A method and system for constructing and recommending knowledge graphs for intelligent model attack and defense

Abstract

A method and system for constructing and recommending a knowledge graph for intelligent model attack and defense is disclosed. The method includes: S1: designing an ontology graph by analyzing the key elements and influencing factors of the intelligent model in the attack and defense domain; S2: obtaining corresponding indicators by analyzing attack events of the intelligent model in multiple domains, and then mapping the data to the ontology graph to complete the construction of the intelligent model attack and defense knowledge graph; S3: based on the constructed graph, analyzing the performance differences of various defense algorithms when different models face different attack methods, and using this to guide the selection of defense algorithms, thus realizing the recommendation function of defense algorithms. This invention, based on the graph, realizes the visualization and query functions of attack and defense methods, and analyzes the performance of different models when facing different attack and defense methods from multiple dimensions, thereby achieving the function of defending against attack events.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security, and in particular to a method and system for constructing and recommending knowledge graphs for intelligent model attack and defense. Background Technology

[0002] With the rapid development of artificial intelligence (AI) technology, more and more enterprises and organizations are applying AI to various business scenarios. However, with the widespread use of AI models, security issues have become increasingly prominent. AI models are vulnerable to attacks, deception, and tampering, which can lead to serious consequences such as data breaches, business interruptions, and user privacy breaches. Determining appropriate defense methods to address these security challenges is crucial. However, AI model analysis results typically come from diverse data sources, such as text, images, and videos, which may have different structures, formats, and semantics. Integrating this multi-source, heterogeneous data into a specific database to enhance its value and usability is also a critical issue. Knowledge graphs, due to their powerful representation capabilities, can connect knowledge from different domains to form a visualized knowledge base, injecting new thinking and methods into defense recommendation work. Therefore, they can provide timely, accurate, and comprehensive knowledge support in the field of AI attack and defense.

[0003] Current AI attack and defense paradigms fail to connect the intricate relationships between algorithms, data, and metrics across various domains, including image processing and electromagnetics. This results in a lack of correlation analysis of the AI ​​models, algorithms, and data used in these domains. Consequently, applications such as defense algorithm recommendations lack data support, impacting the retrieval and recommendation effectiveness of defense algorithms. Summary of the Invention

[0004] This invention aims to solve the technical problems existing in the prior art by proposing a method and system for constructing and recommending intelligent model attack and defense knowledge graphs.

[0005] This invention designs and constructs an intelligent model attack and defense knowledge graph, which is beneficial for data association and various relationship mining of attack and defense events in the field of intelligent model attack and defense. Based on this graph, the function of defense algorithm recommendation is realized, thereby improving the security of artificial intelligence.

[0006] To achieve the above objectives, the present invention provides the following solution: The present invention provides a method and system for constructing and recommending intelligent model attack and defense knowledge graphs, the method comprising:

[0007] S1: Analyze the key elements and influencing factors of intelligent models in the field of attack and defense, and design the ontology graph;

[0008] S2: Analyze the attack events of the intelligent model in multiple domains to obtain corresponding indicators, and then map the data to the ontology graph to complete the construction of the intelligent model attack and defense knowledge graph;

[0009] S3: Based on the constructed graph, analyze the performance differences of various defense algorithms when different models face different attack methods, and use this to guide the selection of defense algorithms, thereby realizing the recommendation function of defense algorithms.

[0010] Preferably, step S1 includes:

[0011] S101: By analyzing technical documents such as algorithm descriptions and algorithm characteristics of intelligent models, data descriptions, and relevant experimental data such as attack and defense experiment records and indicators during system experiments, we can explore various relationships between algorithms, data, indicators and algorithms.

[0012] S102: Based on the important elements obtained from the analysis in step S101, an ontology graph of the intelligent model attack and defense knowledge graph was designed. The ontology graph includes attack event entities, defense event entities and indicator entities, intelligent algorithm entities, dataset entities, attack method entities, defense method entities, intelligent model entities, technology type entities, and algorithm function entities.

[0013] The attack event entity includes the time attribute and effect attribute of the attack, and the defense event entity includes the time attribute and effect attribute of the defense.

