hierarchical relationships between concepts, and non-hierarchical relationships between concepts, are extracted from the intermediate format of security data. The ontology model after extracting ontology elements is stored using a unified multi-branch tree data structure.

[0258] Optionally, the building module is used for:

[0259] Map the full class name to the node concept name of the initial multi-way tree, and decompose the class name path into nodes between the root node and the concept leaf node;

[0260] Map data attributes in the class package to node data attributes, while preserving the names of the data attributes;

[0261] Map method properties in the class package to node object properties, preserving the names of the method properties; convert constraints into node axiom properties.

[0262] Some embodiments of this application focus on constructing concepts and relationships between concepts by corresponding multi-branch trees and ontology files, and innovatively use Java class packages as an intermediate form to preserve relatively complete data source semantic information.

[0263] Optionally, the building module is used for:

[0264] Retrieve the nodes with the same name from all nodes in the initial multi-way tree;

[0265] Store concept nodes with the same name and their corresponding identifiers in key-value pairs, and process concept nodes with the same name in groups.

[0266] Calculate the semantic distance between nodes with the same name;

[0267] Based on semantic distance and a preset threshold, determine whether to cluster nodes with the same name and obtain the judgment result.

[0268] Based on the judgment results, nodes with the same name are merged and deleted to obtain the initial multi-branch tree.

[0269] Some embodiments of this application employ split hierarchical clustering and agglomerative hierarchical clustering methods, respectively targeting ontology learning for structured data and ontology learning for unstructured data, which can better handle the problems of concept duplication and conflict.

[0270] Optionally, the update module is used for:

[0271] Natural language processing tools are used to process unstructured security data to obtain conceptual information corresponding to the unstructured security data;

[0272] Calculate the semantic similarity between the conceptual information and each node in the initial multi-way tree;

[0273] Based on semantic similarity and a preset string similarity threshold, determine whether to update the initial multi-way tree;

[0274] Based on the judgment results, the target multi-branch tree is determined.

[0275] Some embodiments of this application update the nodes on the multi-way tree with unstructured secure data based on the established structured secure data. This allows different types of data to be processed, making the generated multi-way tree cover more comprehensive data.

[0276] Optionally, the update module is used for:

[0277] If the semantic similarity is greater than or equal to the preset string, the conceptual information and the initial multi-way tree will be aggregated.

[0278] If the semantic similarity is less than the preset string, the conceptual information is used as the child node of the current node in the initial multi-way tree, and the initial multi-way tree is updated.

[0279] Some embodiments of this application calculate the similarity between unstructured security data and nodes on the multi-branch tree based on the established structured security data, and then aggregate and delete nodes on the multi-branch tree according to the similarity to obtain a more accurate multi-branch tree.

[0280] Optionally, the generation module is used for:

[0281] Based on the ontology factory model, create ontology instance objects;

[0282] Based on the mapping rules from the target multi-branch tree to the ontology instance object, the conceptual information in the target multi-branch tree is mapped to the ontology instance object;

[0283] Perform a level-order traversal of the target multi-branch tree, mapping each node of the target multi-branch tree to an ontology instance object;

[0284] Call the ontology output interface, pass the ontology instance object as an argument, and obtain the network security ontology file corresponding to the construction requirements of the network security ontology.

[0285] Some embodiments of this application, from the mapping and output logic of the target multi-way tree to the ontology file, can output the stored target multi-way tree as an ontology file. The generated ontology conforms to the OWL DL (Web Ontology Language) specification and meets the requirements of consistency and correctness.

[0286] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0287] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0288] This application also provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it can implement the operation of any of the methods corresponding to the embodiments of the network security ontology construction method provided in the above embodiments.

[0289] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the embodiments of the network security ontology construction method provided in the above embodiments.

[0290] like Figure 16As shown, some embodiments of this application provide an electronic device 1600, which includes a memory 1610, a processor 1620, and a computer program stored in the memory 1610 and executable on the processor 1620. When the processor 1620 reads the program from the memory 1610 via a bus 1630 and executes the program, it can implement any of the methods included in the above-described method for constructing a network security ontology.

[0291] Processor 1620 can process digital signals and can include various computing architectures. Examples include complex instruction set computer architectures, reduced instruction set computer architectures, or architectures that implement multiple instruction set combinations. In some examples, processor 1620 can be a microprocessor.

