A method for constructing a knowledge network in a multi-layer cyber space

Abstract

The present invention provides a method for constructing a knowledge network in a multi-layer cyber space. The method includes Step 1: dividing the cyber space environment into an entity resource layer, a virtual resource layer, a process resource layer, and a decision control layer; Step 2: designing ontologies for each layer of the cyber space environment to construct an ontology system of the cyber space environment; Step 3: constructing a cyber space knowledge network model and filling it through a schema layer and a data layer to construct a knowledge network of the cyber space environment; wherein, the schema layer is used to represent the included ontologies and ontology relationships to form a network ontology knowledge network; the data layer is used to represent the included entities and entity relationships to form a network entity knowledge network; Step 4: using the node-link method to achieve hierarchical visualization expression of the cyber space environment, as well as visualization expression of the network ontology knowledge network and the network entity knowledge network.

Description

Technical Field

[0001] The present invention relates to the field of network information technology, and in particular, to a method for constructing a knowledge network in a multi-layer network space. Background Art

[0002] The network space has penetrated into all aspects of daily work and has gradually become a key consideration and concern in issues such as national economic production, military struggle, and national defense security. It is the fifth space after land, sea, air, and space. The network space is an intangible, complex, and dynamic virtual space, and the modeling and expression of the network space environment are the main means to understand the network space.

[0003] Each field is committed to the modeling, simulation, analysis, and expression of the complex network space. A knowledge graph is a method of representing knowledge in the form of <node, relationship, node>, and its core is a large-scale knowledge base. The knowledge graph has achieved relatively in-depth research in the field of network space security and plays an important supporting role in the perception and expression of the network space security situation. For the construction of the network space knowledge graph, the more representative ones are: Gao Jian et al. constructed a threat intelligence ontology model that can be shared, reused, and extended. Cai Yinyin studied the knowledge representation model, knowledge graph construction, and management of APT organizations based on the MDATA cognitive model. Liu Jingxu et al. proposed a phased fusion method for heterogeneous ontologies including high-level concept extraction and fusion, and integration of tree structures. Ye Ziwei et al. designed a knowledge graph based on the atomic attack ontology and proposed an extended attack graph generation framework based on the knowledge graph. Dong Cong et al. proposed a knowledge graph construction framework for security intelligence. Niu Yong, Qin Ya, etc. systematically studied the construction method of the network space security knowledge graph from aspects such as network security entity and relationship extraction.

[0004] However, the above methods do not start from the overall perspective of the network space environment, do not reflect the hierarchical characteristics of the network space environment, and it is difficult to fully understand the composition of the network space environment itself. Summary of the Invention

[0005] In order to reflect the hierarchical characteristics of the network space environment and to achieve the analysis and mining of complex high-dimensional network data, the present invention provides a method for constructing a knowledge network in a multi-layer network space.

[0006] The method for constructing a knowledge network in a multi-layer network space provided by the present invention includes:

[0007] Step 1: Divide the network space environment into an entity resource layer, a virtual resource layer, a process resource layer, and a decision control layer;

[0008] Step 2: Design the ontology of each layer of the network space environment and construct an ontology system of the network space environment;

[0009] Step 3: Construct a knowledge network model for the cyberspace environment, and populate and construct a knowledge network for the cyberspace environment through the pattern layer and the data layer; among them, the pattern layer is used to represent the included ontologies and ontology relationships to form a network ontology knowledge network; the data layer is used to represent the included entities and entity relationships to form a network entity knowledge network.

[0010] Step 4: Use the node-link method to achieve hierarchical visualization of the cyberspace environment, as well as visualization of the network ontology knowledge network and the network entity knowledge network.

[0011] Furthermore, the entity resource layer includes interconnected devices composed of network infrastructure and the physical network formed; the virtual resource layer includes operating systems, application software, software settings on devices, and logical links between networked devices; the process resource layer includes process resources such as virtual character activity behaviors and rules, cyberspace attacks, defenses, operation and maintenance events and phenomena; the decision and control layer includes control decisions for the cyberspace.