[0014] The attack event entity forms relationships with the attack method entity, the dataset entity, and the intelligent algorithm that is the target of the attack, etc. The defense event entity forms relationships with the defense method entity and the attack event entity through the indicator entity.

[0015] The indicator entity connects the attack event entity and the defense event entity.

[0016] The specific value of the indicator entity is stored as a relational attribute between the attack event entity, the defense event entity, and the indicator entity.

[0017] Preferably, step S2 includes:

[0018] S201: Based on the attack performance of the attack strategies adopted in the network domain, image domain, and electromagnetic domain on the intelligent model, obtain the sample indicators after attack and defense.

[0019] S202: The intelligent model-related description refers to the data content required by the algorithm entity, dataset entity, technology type entity, and algorithm function entity in the ontology graph;

[0020] The algorithm entities include the names of relevant algorithms in machine learning and deep learning that can be targets of attack;

[0021] The dataset entities include image datasets, network datasets, and electromagnetic signal datasets;

[0022] The technology type entities include the basic technologies and upstream and downstream algorithms involved in intelligent algorithms;

[0023] The algorithm functional entities include node classification, community detection, link prediction, image classification, target detection, target recognition, individual recognition, and modulation type recognition functions in the network domain, image domain, and electromagnetic domain.

[0024] S203: Using knowledge extraction techniques, the data obtained in steps S201 and S202 are processed into the form of <head entity; relation; tail entity>, and mapped to the ontology graph to complete the construction of the knowledge graph;

[0025] Preferably, step S3 includes:

[0026] S301: When the model faces different attack methods, it provides two different methods for white-box attacks and black-box attacks, and adopts two recommendation strategies: a path-based recommendation method and a GCN-based recommendation method.

[0027] S302: Based on the recommendation method described in step S301, determine the defense method that best matches the attack event and recommend it to the user;

[0028] Preferably, the path-based recommendation method in step S301 includes:

[0029] Assuming an attack event consists of an attack method, a dataset, and a target intelligent algorithm, the goal is to recommend a defense algorithm based on the performance of key metrics. The process involves searching for paths from the attack event to any defense algorithm via the metrics, and then calculating the weight of these paths in subsequent steps to determine the recommendation index for that algorithm. The paths from which the attack event arrives are represented as:

[0030] path = {path k path k froma l toP j ,k=1,2,3...,num} (1)

[0031] num is from a l Arrive at P j The number of paths. Through the above steps, multiple paths related to attack event a can be identified. l and index R m Related defense methods and paths in the map.

[0032] Path weight calculation assigns a weight to each path. The larger the weight value, the stronger the defense method P at the end of that path. j More effective defense against attack method A i The resulting attack event a l The specific calculation process is as follows:

[0033] PW = {PW} k |PW k =weight(Path) k ),k=1,2,...,num} (2)

[0034] PW is Path j The weight value, the weight() function is used to get the path j The sum of the weights of the edges connected to it.

[0035] Constructing a recommendation score matrix and normalizing the path weights, due to attack event a l It is based on the only attack method A i It is certain, therefore the statistics are based on attack event a. l Reachable Defense Method P j The sum of normalized weights on all paths is used as attack method A. i To P j The recommended scores are calculated, and the recommended scores between different attack methods and defense methods are statistically analyzed to construct a recommended score matrix RF. Specifically:

[0036] RF ij =sum(PW k ) / sum(PW),k=1,2,...,num (3)

[0037] num represents the number of events from attack event a. l Reaching Defense Method P j The number of paths. RF ij Represents the attack event a l At a certain optimal performance metric, the defense method P j The degree of matching.

[0038] By constructing an attack and defense method matching index matrix, and using the recommendation score matrix, we can obtain the preference score of each attack method for each defense method.

