Evaluation method and related device for MDATA graph embedding

Abstract

The present application discloses an evaluation method and related device for MDATA graph embedding, which relates to the field of network security technology. By obtaining a target MDATA graph including an MDATA static graph and an MDATA spatiotemporal graph, and embedding the MDATA static graph and the MDATA spatiotemporal graph into a vector space respectively, a first entity vector set and a second entity vector set are obtained, an evaluation vector set is obtained and the evaluation vector is replaced according to the first entity vector set and the second entity vector set to obtain a first test vector set and a second test vector set, and then each test vector in the first test vector set and the second test vector set is evaluated to obtain an evaluation set, and target evaluation data is constructed according to the sorting order of the evaluation vectors in the evaluation set. Therefore, the present application associates static data and corresponding spatiotemporal data, which can accurately evaluate the embedding effect of the MDATA graph and promote the development of the embedding work of existing dynamic knowledge graphs.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an MDATA graph embedding evaluation method and related devices. Background Art

[0002] With the rise of knowledge representation methods, such as knowledge graphs, and related embedding technologies, vast amounts of information are being effectively represented and utilized. However, in various fields of reality, much of this information is distorted by changes in time and space. Based on a general knowledge graph, Gu et al. proposed the Multidimensional Data Association and Intelligent Analysis (MDATA) model, redefining the architecture of knowledge representation models to enable the effective representation of dynamically changing knowledge.

[0003] To fully leverage the usability of MDATA models, the field of embedding is constantly evolving. In the field of cybersecurity, cyberattacks typically consist of a series of logically related basic attack steps, each of which is linked in time and space. Consequently, MDATA models are increasingly being used. However, embedding evaluation methods in related technologies fail to consider the impact of temporal and spatial shifts on authenticity when evaluating embedding effectiveness, resulting in inaccurate embedding assessments. Summary of the Invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application provides an MDATA graph embedding evaluation method and related device, which can associate spatiotemporal information and accurately evaluate the embedding effect.

[0005] In a first aspect, an embodiment of the present application provides an evaluation method for MDATA graph embedding, comprising:

[0006] Obtain a target MDATA map; wherein the target MDATA map includes: an MDATA static map and an MDATA spatiotemporal map, wherein the MDATA static map is constructed by static feature data in the network monitoring data, and the MDATA spatiotemporal map is constructed by spatiotemporal feature data in the network monitoring data;

[0007] Embed the entities in the MDATA static graph into a preset vector space to obtain a first entity vector set;

[0008] Embed the entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set;

[0009] Acquire an evaluation vector set; wherein the evaluation vector set includes: a static evaluation vector and a spatiotemporal evaluation vector;

[0010] Replacing the static evaluation vector according to the first entity vector set to obtain a first test vector set;

[0011] Replacing the spatiotemporal evaluation vectors according to the second entity vector set to obtain a second test vector set;

[0012] Performing embedding evaluation processing on each test vector in the first test vector set according to the static evaluation vector to obtain a first evaluation set;

[0013] performing embedding evaluation processing on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain a second evaluation set;

[0014] Target evaluation data is constructed based on the first evaluation set and the second evaluation set; wherein, the target evaluation data represents the embedding effect of the vector space in the MDATA graph.

[0015] In some embodiments of the present application, before obtaining the target MDATA map, the evaluation method further includes:

[0016] Constructing the target MDATA map specifically includes:

[0017] Obtain network monitoring data at each time point;

[0018] Extracting network attack data from the network monitoring data; wherein the network attack data includes: static feature data and spatiotemporal feature data;

[0019] The MDATA static map is constructed based on the static feature data, and the MDATA spatiotemporal map is constructed based on the spatiotemporal feature data.

[0020] In some embodiments of the present application, the static feature data includes a head entity, a relationship, and a tail entity, and the spatiotemporal feature data includes a source address, time information, and a destination address; and constructing the MDATA static graph based on the static feature data and constructing the MDATA spatiotemporal graph based on the spatiotemporal feature data include:

[0021] The head entity is taken as the first head entity, the relationship is taken as the first relationship, and the tail entity is taken as the first tail entity;

[0022] Associating the first head entity and the first tail entity according to the first relationship to construct the MDATA static graph;

[0023] The source address is used as a second header entity, the time information is used as a second relationship, and the destination address is used as a second tail entity;

[0024] The second head entity and the second tail entity are associated according to the second relationship to construct the MDATA spatiotemporal graph.

[0025] In some embodiments of the present application, embedding entities in the MDATA static graph into a preset vector space to obtain a first entity vector set includes:

[0026] Input the entities in the MDATA static graph into a preset static embedding model for vector space conversion to obtain a static embedding vector;

[0027] Performing loss calculation based on a preset static evaluation vector and the static embedding vector to obtain a first loss value;

[0028] Allowing the static embedding model to perform a first training process according to the first loss value; wherein the first training process is to update the static embedding vector using a stochastic gradient descent algorithm and update the first loss value;

[0029] Until the updated first loss value satisfies a first preset condition, the updated static embedding vector is used as the output of the static embedding model to obtain the first entity vector set.

[0030] In some embodiments of the present application, embedding entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set includes:

[0031] Input the entities in the MDATA spatiotemporal graph into a preset spatiotemporal embedding model for vector space conversion to obtain a spatiotemporal embedding vector;

[0032] Performing loss calculation based on the preset spatiotemporal evaluation vector and the spatiotemporal embedding vector to obtain a second loss value;

[0033] Allowing the spatiotemporal embedding model to perform a second training process according to the second loss value; wherein the second training process is to update the spatiotemporal embedding vector using a stochastic gradient descent algorithm and update the second loss value;

[0034] Until the updated second loss value satisfies a second preset condition, the updated spatiotemporal embedding vector is used as the output of the spatiotemporal embedding model to obtain the second entity vector set.