[0012] Furthermore, the ontologies of the entity resource layer include servers, mobile devices, hosts, switches, routers, gateways, bridges, communication vehicles, satellite stations, radio stations, and communication base stations; the ontologies of the virtual resource layer include operating systems, application software, firewalls, databases, malicious processes, information retrieval services, data distribution and sharing services, emails, instant messaging, software online services, virtual agents, social accounts, network roles, and virtual mappings of personnel; the ontologies of the process resource layer include network attacks, network defenses, network operation and maintenance, and virtual character activities; the ontologies of the decision and control layer include command, control, supervision, and permissions.

[0013] Furthermore, in Step 3, constructing the knowledge network model for the cyberspace environment specifically includes: formally representing the knowledge network model for the cyberspace environment as

[0014] G = {G Object , G VirtuatObject , G Prcoss , G Decision , R}

[0015] where G Object represents an undirected attribute graph corresponding to the network of the entity resource layer, G VirtualObject represents an undirected attribute graph corresponding to the network of the virtual resource layer, G Prcoss represents a directed weighted attribute graph corresponding to the network of the process resource layer, G Decision represents a directed weighted attribute graph corresponding to the network of the decision and control layer, and R represents the connection relationships between layers and the connection relationships between each sub-network; among them, the undirected attribute graph is represented as G1 = (V O (VA, LV), E O(EA, LE)), VA represents the set of nodes V O 's set of attributes, LV represents the value range set of VA, EA represents the set of edges E O 's set of attributes, LE represents the value range set of EA; the directed weighted attribute graph is represented as G = (V P , E P , W), where V P represents the set of nodes, E P represents the set of edges, W represents the set of weights, w ij ∈W is the weight of the edge e i connecting nodes v j and v ij .

[0016] Furthermore, the connection relationship between the entity resource layer and the virtual resource layer is established through the dependency relationship of virtual resources on entity resources, the connection relationship between the virtual resource layer and the process resource layer is established through virtual resource entities, and the connection relationship between the process resource layer and the decision control layer is established through the command relationship between command commands and action events.

[0017] Advantages of the present invention:

[0018] The method of the present invention first starts from the cognitive requirements of the cyber space, and with the help of the layer concept in the field of cartography, divides the cyber space environment into an entity resource layer, a virtual resource layer, a process resource layer, and a decision control layer; then, designs a cyber space knowledge element model and constructs an ontology system; secondly, according to the characteristics of each layer of the cyber space environment, fills and constructs a cyber space environment knowledge network through the model layer and the data layer; finally, uses the node-link method to realize the visual expression of the complex knowledge network in the cyber space.

[0019] Through the association and representation of various resources in the cyber space, using the "node-link" graph expression method to form a cyber space knowledge map is conducive to fully understanding the network connectivity and network asset correlation between different levels of the cyber space. The construction of the complex knowledge network in the cyber space is the basis for the dynamic information expression in the cyber space, and applying technologies such as multi-view collaborative correlation analysis, human-computer collaborative interaction analysis, and atlas visualization provides support for the analysis and mining of complex high-dimensional network data. Brief Description of the Drawings

[0020] Figure 1 is the basic process of the method for constructing a knowledge network of a multi-layer cyber space provided by an embodiment of the present invention;

[0021] Figure 2 is the cyber space structure model provided by an embodiment of the present invention;

[0022] Figure 3 is the composition of the cyber space environment ontology provided by an embodiment of the present invention;

[0023] Figure 4 The hierarchical knowledge network of the cyber space OVPD provided by the embodiment of the present invention;

[0024] Figure 5 An example of the conceptual layer of the complex semantic network in the cyber space environment provided by the embodiment of the present invention;

[0025] Figure 6 An example of the knowledge representation in the cyber space environment provided by the embodiment of the present invention;

[0026] Figure 7 An example of the instance layer of the complex semantic network in the cyber space environment provided by the embodiment of the present invention;

[0027] Figure 8 An example of the complex knowledge network in the cyber space provided by the embodiment of the present invention;

[0028] Figure 9 An example of the hierarchical visualization of the complex knowledge network in the cyber space provided by the embodiment of the present invention. Detailed implementation manners

[0029] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0030] Embodiment 1

[0031] As Figure 1 shown, the embodiment of the present invention provides a method for constructing a knowledge network of a multi-layer cyber space, including the following steps:

[0032] S101: Divide the cyber space environment into an entity resource layer, a virtual resource layer, a process resource layer, and a decision and control layer;

[0033] Specifically, as Figure 2 shown, the cyber space is intertwined with the land, sea, air, and space domains. The cyber space environment (i.e., the information environment) refers to the information that plays a dominant role in the application of the cyber space, as well as the environment jointly formed by the personnel, equipment, facilities, etc. that generate, acquire, store, process, transmit, and receive information. It is deeply integrated with the natural environment and the human environment to form a complex ternary world. The cyber space environment is a relatively "stable" basic environment that depends on the land, sea, air, and space domains and has the hierarchical characteristics of a spatial structure. Based on this, this embodiment divides the cyber space environment into: an entity resource layer, a virtual resource layer, a process resource layer, and a decision and control layer.

[0034] In this embodiment, the entity resource layer includes interconnected devices composed of network infrastructure and the physical network formed thereby; the virtual resource layer includes the operating system, application software, software settings on the device, and the logical links between networked devices; the process resource layer includes process resources such as virtual role activity behaviors and rules, cyberattacks, defenses, operation and maintenance events, and phenomena in the cyber space; the decision and control layer includes control decisions in the cyber space, such as control commands including planning, perception, etc., and mainly provides permissions for supervising and starting, stopping, modifying, or redirecting network operations.

[0035] S102: Design the ontology of each layer of the cyber space environment, and construct an ontology system of the cyber space environment;

[0036] Specifically, according to the definitions of the above-mentioned entity resource layer, virtual resource layer, process resource layer, and decision and control layer, as an implementable manner, as Figure 3 shown, the ontology of each layer is designed as follows:

[0037] The ontology of the entity resource layer includes servers, mobile devices, hosts, switches, routers, gateways, bridges, communication vehicles, satellite stations, radio stations, and communication base stations; the ontology of the virtual resource layer includes the operating system, application software, firewalls, databases, malicious processes, information retrieval services, data distribution and sharing services, emails, instant messaging, software online services, virtual agents, social accounts, network roles, and virtual mappings of personnel; the ontology of the process resource layer includes cyberattacks, cyber defenses, cyber operation and maintenance, and virtual role activities; the ontology of the decision and control layer includes command, control, supervision, and permissions.

[0038] It should be noted that the ontology classification of each layer of the cyber space environment can be extended according to requirements.

[0039] S103: Construct a cyber space knowledge network model, and fill and construct a cyber space environment knowledge network through the schema layer and the data layer; among them, the schema layer is used to represent the included ontologies and ontology relationships to form a network ontology knowledge network; the data layer is used to represent the included entities and entity relationships to form a network entity knowledge network;

[0040] Specifically, in this embodiment, based on the structural composition of cyber space elements, the complex knowledge network of the cyber space environment can be abstractly represented as

[0041] <Cyber Concepts ,Cyber Objects ,Cyber VirtualObjects ,Cybe_Process,Dyber_Decision,Realtions,Propertys>

[0042] Among them, Cyber_Concepts represents the ontology classification set, Cyber_Objects represents the set of entity resources in the cyberspace environment, Cyber_VirtualObjects represents the set of virtual entity resources in the cyberspace, Cyber_Process represents the set of process resources in the cyberspace, Cyber_Decision represents the set of decision-making resources in the cyberspace, Relations represents the set of relationships, mainly including the relationships of "concept-entity", "entity-entity", and "entity-attribute", and Propertys represents various attributes of entities.

[0043] It can be understood that the knowledge graph is a method of representing knowledge about the objective world of human beings. Through technologies such as knowledge extraction, knowledge association, and storage, various types of knowledge are represented as a triple knowledge base of <entity, relationship, entity>. Its essence is a complex semantic network, which can be represented as a directed graph of "node-edge".