[0039] However, to verify the accuracy of the recommendations, an index is needed to evaluate whether the obtained defense methods can effectively defend against attack methods. Therefore, this invention constructs an attack-defense method matching index matrix Pa-score based on the index:

[0040]

[0041] Pa-score ij This represents an attack method A. i A confirmed attack event a l , by defense method P j The identified defense event d n In its relationship with a l Common defense indicator R k The defensive capabilities demonstrated above. k -attack and R k -defence respectively represent a l With d n In R k The specific manifestations of this.

[0042] The loss and parameter updates are calculated by using the recommendation score matrix from step three and the attack / defense method matching index matrix from step four to obtain the expected defense effect for each attack method. This effect is then used as the loss function to measure the accuracy of the recommendations.

[0043]

[0044] The recommendation performance is optimized by updating the path weights in the graph by taking the gradient of the loss function.

[0045] Preferably, the recommended GCN-based defense algorithm in step S301 includes:

[0046] This method trains a Geographic Graph Convolutional Network (GCN) to obtain embedding vectors for attack events, defense events, attack methods, and defense methods, and then uses similarity calculations to implement the recommendation process. This approach can acquire latent attributes from the black-box model during training, thus compensating for the shortcomings of path-based recommendation methods. After the model is trained robustly, the similarity of the embedding vectors guides the recommendation process. Furthermore, the similarity between embedding vectors can guide the completion of necessary edges in the graph, resulting in more accurate recommendations.

[0047] Another aspect of the present invention relates to an intelligent model attack and defense knowledge graph construction and recommendation system, including an ontology graph design module, a graph construction module, and a defense recommendation module.

[0048] The ontology graph design module is used to analyze the key elements and influencing factors of intelligent models in the field of attack and defense and to design ontology graphs.

[0049] The graph construction module is used to analyze the attack events of the intelligent model in multiple domains to obtain corresponding indicators, and then map the data to the ontology graph to complete the construction of the intelligent model attack and defense knowledge graph.

[0050] The defense recommendation module is used to analyze the performance differences of different models and defense algorithms when facing different attack methods based on the constructed graph, and to guide the selection of defense algorithms, thereby realizing the recommendation function of defense algorithms.

[0051] This invention analyzes technical documents and data descriptions of artificial intelligence models, such as algorithm descriptions and features, as well as relevant experimental data such as attack and defense experiment records and indicators during system experiments. It further explores the complex relationships between algorithms, data, and indicators. Based on this graph, the system realizes functions such as visualization and query of attack and defense methods, and analyzes the performance of different models in the face of different attack and defense methods from multiple dimensions, thereby realizing the defense function against attack events.

[0052] The innovation of this invention lies in the following: By analyzing data such as attack events, defense events, and related indicators during attacks on intelligent models in multiple domains (electromagnetic, image, network, etc.), three unique entity types are designed in the knowledge graph: attack event entities, defense event entities, and indicator entities. Each pair of attack and defense event entities has an independent indicator entity, connecting the attack and defense events. The specific value of the indicator is stored as a relational attribute between the attack, defense event, and indicator. Furthermore, based on the constructed graph, a path-based recommendation method is designed. Assuming an attack event consists of an attack method, a dataset, and a target intelligent algorithm, a defense algorithm is recommended based on the performance of the indicators. The path from the attack event to any defense algorithm via the indicators is searched, and the weight of the path is calculated in subsequent steps to determine the recommendation index of the defense algorithm. Simultaneously, a GCN-based recommendation method is added as a supplement. This method can acquire latent attributes in the black-box model through the training process, thus compensating for the shortcomings of the path-based recommendation method.

[0053] The advantages of this invention are: by linking attack methods, defense methods, and metrics covered in an attack event through a knowledge graph, it further explores the complex relationships between algorithms, data, and metrics, which helps to analyze the patterns, trends, and mutual influences between attack events, attack methods, and defense methods. This provides more convincing data support for subsequent defense algorithm recommendations. At the same time, the recommendation part integrates two recommendation modes to provide different recommendation forms in different scenarios, thereby realizing intelligent AI attack and defense decision-making, enhancing the effectiveness of defense strategies, and further improving the security of AI. Attached Figure Description

[0054] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0055] Figure 1 Flowchart of the intelligent model attack and defense knowledge graph construction and recommendation method provided in the embodiments of the present invention;