[0035] In some embodiments of the present application, the first entity vector set includes a plurality of static embedding vectors, the static embedding vectors include a static head entity vector and a static tail entity vector, the static evaluation vectors include a first head entity evaluation vector and a first tail entity evaluation vector, and the first test vector set includes a first head entity test set and a first tail entity test set; and replacing the static evaluation vectors according to the first entity vector set to obtain the first test vector set includes:

[0036] replacing the first head entity evaluation vector according to each of the static head entity vectors and each of the static tail entity vectors in the first entity vector set to obtain the first head entity test set;

[0037] The first tail entity evaluation vector is replaced according to each of the static head entity vectors and each of the static tail entity vectors in the first entity vector set to obtain the first tail entity test set.

[0038] In some embodiments of the present application, the second entity vector set includes a plurality of spatiotemporal embedding vectors, the spatiotemporal embedding vectors include a spatiotemporal head entity vector and a spatiotemporal tail entity vector, the spatiotemporal evaluation vectors include a second head entity evaluation vector and a second tail entity evaluation vector, and the second test vector set includes a second head entity test set and a second tail entity test set; and replacing the spatiotemporal evaluation vectors according to the second entity vector set to obtain the second test vector set includes:

[0039] Replace the second head entity evaluation vector according to each of the spatiotemporal head entity vectors and each of the spatiotemporal tail entity vectors in the second entity vector set to obtain the second head entity test set;

[0040] The second tail entity evaluation vector is replaced according to each of the spatiotemporal head entity vectors and each of the spatiotemporal tail entity vectors in the second entity vector set to obtain the second tail entity test set.

[0041] In some embodiments of the present application, the first evaluation set is first sorted data, and the first evaluation set includes a first head entity evaluation set and a first tail entity evaluation set; performing embedded evaluation processing on each test vector in the first test vector set according to the static evaluation vector to obtain the first evaluation set includes:

[0042] Performing head entity embedding evaluation on each test vector in the first head entity test set to obtain the first head entity evaluation set;

[0043] Performing tail entity embedding evaluation on each test vector in the first tail entity test set to obtain the first tail entity evaluation set;

[0044] Performing embedded evaluation on the static evaluation vector to obtain static evaluation data;

[0045] The first sorting data is obtained according to the sorting order of the static evaluation data in the first head entity evaluation set and the first tail entity evaluation set.

[0046] In some embodiments of the present application, the second evaluation set is second sorted data, and the second evaluation set includes a second head entity evaluation set and a second tail entity evaluation set; and performing embedding evaluation processing on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain the second evaluation set includes:

[0047] Performing head entity embedding evaluation on each test vector in the second head entity test set to obtain the second head entity evaluation set;

[0048] Performing a tail entity embedding evaluation on each test vector in the second tail entity test set to obtain the second tail entity evaluation set;

[0049] Performing embedded evaluation on the spatiotemporal evaluation vector to obtain static evaluation data;

[0050] The second sorting data is obtained according to the sorting order of the static evaluation data in the second head entity evaluation set and the second tail entity evaluation set.

[0051] In some embodiments of the present application, constructing target evaluation data of the MDATA map based on the first evaluation set and the second evaluation set includes:

[0052] Associating the first sorting data with the second sorting data according to a preset association weight to obtain total sorting data;

[0053] The target evaluation data is constructed according to the preset evaluation index and the total ranking data.

[0054] In some embodiments of the present application, before associating the first ranking data with the second ranking data according to the preset association weight to obtain the total ranking data, the evaluation method further includes:

[0055] The association weight is preset, specifically including:

[0056] Obtaining the number of entities in the static feature data to obtain a first entity number;

[0057] Obtaining the number of entities in the spatiotemporal feature data to obtain a second entity number;

[0058] Summing the first entity quantity and the second entity quantity to obtain a total entity quantity;

[0059] using a ratio between the first entity quantity and the total entity quantity as a first weight;

[0060] using a ratio between the second entity quantity and the total entity quantity as a second weight;

[0061] The association weight is constructed according to the first weight and the second weight.

[0062] In a second aspect, an embodiment of the present application further provides an MDATA graph embedding evaluation device, which applies the MDATA graph embedding evaluation method described in the embodiment of the first aspect of the present application, including:

[0063] The first acquisition module is used to acquire a target MDATA map; wherein the target MDATA map includes: an MDATA static map and an MDATA spatiotemporal map, wherein the MDATA static map is constructed by static feature data in the network monitoring data, and the MDATA spatiotemporal map is constructed by spatiotemporal feature data in the network monitoring data;

[0064] A first embedding module embeds entities in the MDATA static graph into a preset vector space to obtain a first entity vector set;

[0065] A second embedding module embeds entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set;

[0066] A second acquisition module is used to acquire an evaluation vector set; wherein the evaluation vector set includes: a static evaluation vector and a spatiotemporal evaluation vector;

[0067] A first replacement module, configured to replace the static evaluation vector according to the first entity vector set to obtain a first test vector set;

[0068] A second replacement module, configured to replace the spatiotemporal evaluation vector according to the second entity vector set to obtain a second test vector set;

[0069] A first evaluation module, configured to perform an embedding evaluation process on each test vector in the first test vector set according to the static evaluation vector to obtain a first evaluation set;

[0070] a second evaluation module, configured to perform embedding evaluation processing on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain a second evaluation set;

[0071] An embedding evaluation module is used to construct target evaluation data based on the first evaluation set and the second evaluation set; wherein, the target evaluation data represents the embedding effect of the vector space in the MDATA map.