[0044] Based on this, in this embodiment, a "OVPD (Object-Virtual object-Process-Decision)" knowledge cognition model is constructed to model complex and diverse relationships. The knowledge network of the cyberspace environment can be constructed through a schema layer and a data layer. The schema layer mainly represents concepts and the relationships between concepts. According to the basic composition of the cyberspace environment, it is divided into four categories: entities, virtual entities, processes, and decisions. The multi-layer complex knowledge network model of the cyberspace is formally represented as:

[0045] G = {G Object , G VirtualObject , G Prcoss , G Decision , R}

[0046] Among them, G Object represents the undirected attribute graph corresponding to the entity resource layer network, G VirtualObject represents the undirected attribute graph corresponding to the virtual resource layer network, G Prcoss represents the directed weighted attribute graph corresponding to the process resource layer network, G Decision represents the directed weighted attribute graph corresponding to the decision control layer network, and R represents the connection relationships between layers and the connection relationships between sub-networks; among them, the undirected attribute graph is represented as G1 = (V O (VA, LV), E O (EA, LE)), VA represents the attribute set of the node set V O , LV represents the value range set of VA, EA represents the attribute set of the edge set E O , LE represents the value range set of EA; the directed weighted attribute graph is represented as G = (V P , EP , W), where V P represents the set of nodes, and E P represents the set of edges, W represents the set of weights, and w ij ∈W is the weight of the edge e i connecting nodes v j and v ij .

[0047] Furthermore, the connection relationship between the entity resource layer and the virtual resource layer is established through the dependency relationship of virtual resources on entity resources. For example, virtual resources such as viruses and operating software mainly depend on hardware platforms such as servers and switches; the connection relationship between the virtual resource layer and the process resource layer is established through virtual resource entities. For example, network attacks usually use viruses, vulnerabilities, etc. as action weapons or means; the connection relationship between the process resource layer and the decision control layer is established through the command relationship between command commands and action events.

[0048] S104: Use the node-link method to achieve the visual expression of the hierarchical network space environment, as well as the visual expression of the network ontology knowledge network and the network entity knowledge network.

[0049] Specifically, as Figure 4 shown, the hierarchical visual expression of the network space environment. As Figure 6 shown, the visual expression of the network ontology knowledge network and the network entity knowledge network.

[0050] Furthermore, the multi-layer network space complex knowledge network model can also be used to represent Figure 4 as a general graph network, as Figure 5 shown. This network has the following characteristics: (1) It is a directed graph, and the edges in the graph represent the relationships between entities, including dependency types: is-a, own, act-to, use, etc.; circulation types: link, flow-in, flow-out, passthrough, etc.; attribute types: has-time, has-pos, has-rgn, has-state, etc. attributes; (2) It has the characteristics of a complex network, and the importance of nodes can be judged by the in-degree and out-degree of the network. (3) It is a complex attribute graph. Nodes represent network space entities, and each entity has corresponding attribute descriptions. For example, the attribute description of the "vulnerability" entity includes attributes such as vulnerability name, vulnerability type, CNNVD number, danger level, release time, etc. (4) Each edge and attribute node has different weights. In order to highlight the important position of spatio-temporal location information in the attributes of various elements of the network space environment, different weights are assigned to the node attribute relationships in entities, virtual entities, processes, and decisions.

[0051] By constructing basic classes such as CObject, CVirtualObject, CProcess, and CDecision and establishing the relationships between the classes. As shown in the figure, (TIME, POS, RGN, STA, ACT) are the general attributes of cyber entities, representing time, position, region, status, and action respectively. CObject and CVirtualObject have the attributes of (TIME, POS, RGN, STA), CProcess has the attributes of (TIME, POS, ACT), and CDecision mainly models various types of Commands. For example, on xx / xx / 20xx, the tower server located at xx is in normal operation status, and the attribute graph is represented as (Towerserver, TIME, xx / xx / 20xx)(Towerserver, POS, Address A)(Towerserver, STA, normal).

[0052] Embodiment 2

[0053] To verify the effectiveness of the method for constructing the knowledge network of the multi-layer cyber space provided by the embodiments of the present invention, the embodiments of the present invention also provide the following experimental data.

[0054] (1) Experimental data

[0055] The experimental data are the data obtained through cyber space mapping, including DNS data, AS data, topo-scamper data, topo-routeviews data, topo-asnlinks, and topo-asns data. The data description is shown in Table 1.