[0056] Figure 2 This is an overall module diagram of the intelligent model attack and defense knowledge graph construction and recommendation system provided in the embodiments of the present invention;

[0057] Figure 3 This invention provides an intelligent model attack and defense knowledge graph ontology. Detailed Implementation

[0058] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0060] Example 1

[0061] Reference Figures 1 to 3 As shown, this embodiment provides a defense method against network attacks, the method including the following steps:

[0062] S1: Analyze the key elements and influencing factors in the offensive and defensive domains and design the ontology graph;

[0063] Specifically, the designed ontology graph is a higher-level concept of the attack and defense knowledge graph; by analyzing the key influencing factors in the process of network attack and defense events, the entities and relationships contained in the knowledge graph are designed, such as... Figure 3 As shown, the attack and defense knowledge graph includes three unique entity types: (1) attack event entities, (2) defense event entities and (3) indicator entities;

[0064] (1) An attack event entity represents an attack experiment suffered by an intelligent algorithm. It forms a relationship with entities such as attack methods, data objects, and intelligent algorithms that are the targets of the attack. The time and effect of the attack are stored as attributes in the attack event entity.

[0065] (2) The defense event entity represents a defense experiment performed by the defense algorithm. In addition to being related to the defense method, it is also related to the attack event entity through the indicator entity. The defense time, effect, etc. are stored as attributes in the defense event entity.

[0066] (3) Indicator entities are the most special type of entity. Considering the special nature of indicators, if different types of indicators are designed as ordinary entities, all attack and defense event entities will be connected to these indicator entities. Excessively large degree values ​​will increase the difficulty of graph search and recommendation. If indicators are designed as attributes, the performance of defense and attack methods on the same indicator is easily overlooked during path search. Therefore, such as Figure 3 As shown, each pair of attack and defense event entities in this invention has an independent indicator entity that connects the attack and defense events. The specific value of the indicator is stored as a relational attribute between the attack, defense event and the indicator, which facilitates path search during reasoning and recommendation.

[0067] In addition to the three special entities mentioned above, the attack and defense knowledge graph also includes various entities such as (4) intelligent algorithm entity, (5) dataset entity, (6) artificial intelligence model entity, (7) attack method entity, (8) technology type entity and (9) algorithm function entity. Among them, intelligent algorithm entity represents a certain machine learning or deep learning algorithm that may become an attack target; dataset entity represents the sum of data used for a specific task, including image datasets, network datasets and electromagnetic signal datasets; attack method entity represents a certain attack strategy; technology type entity represents the basic technology or upstream and downstream algorithms involved in intelligent algorithm or attack and defense method; algorithm function entity represents the function that the algorithm can perform.

[0068] S2: Analyze attack events to obtain corresponding indicators, and then map the data to the ontology graph to complete the construction of the attack and defense knowledge graph;

[0069] Specifically, by cleaning and uploading technical documents, data descriptions, and experimental data such as records and indicators from attack and defense events in the network, the extracted entity, relationship, and attribute information is stored and represented in a form suitable for graph querying and reasoning. Based on graph-based search and query operations, users can ask questions or keywords, and the system will provide relevant results through the entity, relationship, and attribute information in the graph, which helps users quickly obtain the knowledge or information they need.

[0070] S3: Based on the constructed graph, analyze the performance differences of various defense algorithms when different models face different attack methods, and use this to guide the selection of defense algorithms and realize the recommendation function of defense algorithms;

[0071] Specifically, this invention provides two different methods to address white-box and black-box attacks, employing two recommendation strategies: a path-based recommendation method and a GCN-based recommendation method. The path-based recommendation method offers stronger interpretability, while the GCN-based recommendation algorithm boasts higher efficiency and can guide the completion of missing edges in the graph. Therefore, this invention aims to integrate these two recommendation models, combining their results to provide different recommendation formats for various scenarios.