[0072] In the third aspect, an embodiment of the present application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the MDATA graph embedding evaluation method as described in the embodiment of the first aspect of the present application.

[0073] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the evaluation method of MDATA graph embedding as described in the embodiment of the first aspect of the present application.

[0074] The embodiments of the present application include at least the following beneficial effects:

[0075] An embodiment of the present application provides an evaluation method and related device for MDATA graph embedding, wherein the method first obtains a target MDATA graph constructed by static feature data and spatiotemporal feature data, and the target MDATA graph includes an MDATA static graph and an MDATA spatiotemporal graph. Then, the entities in the MDATA static graph are embedded into a preset vector space to obtain a first entity vector set, and the entities in the MDATA spatiotemporal graph are embedded into a vector space to obtain a second entity vector set. An evaluation vector set including a static evaluation vector and a spatiotemporal evaluation vector is obtained, and the static evaluation vector is replaced according to the first entity vector set to obtain a first test vector set, and the spatiotemporal evaluation vector is replaced according to the second entity vector to obtain a second test vector set. Each test vector in the first test vector set is embedded and evaluated according to the static evaluation vector to obtain a first evaluation set, and each test vector in the second test vector set is embedded and evaluated according to the spatiotemporal evaluation vector to obtain a second evaluation set. Finally, target evaluation data is constructed based on the first evaluation set and the second evaluation set. Therefore, by associating static data with corresponding spatiotemporal data, the embedding effect of the vector space in the MDATA graph can be accurately evaluated. When applied to the field of network security technology, it can accurately evaluate spatiotemporal changes and their impacts, and promote the development of embedding work in existing dynamic knowledge graphs.

[0076] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0078] Figure 1 1 is a flowchart of an MDATA graph embedding evaluation method provided by an embodiment of the present application;

[0079] Figure 21 is a flowchart of an MDATA graph embedding evaluation method provided by another embodiment of the present application;

[0080] Figure 3 yes Figure 2 Flow diagram of step S203;

[0081] Figure 4 yes Figure 1 Flow diagram of step S102;

[0082] Figure 5 yes Figure 1 Flow diagram of step S103;

[0083] Figure 6 yes Figure 1 Flow chart of step S105;

[0084] Figure 7 yes Figure 1 Flow chart of step S106;

[0085] Figure 8 yes Figure 1 Flow chart of step S107;

[0086] Figure 9 yes Figure 1 Flow chart of step S108;

[0087] Figure 10 yes Figure 1 Flow chart of step S109;

[0088] Figure 11 1 is a flowchart of an MDATA graph embedding evaluation method provided by another embodiment of the present application;

[0089] Figure 12 This is a schematic diagram of the embedding process provided by an embodiment of the present application;

[0090] Figure 13 This is a schematic diagram of embedded evaluation replacement provided by an embodiment of the present application;

[0091] Figure 14 This is a schematic diagram of an evaluation device module embedded with an MDATA graph provided in one embodiment of the present application;

[0092] Figure 15 It is a structural diagram of an electronic device provided by an embodiment of the present application.

[0093] Reference numerals: first acquisition module 100 , first embedding module 200 , second embedding module 300 , second acquisition module 400 , first replacement module 500 , second replacement module 600 , first evaluation module 700 , second evaluation module 800 , embedded evaluation module 900 , electronic device 1000 , processor 1001 , memory 1002 . DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0095] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application and are not to be construed as limiting the present application.

[0096] In the description of this application, it should be understood that descriptions involving orientations, such as up, down, front, back, left, right, etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limitations on this application.

[0097] In the description of this application, "several" means one or more, "many" means more than two, "greater than," "less than," and "exceed" are understood to exclude the number itself, while "above," "below," and "within" are understood to include the number itself. The terms "first" and "second" are used solely to distinguish technical features and are not to be construed as indicating or implying relative importance, or as implicitly specifying the number or order of the technical features indicated.

[0098] In the description of this application, unless otherwise clearly defined, terms such as setting, installing, and connecting should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in this application based on the specific content of the technical solution.

[0099] With the rise of knowledge representation methods, such as knowledge graphs, and related embedding technologies, vast amounts of information are being effectively represented and utilized. However, in various fields of reality, a large amount of information is distorted by changes in time and space. Existing knowledge graphs are unable to represent highly evolving knowledge, especially cybersecurity knowledge. Based on a general knowledge graph, Gu et al. proposed the Multidimensional Data Association and Intelligent Analysis (MDATA) model, redefining the architecture of knowledge representation models to effectively represent dynamically changing knowledge.

[0100] To fully leverage the usability of MDATA models, the field of embedding is continuously developing. Embedding is the process of mapping entities and relationships into a low-dimensional vector space. The semantic associations between entities and relationships are measured by the similarity between vectors. Embedding provides a compact way to represent large-scale knowledge graphs and can be used for tasks such as computing similarity, reasoning, and data analysis. Evaluating the effectiveness of embeddings aims to measure the performance and quality of the embedding model. This evaluation can reveal the accuracy, robustness, and generalization of the embedding model in tasks such as link prediction. Evaluation results can also be used to guide model optimization, select optimal parameter configurations, and compare performance differences between different methods. Furthermore, evaluation can verify the applicability of the embedding model across different datasets, tasks, and scenarios, providing guidance on model generalization performance. Therefore, evaluation can provide an objective measure and reference for the performance and effectiveness of the embedding model, further promoting research and application in the field of knowledge graphs.