[0056] Table 1 Experimental data description

[0057]

[0058] (2) Experimental data and platform

[0059] (1) Example of a complex semantic network in the cyber space environment

[0060] Such as Figure 7As shown, the physical resource instance is "rack-mounted server", and its attributes include <Model, NF5280M5>, <Type, 2U rack-mounted>, <Geographical location, (113.54, 34.81)>, … etc.; the virtual resource instance is "Windows server", and its attributes include <Version, 2022>, <Serial number, PF3FAHFY>, <Installation date, 2022-06-04>, … etc.; the virtual resource instance is "CVE-2022-41076", and its attributes include <Vulnerability name, PowerShell remote code execution vulnerability>, <Disclosure time, 2022-12-23>, <Risk level, high risk>, … etc.; the process resource instance is "xxx attack event", and its attributes include <Attack time, xx / xx / 2022>, <Attack initiator, XXX organization>, <Attack springboard, ip: xxx.xx.xx.xx>, … etc.

[0061] (2) Knowledge network visualization

[0062] The Force-Directed Graph model algorithm is adopted. By calculating each node of the graph spectrum, the resultant force of the comprehensive gravitational and repulsive forces is calculated, and then the resultant force is used to move the positions of the nodes, presenting the graph layout in a complex network environment, as Figure 8 shown. An example of the hierarchical visualization of complex networks in cyberspace based on OVPD is as Figure 9 shown.

[0063] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing a knowledge network in a multi-layer cyber space, characterized in that, Including: Step 1: Divide the cyber space environment into an entity resource layer, a virtual resource layer, a process resource layer, and a decision and control layer; the entity resource layer includes interconnected devices composed of network infrastructure and the physical network formed; the virtual resource layer includes the operating system, application software, software settings on devices, and logical links between networked devices; the process resource layer includes process resources such as virtual role activity behaviors and rules, cyber space attacks, defenses, operation and maintenance events and phenomena; the decision and control layer includes control decisions for the cyber space. Step 2: Design the ontologies for each layer of the cyber space environment and construct an ontology system for the cyber space environment. Step 3: Construct a cyber space knowledge network model and fill and construct a cyber space environment knowledge network through a schema layer and a data layer; among them, the schema layer is used to represent the included ontologies and ontology relationships to form a network ontology knowledge network; the data layer is used to represent the included entities and entity relationships to form a network entity knowledge network; constructing the cyber space knowledge network model specifically includes: formalizing the cyber space knowledge network model as Among them, represents an undirected attribute graph corresponding to the entity resource layer network, represents an undirected attribute graph corresponding to the virtual resource layer network, represents a directed weighted attribute graph corresponding to the process resource layer network, represents a directed weighted attribute graph corresponding to the decision control layer network, R represents the connection relationships between layers and between each sub-network; among them, the undirected attribute graph is represented as , VA represents the node set V O 's attribute set, LV represents VA 's value range set, EA represents the edge set E O 's attribute set, LE represents EA 's value range set; the directed weighted attribute graph is represented as where V P represents the node set, E P represents the edge set, W represents the weight set, is the weight of the edge v i connecting the node v j and e ij ; Establish a connection relationship between the entity resource layer and the virtual resource layer through the dependency relationship of virtual resources on entity resources, establish a connection relationship between the virtual resource layer and the process resource layer through virtual resource entities, and establish a connection relationship between the process resource layer and the decision and control layer through the command relationship between command commands and action events. Step 4: Use the node-link method to achieve hierarchical visualization expression of the cyber space environment, as well as visualization expression of the network ontology knowledge network and the network entity knowledge network.

2. The method for constructing a knowledge network of a multi-layer cyber space according to claim 1, wherein The ontologies of the entity resource layer include servers, mobile devices, hosts, switches, routers, gateways, bridges, communication vehicles, satellite stations, radio stations, and communication base stations; the ontologies of the virtual resource layer include operating systems, application software, firewalls, databases, malicious processes, information retrieval services, data distribution and sharing services, emails, instant messaging, software online services, virtual agents, social accounts, network roles, and virtual mappings of personnel; the ontologies of the process resource layer include cyber attacks, cyber defenses, cyber operation and maintenance, and virtual role activities; the ontologies of the decision and control layer include command, control, supervision, and permissions.

Images