[0072] The path-based recommendation method assumes an attack event consisting of an attack method, a dataset, and a target intelligent algorithm. It recommends defense algorithms based on the performance of metrics. The method searches for paths from the attack event to any defense algorithm via the metrics, and in subsequent steps, calculates the weight of each path to determine the recommendation index for that defense algorithm. The path from the attack event to the target algorithm is represented as:

[0073] path = {path k path k froma l toP j ,k=1,2,3...,num} (1)

[0074] num is from a l Arrive at P j The number of paths. Through the above steps, multiple paths related to attack event a can be identified. l and index R m Related defense methods and paths in the map.

[0075] Path weight calculation assigns a weight to each path. The larger the weight value, the stronger the defense method P at the end of that path. j More effective defense against attack method A i The resulting attack event a l The specific calculation process is as follows:

[0076] PW = {PW} k |PW k =weight(Path) k ),k=1,2,...,num} (2)

[0077] PW is Path j The weight value, the weight() function is used to get the path j The sum of the weights of the edges connected to it.

[0078] Constructing a recommendation score matrix and normalizing the path weights, due to attack event a l It is based on the only attack method A iIt is certain, therefore the statistics are based on attack event a. l Reachable Defense Method P j The sum of normalized weights on all paths is used as attack method A. i To P j The recommended scores are calculated, and the recommended scores between different attack methods and defense methods are statistically analyzed to construct a recommended score matrix RF. Specifically:

[0079] RF ij =sum(PW k ) / sum(PW),k=1,2,...,num (3)

[0080] num represents the number of events from attack event a. l Reaching Defense Method P j The number of paths. RF ij Represents the attack event a l At a certain optimal performance metric, the defense method P j The degree of matching.

[0081] By constructing an attack and defense method matching index matrix, and using the recommendation score matrix, we can obtain the preference score of each attack method for each defense method.

[0082] However, to verify the accuracy of the recommendations, an index is needed to evaluate whether the obtained defense methods can effectively defend against attack methods. Therefore, this invention constructs an attack-defense method matching index matrix Pa-score based on the index:

[0083]

[0084] Pa-score ij This represents an attack method A. i A confirmed attack event a l , by defense method P j The identified defense event d n In its relationship with a l Common defense indicator R k The defensive capabilities demonstrated above. k -attack and R k -defence respectively represent a l With d n In R k The specific manifestations of this.

[0085] The loss and parameter updates are calculated by combining the recommendation score matrix from step three with the attack / defense method matching index matrix from step four. This yields the expected defense effect against each attack method, which is then used as the loss function to measure the accuracy of the recommendations.

[0086]

[0087] The recommendation performance is optimized by updating the path weights in the graph by taking the gradient of the loss function.

[0088] The GCN-based defense algorithm recommendation primarily obtains embedding vectors of attack events, defense events, attack methods, and defense methods through GCN training, and then implements the recommendation process through similarity calculation. This method can acquire latent attributes from the black-box model during training, thus compensating for the shortcomings of path-based recommendation methods. After the model is trained robustly, the similarity of the embedding vectors can guide the recommendation. Furthermore, relying on the similarity between embedding vectors, it can guide the completion of actual edges in the graph, making the recommendation results more accurate.

[0089] S4: Use network attack events as input to the system to defend against such attacks.

[0090] Example 2

[0091] Specifically, such as Figure 2 As shown, this embodiment provides a defense system for network attacks, used to implement a defense method for network attacks in Embodiment 1, including an ontology graph design module, a graph construction module, a defense recommendation module, and a defense implementation module.

[0092] The ontology graph design module is used to analyze the key elements and influencing factors of intelligent models in the field of attack and defense and to design ontology graphs.

[0093] The graph construction module is used to analyze the attack events of the intelligent model in multiple domains to obtain corresponding indicators, and then map the data to the ontology graph to complete the construction of the intelligent model attack and defense knowledge graph.

[0094] The defense recommendation module is used to analyze the performance differences of different models and defense algorithms when facing different attack methods based on the constructed graph, and guide the selection of defense algorithms to achieve the recommendation function of defense algorithms.

[0095] The defense implementation module is used to take network attack events as input to the system and implement defense against such attacks.