[0101] In the field of network security technology, network attacks are usually composed of a series of basic attack steps with logical relationships, and there are also temporal and spatial correlations between each step. Therefore, the MDATA model is increasingly widely used. However, the existing evaluation work of MDATA knowledge embedding is inspired by traditional static knowledge graphs. Its basic unit is a triple: (head entity, relationship, tail entity). During testing, it is generally based on the link prediction task. By calculating the score of knowledge after being replaced by all entities or relationships, the comprehensive hit rate and ranking order of correct knowledge are obtained to evaluate the effect of embedding. The impact of timeliness and spatial transfer on authenticity is not considered. Therefore, when evaluating dynamic knowledge graphs, it is impossible to associate spatiotemporal information to accurately evaluate the embedding effect, resulting in difficulty in accurately detecting the spatiotemporal changes of network attacks and their impact, hindering the development of related research and applications.

[0102] Based on this, the embodiments of the present application provide an MDATA graph embedding evaluation method and related devices, which can associate static data and corresponding spatiotemporal data, accurately evaluate the embedding effect of the vector space in the MDATA graph, and be applied to the field of network security technology to accurately evaluate spatiotemporal changes and their impacts, and promote the development of existing dynamic knowledge graph embedding work.

[0103] The embodiments of the present application provide an evaluation method and related device for MDATA graph embedding, which are specifically illustrated by the following embodiments. First, the evaluation method for MDATA graph embedding in the embodiments of the present application is described.

[0104] The evaluation method for embedding an MDATA graph provided in the embodiment of the present application relates to the field of network security technology, and in particular to the field of network attack and defense technology. The evaluation method for embedding an MDATA graph provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be a computer program running in a terminal or a server side. For example, a computer program can be a native program or software module in an operating system; it can be a local (Native) application (APP, Application), that is, a program that needs to be installed in the operating system before it can run, such as a client that supports the evaluation of embedding an MDATA graph, that is, a program that can be run only by downloading it to a browser environment. In short, the above-mentioned computer program can be any form of application, module or plug-in. Among them, the terminal communicates with the server through a network. The evaluation method for embedding an MDATA graph can be executed by a terminal or a server, or by the terminal and the server in collaboration.

[0105] In some embodiments, the terminal can be a smartphone, tablet computer, laptop computer, desktop computer or smartwatch, etc. The server can be an independent server, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms; it can also be a service node in a blockchain system, where each service node in the blockchain system forms a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on the Transmission Control Protocol (TCP). The server can be installed with a server end of the MDATA graph embedded evaluation system, through which the terminal can interact, for example, the server end can be installed with corresponding software, and the software can be an application that implements the MDATA graph embedded evaluation method, etc., but is not limited to the above forms. The terminal and the server can be connected through Bluetooth, USB (Universal Serial Bus) or network communication connection methods, which are not limited in this embodiment.

[0106] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0107] The following describes the evaluation method of MDATA graph embedding in an embodiment of the present invention.

[0108] Reference Figure 1 As shown, an embodiment of the present application provides an MDATA graph embedding evaluation method, which is applied to an infrastructure entity. The MDATA graph embedding evaluation method includes but is not limited to the following steps S101 to S109.

[0109] Step S101, obtain the target MDATA map.

[0110] In some embodiments, the MDATA graph is a knowledge graph, which is a graph-based data structure consisting of nodes (Point) and edges (Edge). In the knowledge graph, each node represents an "entity" that exists in the real world, and each edge is a "relationship" between entities. Binary relationship facts in the knowledge graph are usually represented as triples, namely (head entity, relationship, tail entity). In this embodiment, the MDATA graph is mainly used to establish corresponding spatiotemporal associations in the field of network security. On the basis of the knowledge graph, the entity or attribute representation of time and space is also realized, thereby enhancing the representation ability of the existing knowledge graph.

[0111] In some embodiments, the target MDATA map can also be divided into an MDATA static map and an MDATA spatiotemporal map. Specifically, the MDATA static map is constructed by the static feature data in the network monitoring data, and the MDATA spatiotemporal map is constructed by the spatiotemporal feature data in the network monitoring data. For example, network monitoring data such as attack names, vulnerabilities, intrusion detection devices, timestamps, source addresses and destination addresses of attacks can be collected from a network target range environment and identified as static feature data or spatiotemporal feature data, thereby constructing a corresponding data map. This embodiment does not impose any restrictions on this.

[0112] Step S102: embed the entities in the MDATA static graph into a preset vector space to obtain a first entity vector set.

[0113] In some embodiments, the MDATA static graph is embedded into a preset vector space, that is, the entities and relationships in the MDATA static graph are represented by vectors. It can be understood that by mapping entities and relationships into a continuous vector space, the semantic associations between entities and relationships can be captured and applied to prediction tasks, etc., thereby improving the usability of the knowledge graph. Specifically, after embedding the entities in the MDATA static graph into the preset vector space, a first entity vector set is obtained, and the first entity vector set corresponds to the entity vectors obtained after the entities in the MDATA static graph are embedded into the vector space.

[0114] Step S103: embed the entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set.

[0115] In some embodiments, the MDATA spatiotemporal graph is also embedded into the vector space to obtain entity vectors after the entities in the MDATA spatiotemporal graph are embedded into the vector space, thereby forming a second entity vector set.