[0292] The memory 1610 can be used to store instructions executed by the processor 1620 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 1620 of this disclosure embodiment can be used to execute the instructions in the memory 1610 to implement the methods shown above. The memory 1610 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0293] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0294] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0295] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for constructing a network security ontology, characterized in that, The method includes: Obtain network security data corresponding to the construction requirements of network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data; Based on the structured network security data, construct an initial multi-branch tree corresponding to the structured network security data; The initial multi-way tree is updated based on the unstructured network security data to obtain the updated target multi-way tree; Based on the target multi-branch tree, generate a network security ontology file corresponding to the construction requirements of the network security ontology; The step of constructing an initial multi-way tree corresponding to the structured network security data based on the structured network security data includes: The structured network security data is converted into a class package, wherein the class package includes at least a fully qualified class name, data attributes, method attributes, and constraints; The nodes of the initial multi-branch tree are determined based on the complete class name, data attributes, method attributes, constraints, and inter-class relationships in the class package. The initial multi-way tree is obtained by merging and deleting the nodes using a split hierarchical clustering method. The process of determining the nodes of the initial multi-way tree based on the fully qualified class name, data attributes, method attributes, constraints, and inter-class relationships in the class package includes: The complete class name is mapped to the node concept name of the initial multi-way tree, and the class name path is decomposed into nodes between the root node and the concept leaf node; Map the data attributes in the class package to node data attributes, while preserving the names of the data attributes; Map the method properties in the class package to node object properties, preserving the names of the method properties; convert the constraints into node axiom properties; The method employs a split-level clustering approach to merge and delete nodes to obtain the initial multi-way tree, including: Obtain the concept nodes with the same name from all nodes in the initial multi-way tree; The concept nodes with the same name and the identifiers corresponding to the concept nodes with the same name are grouped and stored as key-value pairs, and the concept nodes with the same name are processed in groups. Calculate the semantic distance between the nodes with the same name; Based on the semantic distance and the preset threshold, it is determined whether to cluster nodes with the same name, and the determination result is obtained. Based on the judgment result, the nodes with the same name are merged and deleted to obtain the initial multi-branch tree.

2. The method for constructing a network security ontology according to claim 1, characterized in that, The step of updating the initial multi-way tree based on the unstructured network security data to obtain the updated target multi-way tree includes: Natural language processing tools are used to process the unstructured security data to obtain conceptual information corresponding to the unstructured security data; Calculate the semantic similarity between the concept information and each node in the initial multi-way tree; Based on the semantic similarity and the preset string similarity threshold, determine whether to update the initial multi-way tree; Based on the judgment result, the target multi-branch tree is determined.

3. The method for constructing a network security ontology according to claim 2, characterized in that, The step of determining whether to update the initial multi-way tree based on the semantic similarity and a preset string similarity threshold includes: If the semantic similarity is greater than or equal to the preset string, the concept information and the initial multi-way tree are aggregated. If the semantic similarity is less than the preset string, the conceptual information is used as a child node of the current node of the initial multi-way tree, and the initial multi-way tree is updated.

4. The method for constructing a network security ontology according to claim 1, characterized in that, The step of generating a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-way tree includes: Based on the ontology factory model, create ontology instance objects; According to the mapping rules from the target multi-branch tree to the ontology instance object, the conceptual information in the target multi-branch tree is mapped to the ontology instance object; Perform a level-order traversal of the target multi-way tree and map each node of the target multi-way tree to an ontology instance object; The ontology output interface is called, and the ontology instance object is passed in as an actual parameter to obtain the network security ontology file corresponding to the construction requirements of the network security ontology.

5. A device for constructing a network security ontology, characterized in that, The device includes: The acquisition module is used to acquire network security data corresponding to the construction requirements of the network security ontology, wherein the network security data includes at least structured network security data and unstructured network security data; A construction module is used to construct an initial multi-branch tree corresponding to the structured network security data based on the structured network security data; An update module is used to update the initial multi-way tree based on the unstructured network security data to obtain the updated target multi-way tree; The generation module is used to generate a network security ontology file corresponding to the construction requirements of the network security ontology based on the target multi-branch tree; The building module is used for: The structured network security data is converted into a class package, wherein the class package includes at least a fully qualified class name, data attributes, method attributes, and constraints; The nodes of the initial multi-branch tree are determined based on the complete class name, data attributes, method attributes, constraints, and inter-class relationships in the class package. The initial multi-way tree is obtained by merging and deleting the nodes using a split hierarchical clustering method. The building module is used for: The complete class name is mapped to the node concept name of the initial multi-way tree, and the class name path is decomposed into nodes between the root node and the concept leaf node; Map the data attributes in the class package to node data attributes, while preserving the names of the data attributes; Map the method properties in the class package to node object properties, preserving the names of the method properties; convert the constraints into node axiom properties; The building module is used for: Obtain the concept nodes with the same name from all nodes in the initial multi-way tree; The concept nodes with the same name and the identifiers corresponding to the concept nodes with the same name are grouped and stored as key-value pairs, and the concept nodes with the same name are processed in groups. Calculate the semantic distance between the nodes with the same name; Based on the semantic distance and the preset threshold, it is determined whether to cluster nodes with the same name, and the determination result is obtained. Based on the judgment result, the nodes with the same name are merged and deleted to obtain the initial multi-branch tree.

6. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the method for constructing a network security ontology as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that, when the program is executed by a processor, it can implement the method for constructing a network security ontology as described in any one of claims 1-4.

Images