[0096] Taking path-based recommendation methods as an example, a new attack event a new As a new node in the attack and defense knowledge graph G, it is linked to the attack method A used. i By correlating the data, information can be obtained from attack event a. new To candidate defense method P iMultiple paths are identified; then, a path weight PW is calculated for each path, and a recommendation score matrix RF is constructed. Normalizing the path weights yields a new attack method a. new For each defense method's preference score, the training loss and parameter updates yield the expected defense effect against each attack method; based on the above steps, the best-matching defense method P is obtained. i The defense recommendation module uses this method to defend against new network attack events, thereby improving network security.

[0097] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for constructing and recommending knowledge graphs for intelligent model attack and defense, characterized in that, Includes the following steps: S1: Analyze the key elements and influencing factors of intelligent models in the field of attack and defense, and design the ontology graph; S2: Analyze the attack events of the intelligent model in multiple domains to obtain corresponding indicators, and then map the data to the ontology graph to complete the construction of the intelligent model attack and defense knowledge graph; S3: Based on the constructed graph, analyze the performance differences of various defense algorithms when different models face different attack methods, and use this to guide the selection of defense algorithms and realize the recommendation function of defense algorithms; Step S1 includes: S101: By analyzing the algorithm description, algorithm feature technical documents, data description, and attack and defense experiment records and indicator-related experimental data of the intelligent model, we can explore various relationships between algorithms, data, and indicators and algorithms. S102: Based on the important elements obtained from the analysis in step S101, an ontology graph of the intelligent model attack and defense knowledge graph was designed. The ontology graph includes attack event entities, defense event entities and indicator entities, intelligent algorithm entities, dataset entities, attack method entities, defense method entities, intelligent model entities, technology type entities, and algorithm function entities. The attack event entity includes the time attribute and effect attribute of the attack, and the defense event entity includes the time attribute and effect attribute of the defense. The attack event entity forms a relationship with the attack method entity, the dataset entity, and the intelligent algorithm entity that is the target of the attack; the defense event entity forms a relationship with the defense method entity and the attack event entity through the indicator entity. The indicator entity connects the attack event entity and the defense event entity. The specific value of the indicator entity is stored as a relational attribute between the attack event entity, the defense event entity, and the indicator entity.

2. The method for constructing and recommending an intelligent model attack and defense knowledge graph according to claim 1, characterized in that, Step S2 includes: S201: Based on the attack performance of the attack strategies adopted in the network domain, image domain, and electromagnetic domain on the intelligent model, obtain the sample indicators after attack and defense. S202: The intelligent model-related description refers to the data content required by the algorithm entity, dataset entity, technology type entity, and algorithm function entity in the ontology graph; The algorithm entities include the names of relevant algorithms in machine learning and deep learning that can be targets of attack; The dataset entities include image datasets, network datasets, and electromagnetic signal datasets; The technology type entities include the basic technologies and upstream and downstream algorithms involved in intelligent algorithms; The algorithm functional entities include node classification, community detection, link prediction, image classification, target detection, target recognition, individual recognition, and modulation type recognition functions in the network domain, image domain, and electromagnetic domain. S203: Using knowledge extraction techniques, the data obtained in steps S201 and S202 are processed into the form of <head entity; relation; tail entity>, and mapped to the ontology graph to complete the construction of the knowledge graph.

3. The method for constructing and recommending an intelligent model attack and defense knowledge graph according to claim 1, characterized in that, Step S3 includes: S301: When the model faces different attack methods, it provides two different methods for white-box attacks and black-box attacks, and adopts two recommendation strategies: a path-based recommendation method and a GCN-based recommendation method. S302: Based on the recommendation method described in step S301, determine the defense method that best matches the attack event and recommend it to the user.