[0116] In some embodiments, the graph can be embedded into the vector space using a related knowledge graph embedding model, such as the TransE model or the DistMult model. Specifically, the TransE model is a model based on vector difference, assuming that in a triple (h, r, t), the vectors of the head entity h and the tail entity t should be similarity calculated through the vector of the relationship r. The model learns the vector representation of entities and relationships by minimizing the difference between the vectors of the head entity, relationship, and tail entity. The DistMult model is a model based on dot product, assuming that in a triple (h, r, t), the similarity between the vectors of the head entity h, relationship r, and tail entity t can be calculated by their dot product. The model learns the vector representation of entities and relationships by maximizing the difference between the correct triples and the incorrect triples. It can be understood that the same embedding model is used to embed the MDATA static graph into the vector space and to embed the MDATA spatiotemporal graph into the vector space, thereby having a unified dimension when evaluating the embedding effect, which can ensure the accuracy of the evaluation effect.

[0117] Step S104: Obtain an evaluation vector set.

[0118] In some embodiments, an evaluation vector set including a static evaluation vector and a spatiotemporal evaluation vector is obtained. Specifically, the evaluation vector set includes multiple evaluation vectors that can be used to evaluate the effect of embedding the MDATA graph into the vector space. Each evaluation vector can be divided into a corresponding static evaluation vector and a spatiotemporal evaluation vector. The static evaluation vector can be used to evaluate the embedding effect of the MDATA static graph, and the spatiotemporal evaluation vector can be used to evaluate the embedding effect of the MDATA spatiotemporal graph.

[0119] Step S105 : replacing the static evaluation vectors according to the first entity vector set to obtain a first test vector set.

[0120] In some embodiments, the first entity vector set is composed of entities in the MDATA static graph, represented in vector form, and there are multiple triples in the MDATA static graph, and the head entity and the tail entity in each triple together constitute the first entity vector set. According to the first entity vector set, the static evaluation vector in the evaluation vector is replaced, and an erroneous triple can be obtained for testing. The triple corresponding to the static evaluation vector is the correct triple used to evaluate the effect of embedding, so the replaced triples constitute the first test vector set.

[0121] Step S106: Replace the spatiotemporal evaluation vectors according to the second entity vector set to obtain a second test vector set.

[0122] In some embodiments, the second entity vector set is composed of entities in the MDATA spatiotemporal graph, represented as vectors. There are multiple triplets in the MDATA spatiotemporal graph, and the head entity and tail entity in each triple together constitute the second entity vector set. By replacing the spatiotemporal evaluation vector in the evaluation vector according to the second entity vector set, an incorrect triple can be obtained for testing, while the triple corresponding to the spatiotemporal evaluation vector is a correct triple used to evaluate the effect of the embedding, so the replaced triples constitute the second test vector set.

[0123] Step S107 , performing embedding evaluation processing on each test vector in the first test vector set according to the static evaluation vector to obtain a first evaluation set.

[0124] In some embodiments, each test vector in the first test vector set is evaluated based on a static evaluation vector. Specifically, there are multiple static evaluation vectors, each of which is replaced by the first entity vector set. Since the first entity vector set has multiple entity vectors, multiple corresponding test vectors can be obtained, that is, the static evaluation vector and its test vector are in a one-to-many relationship. By evaluating the corresponding multiple test vectors in the first test vector based on each static evaluation vector, evaluation data of the static evaluation vector in the test vector can be obtained, thereby obtaining a first evaluation set composed of the evaluation data of each static evaluation vector.

[0125] Step S108 , performing embedding evaluation processing on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain a second evaluation set.

[0126] In some embodiments, each test vector in the second test vector set is evaluated based on the spatiotemporal evaluation vector. Specifically, there are multiple spatiotemporal evaluation vectors, each of which is replaced by the second entity vector set. Since the second entity vector set has multiple entity vectors, multiple corresponding test vectors can be obtained, that is, the spatiotemporal evaluation vector and its test vector are in a one-to-many relationship. By evaluating the corresponding multiple test vectors in the first test vector based on each spatiotemporal evaluation vector, evaluation data of the spatiotemporal evaluation vector in the test vector can be obtained, thereby obtaining a second evaluation set composed of the evaluation data of each spatiotemporal evaluation vector.

[0127] Step S109: construct target evaluation data based on the first evaluation set and the second evaluation set.

[0128] In some embodiments, the target evaluation data represents the embedding effect of the vector space in the MDATA graph, specifically constructed based on a first evaluation set and a second evaluation set, thereby correlating the evaluation of the static evaluation vector and the spatiotemporal evaluation vector. Combining static and spatiotemporal features for analysis and prediction allows for an accurate evaluation of the embedding effect of the vector space in the MDATA graph. This application to the field of network security can accurately detect and identify network attacks and promote the development of embedding work in existing dynamic knowledge graphs.

[0129] Reference Figure 2 As shown, in some embodiments of the present application, before the above step S101, the following steps S201 to S203 may also be included but not limited to.

[0130] Step S201: Acquire network monitoring data at each time point.

[0131] In some embodiments, an MDATA map needs to be constructed before obtaining the target MDATA map. Specifically, network monitoring data at each time point can be obtained based on the network range environment. The time point is also known as the timestamp, which can be set to 10 seconds or 30 seconds according to actual needs, or it can be the system default time. The network monitoring data can be alarm logs generated by the system and monitored target data, etc., which is not limited in this embodiment.

[0132] Step S202: extract network attack data from the network monitoring data.

[0133] In some embodiments, natural language processing (NLP) technology is used to extract network attack data from network monitoring data, such as attack name, vulnerability, intrusion detection device, timestamp, source address and destination address of the attack. The data type can be expressed as (header entity, relationship, tail entity, time, space), where the space includes the source address and destination address. For example, a network attack data extracted from the system alarm log is (attacker, phishing email attack, web server, 2019.10.19, 101.1.35.X, 192.168.12.X), which means that the attacker used a phishing email to attack the web server. The attack time was October 19, 2019, the source address of the attack was 101.1.35.X, and the destination address of the attack was 192.168.12.X.