4. The method for constructing and recommending an intelligent model attack and defense knowledge graph according to claim 3, characterized in that, The path-based recommendation method in step S301 includes: Assuming an attack event consists of an attack method, a dataset, and a target intelligent algorithm, the recommended defense algorithm is based on the performance of the metrics. The process involves searching for paths from the attack event to any defense algorithm via the metrics, and calculating the weight of these paths in subsequent steps to determine the recommendation index for that defense algorithm. The resulting paths are represented as follows: （1） From arrival The number of paths; through the above steps, multiple attack events can be identified. and indicators Related defense methods and paths in the map; Path weight calculation assigns a weight to each path; the higher the weight value, the stronger the defense method at the end of that path. More effective defense against attack methods The resulting attack events The specific calculation process is as follows: （2） for The weight value, The function is used to get the path The sum of the weights of the edges connected to it; The recommendation score matrix is ​​constructed and the path weights are normalized. Due to the attack event... It is the only attack method It is certain, therefore the statistics are based on attack events. Reachable defense methods The sum of normalized weights on all paths is used as the attack method. arrive The recommended scores are calculated, and the recommended scores for different attack methods and defense methods are statistically analyzed to construct a recommended score matrix. , specifically: （3） To the attack event Reaching the defense method The number of paths; Representative in the attack incident At a certain optimal performance metric, the defense method The degree of matching; By constructing an attack and defense method matching index matrix, and using the recommendation score matrix, we can obtain the preference score of each attack method for each defense method. However, to test the accuracy of the recommendations, an index is needed to evaluate whether the obtained defense methods can effectively defend against attack methods; therefore, this invention constructs an attack and defense method matching index matrix based on the index. : （4） This represents an attack method Confirmed attack events By defense methods Determined defensive events In its and Common defense indicators The defensive capabilities demonstrated above; and Represent and exist Specific manifestations on; The loss and parameter updates are calculated by combining the recommendation score matrix from step three with the attack / defense method matching index matrix from step four. This yields the expected defense effect against each attack method, which is then used as the loss function to measure the accuracy of the recommendations. （5） The recommendation performance is optimized by updating the path weights in the graph by taking the gradient of the loss function.

5. The method for constructing and recommending an intelligent model attack and defense knowledge graph according to claim 3, characterized in that, The GCN-based recommendation method in step S301 includes: By training with GCN, embedding vectors of attack events, defense events, attack methods, and defense methods are obtained. Then, the recommendation process is implemented through similarity calculation. The training process can obtain latent attributes in the black-box model, compensating for the shortcomings of path-based recommendation methods. After the model is trained robustly, the similarity of the embedding vectors can guide the recommendation. Furthermore, based on the similarity between the embedding vectors, the completion of the edges in the graph is guided, making the recommendation results more accurate.

6. A knowledge graph construction and recommendation system for intelligent model attack and defense, characterized in that, include: The ontology graph design module is used to analyze the key elements and influencing factors of intelligent models in the offensive and defensive domains and design ontology graphs; it includes: S101: By analyzing the algorithm description, algorithm feature technical documents, data description, and attack and defense experiment records and indicator-related experimental data of the intelligent model, we can explore various relationships between algorithms, data, and indicators and algorithms. S102: Based on the important elements obtained from the analysis in step S101, an ontology graph of the intelligent model attack and defense knowledge graph was designed. The ontology graph includes attack event entities, defense event entities and indicator entities, intelligent algorithm entities, dataset entities, attack method entities, defense method entities, intelligent model entities, technology type entities, and algorithm function entities. The attack event entity includes the time attribute and effect attribute of the attack, and the defense event entity includes the time attribute and effect attribute of the defense. The attack event entity forms a relationship with the attack method entity, the dataset entity, and the intelligent algorithm entity that is the target of the attack; the defense event entity forms a relationship with the defense method entity and the attack event entity through the indicator entity. The indicator entity connects the attack event entity and the defense event entity. The specific value of the indicator entity is stored as a relational attribute between the attack event entity, the defense event entity, and the indicator entity. The graph construction module is used to analyze attack events of intelligent models in multiple domains to obtain corresponding indicators, and then map the data to the ontology graph to complete the construction of the intelligent model attack and defense knowledge graph. The defense recommendation module is used to analyze the performance differences of various defense algorithms when facing different attack methods based on the constructed graph, and to guide the selection of defense algorithms, thereby realizing the function of recommending defense algorithms.

Images