[0134] Step S203, constructing an MDATA static graph based on the static feature data, and constructing an MDATA spatiotemporal graph based on the spatiotemporal feature data.

[0135] In some embodiments, network attack data includes static feature data and spatiotemporal feature data. Specifically, static feature data includes head and tail entities and their relationships, while spatiotemporal feature data includes time and space, namely, the source and destination addresses of the attack and their time. Thus, an MDATA static graph is constructed based on the static feature data, and an MDATA spatiotemporal graph is constructed based on the spatiotemporal feature data.

[0136] Reference Figure 3 As shown, in some embodiments of the present application, the above-mentioned step S203 may include but is not limited to the following steps S301 to S304.

[0137] Step S301: The head entity is taken as the first head entity, the relationship is taken as the first relationship, and the tail entity is taken as the first tail entity.

[0138] In some embodiments, the static feature data includes a head entity, a relationship, and a tail entity. Specifically, the head entity is taken as a first head entity, the relationship is taken as a first relationship, and the tail entity is taken as a first tail entity. It is understandable that a first relationship exists between the first head entity and the first tail entity. For example, the relationship between the attacker and the web server is a phishing email attack, that is, the attacker uses a phishing email to attack the web server.

[0139] Step S302: associate the first head entity and the first tail entity according to the first relationship to construct an MDATA static graph.

[0140] In some embodiments, the first head entity and the first tail entity are associated according to the first relationship, which can be specifically expressed as a triple (first head entity, first relationship, first tail entity). Therefore, all static feature data can be processed to obtain multiple first head entities and first tail entities and their first relationships, thereby constructing an MDATA static graph.

[0141] Step S303: take the source address as the second head entity, the time information as the second relationship, and the destination address as the second tail entity.

[0142] In some embodiments, the spatiotemporal feature data includes a source address, time information, and a destination address. Specifically, the source address is used as the second header entity, the time information is used as the second relationship, and the destination address is used as the second tail entity. It is understood that a second relationship exists between the second header entity and the second tail entity. For example, the relationship between the source address and the destination address is the time information 2019.10.19, meaning that the device at the source address launched an attack on the device at the destination address at 2019.10.19.

[0143] Step S304: associate the second head entity and the second tail entity according to the second relationship to construct an MDATA spatiotemporal graph.

[0144] In some embodiments, the second head entity and the second tail entity are associated according to the second relationship, which can be specifically expressed as a triple (second head entity, second relationship, second tail entity). Therefore, by processing all spatiotemporal feature data, multiple second head entities and second tail entities and their second relationships can be obtained, thereby constructing an MDATA spatiotemporal graph.

[0145] In some embodiments, an MDATA graph can also be constructed based on the (head entity, relationship, tail entity, time, space) format of network attack data, and then classified into an MDATA static graph and an MDATA spatiotemporal graph based on static feature data and spatiotemporal feature data. This embodiment does not impose any restrictions on this.

[0146] Reference Figure 4 As shown, in some embodiments of the present application, the above step S102 may also include but is not limited to the following steps S401 to S404.

[0147] Step S401: Input the entities in the MDATA static graph into the preset static embedding model for vector space conversion to obtain a static embedding vector.

[0148] In some embodiments, the MDATA static graph is converted to a preset static embedding model for vector space conversion to obtain a static embedding vector, such as an entity embedding to obtain a corresponding entity vector. Specifically, the static embedding model can be a TransE model, which embeds by defining a transfer relationship between entities and relationships, and the relationship between entities can be realized by vector addition operations. For a triple (head entity, relationship, tail entity), the TransE model can find a vector representation so that the vector of the head entity plus the relationship vector is close to the vector of the tail entity.

[0149] Step S402: Perform loss calculation based on the preset static evaluation vector and static embedding vector to obtain a first loss value.

[0150] In some embodiments, a loss calculation is performed based on a preset static evaluation vector and a static embedding vector to obtain a first loss value, wherein the preset static evaluation vector is the triple data in the training set. Specifically, the TransE model uses an edge loss function to measure whether the triples in the knowledge graph are correctly represented in the vector space. The goal of the edge loss function is to make the correct triples closer in the vector space and the incorrect triples farther away. Commonly used edge loss functions include Hinge loss and negative log-likelihood loss, which are not limited in this embodiment.

[0151] Step S403: Allow the static embedding model to perform a first training process according to the first loss value.

[0152] In some embodiments, the static embedding model performs a first training process based on the first loss value. Specifically, the first training process is to update the static embedding vector using a stochastic gradient descent algorithm, for example, using triples in the training data set to update the vector representations of entities and relationships, so that the marginal loss function is minimized and the first loss value is updated.

[0153] Step S404: until the updated first loss value satisfies the first preset condition, the updated static embedding vector is used as the output of the static embedding model to obtain a first entity vector set.

[0154] In some embodiments, the first training process is repeated until the updated first loss value satisfies a first preset condition. For example, the first preset condition is a preset value or a preset number of training times. Then, when the first loss value is less than the preset value, or the number of training times corresponding to the first loss value reaches the preset number of training times, etc., the corresponding updated static embedding vector is used as the output of the static embedding model, and the vector representation corresponding to the MDATA static graph is obtained. It should be noted that each triple corresponds to a triple vector, and the triple vector includes an entity vector and a relationship vector, wherein the entity vectors constitute a first entity vector set.

[0155] Reference Figure 5 As shown, in some embodiments of the present application, the above step S103 may also include but is not limited to the following steps S501 to S504.

[0156] Step S501: Input the entities in the MDATA spatiotemporal graph into the preset spatiotemporal embedding model for vector space conversion to obtain a spatiotemporal embedding vector.

[0157] In some embodiments, the MDATA spatiotemporal graph is converted to a preset spatiotemporal embedding model for vector space conversion to obtain a spatiotemporal embedding vector, such as an entity embedding to obtain a corresponding entity vector. Specifically, the spatiotemporal embedding model is the same as the static embedding model, which can be a TransE model, which embeds by defining a transfer relationship between entities and relationships, and the relationship between entities can be realized through vector addition operations.

[0158] It can be understood that since both the MDATA static graph and the MDATA spatiotemporal graph contain triplets consisting of a head entity, a relationship, and a tail entity, they meet the basic conditions for embedding and can therefore be embedded through embedding models such as the TransE model or the DistMult model.

[0159] Step S502: performing loss calculation based on the preset spatiotemporal evaluation vector and the spatiotemporal embedding vector to obtain a second loss value.

[0160] In some embodiments, a loss is calculated based on a preset spatiotemporal evaluation vector and a spatiotemporal embedding vector to obtain a second loss value, wherein the preset spatiotemporal evaluation vector is the triple data in the training set. Specifically, the TransE model uses an edge loss function to measure whether the triples in the knowledge graph are correctly represented in the vector space. The goal of the edge loss function is to make the correct triples closer in the vector space and the incorrect triples farther away. Commonly used edge loss functions include Hinge loss and negative log-likelihood loss, which are not limited in this embodiment.

[0161] Step S503: The spatiotemporal embedding model is allowed to perform a second training process according to the second loss value.

[0162] In some embodiments, the spatiotemporal embedding model performs a second training process based on the second loss value. Specifically, the second training process is to update the spatiotemporal embedding vector using a stochastic gradient descent algorithm, for example, using triples in the training data set to update the vector representations of entities and relationships, so that the marginal loss function is minimized and the second loss value is updated.

[0163] Step S504: until the updated second loss value satisfies the second preset condition, the updated spatiotemporal embedding vector is used as the output of the spatiotemporal embedding model to obtain a second entity vector set.

[0164] In some embodiments, the second training process is repeated until the updated second loss value satisfies a second preset condition. For example, the second loss value is less than a preset value, or the number of training times corresponding to the second loss value reaches a preset number of training times, and then the corresponding updated spatiotemporal embedding vector is used as the output of the spatiotemporal embedding model, that is, a vector representation corresponding to the MDATA spatiotemporal graph is obtained, where each triple corresponds to a triple vector, and the entity vectors therein form a second entity vector set.

[0165] Reference Figure 6 As shown, in some embodiments of the present application, the above step S105 may also include but is not limited to the following steps S601 to S602.

[0166] Step S601 : replacing the first head entity evaluation vector according to each static head entity vector and each static tail entity vector in the first entity vector set to obtain a first head entity test set.

[0167] In some embodiments, the first entity vector set includes multiple static embedding vectors, each static embedding vector includes a static head entity vector and a static tail entity vector, the number of static head entity vectors and the number of static tail entities can be the same or different, and the static evaluation vector includes a first head entity evaluation vector, and the first test vector set includes a first head entity test set. Specifically, the first head entity evaluation vector is replaced according to each static head entity vector and each static tail entity vector in the first entity vector set. Exemplarily, assuming that there are 2N static embedding vectors in the first entity vector set, when the number of static head entity vectors and the number of static tail entity vectors are the same, that is, there are N static head entity vectors and N static tail entity vectors, assuming that there are M static evaluation vectors in the evaluation vector set, that is, there are M first head entity evaluation vectors. Each static head entity vector and each static tail entity vector replaces the first head entity evaluation vector, that is, one first head entity evaluation vector corresponds to N+N=2N test vectors after replacement, and finally the 2N*M test vectors obtained by the M first head entity evaluation vectors constitute the first head entity test set.

[0168] In some embodiments, for each of the M static evaluation vectors in the evaluation vector set, the first-head entity test set is divided into M first-head entity test groups, each first-head entity test group corresponds to a static evaluation vector, and each first-head entity test group contains 2N test vectors that replace the first-head entity evaluation vector in the static evaluation vector. That is, the M static evaluation vectors correspond to M first-head entity test groups, and each first-head entity test group contains 2N test vectors.

[0169] Step S602 : replacing the first tail entity evaluation vector according to each static head entity vector and each static tail entity vector in the first entity vector set to obtain a first tail entity test set.

[0170] In some embodiments, the static evaluation vector also includes a first-tail entity evaluation vector, and the first test vector set also includes a first-tail entity test set. Specifically, the first-tail entity evaluation vector is replaced according to each static head entity and each static tail entity vector in the first entity vector set. For example, assuming that there are 2N static embedding vectors in the first entity vector set, when the number of static head entity vectors and the number of static tail entity vectors are the same, that is, there are N static head entity vectors and N static tail entity vectors, assuming that there are M static evaluation vectors in the evaluation vector set, that is, there are M first-tail entity evaluation vectors. Each static head entity vector and each static tail entity vector replaces the first-tail entity evaluation vector, that is, one first-tail entity evaluation vector corresponds to the N+N=2N test vectors after replacement, and finally the 2N*M test vectors obtained by the M first-tail entity evaluation vectors constitute the first-tail entity test set.

[0171] In some embodiments, for each of the M static evaluation vectors in the evaluation vector set, the first-end entity test set is divided into M first-end entity test groups, each first-end entity test group corresponds to a static evaluation vector, and each first-end entity test group contains 2N test vectors that replace the first-end entity evaluation vector in the static evaluation vector. That is, the M static evaluation vectors correspond to M first-end entity test groups, and each first-end entity test group contains 2N test vectors.

[0172] Reference Figure 7 As shown, in some embodiments of the present application, the above step S106 may also include but is not limited to the following steps S701 to S702.

[0173] Step S701 : replacing the second head entity evaluation vector according to each spatiotemporal head entity vector and each spatiotemporal tail entity vector in the second entity vector set to obtain a second head entity test set.

[0174] In some embodiments, the second entity vector set includes a plurality of spatiotemporal embedding vectors, each spatiotemporal embedding vector includes a spatiotemporal head entity vector and a spatiotemporal tail entity vector, the number of spatiotemporal head entity vectors and the number of spatiotemporal tail entities may be the same or different, and the spatiotemporal evaluation vector includes a second head entity evaluation vector, and the second test vector set includes a second head entity test set. Specifically, the second head entity evaluation vector is replaced according to each spatiotemporal head entity vector and each spatiotemporal tail entity vector in the second entity vector set. Exemplarily, assuming that there are 40 spatiotemporal embedding vectors in the second entity vector set, when the number of spatiotemporal head entity vectors and the number of spatiotemporal tail entity vectors are the same, that is, there are 20 spatiotemporal head entity vectors and 20 spatiotemporal tail entity vectors, assuming that there are 10 spatiotemporal evaluation vectors in the evaluation vector set, that is, there are 10 second head entity evaluation vectors. Each spatiotemporal head entity vector and each spatiotemporal tail entity vector replaces the second head entity evaluation vector, that is, one second entity evaluation vector corresponds to 20+20=40 test vectors after replacement, and finally the 10*40=400 test vectors obtained by the 10 second head entity evaluation vectors constitute the second head entity test set.

[0175] In some embodiments, for the 10 spatiotemporal evaluation vectors in the evaluation vector set, the second head entity test set is divided into 10 second head entity test groups, each second head entity test group corresponds to a spatiotemporal evaluation vector, and each second head entity test group has 40 test vectors that replace the second head entity evaluation vector in the spatiotemporal evaluation vector. That is, there are 10 second head entity test groups corresponding to the 10 spatiotemporal evaluation vectors, and each second head entity test group has 40 test vectors.

[0176] Step S702 : replacing the second tail entity evaluation vector according to each spatiotemporal head entity vector and each spatiotemporal tail entity vector in the second entity vector set to obtain a second tail entity test set.

[0177] In some embodiments, the spatiotemporal evaluation vector also includes a second-tail entity evaluation vector, and the second test vector set also includes a second-tail entity test set. Specifically, the second-tail entity evaluation vector is replaced according to each spatiotemporal head entity vector and each spatiotemporal tail entity vector in the second entity vector set. Exemplarily, assuming that there are 40 spatiotemporal embedding vectors in the second entity vector set, when the number of spatiotemporal head entity vectors and the number of spatiotemporal tail entity vectors are the same, that is, there are 20 spatiotemporal head entity vectors and 20 spatiotemporal tail entity vectors, assuming that there are 10 spatiotemporal evaluation vectors in the evaluation vector set, that is, there are 10 second-tail entity evaluation vectors. Each spatiotemporal head entity vector and each spatiotemporal tail entity vector replaces the second-tail entity evaluation vector, that is, one second-tail entity evaluation vector corresponds to 20+20=40 test vectors after replacement, and finally 10 second-tail entity evaluation vectors obtain 10*40=400 test vectors to form the second-tail entity test set.

[0178] In some embodiments, for the 10 spatiotemporal evaluation vectors in the evaluation vector set, the second-tail entity test set is divided into 10 second-tail entity test groups, each second-tail entity test group corresponds to a spatiotemporal evaluation vector, and each second-tail entity test group has 40 test vectors that replace the second-tail entity evaluation vector in the spatiotemporal evaluation vector. That is, the 10 spatiotemporal evaluation vectors correspond to 10 second-tail entity test groups, and each second-tail entity test group has 40 test vectors.

[0179] Reference Figure 8 As shown, in some embodiments of the present application, the above step S107 may also include but is not limited to the following steps S801 to S804.

[0180] Step S801: Perform head entity embedding evaluation on each test vector in the first head entity test set to obtain a first head entity evaluation set.

[0181] In some embodiments, the first evaluation set includes a first head entity evaluation set, and a head entity embedding evaluation is performed on each test vector in the first head entity test set. Specifically, the test vector can be scored by a scoring function corresponding to the embedding model. It is understandable that in the TransE model, Euclidean distance or Manhattan distance is used to measure the similarity between entity and relationship vectors for scoring, and scoring can also be performed by a scoring function, which is not limited in this embodiment.

[0182] In some embodiments, each head entity test group can be scored and sorted through a loop. For example, if there are 10 first head entity test groups in the first head entity test set, the loop is repeated 10 times, scoring and sorting each first head entity test group each time. If there are 20 test vectors in the first head entity test group, there are 20 corresponding scores, which are sorted in descending order according to the scores. After 10 cycles of scoring and sorting, the corresponding first head entity evaluation set is obtained.

[0183] Step S802: Perform tail entity embedding evaluation on each test vector in the first tail entity test set to obtain the first tail entity evaluation set.

[0184] In some embodiments, the first evaluation set includes a first tail entity evaluation set, and each test vector in the first tail entity test set is evaluated for tail entity embedding, specifically scoring the test vector using a scoring function corresponding to the embedding model. It is understood that the scoring method used is the same as that used for the first head entity evaluation set, thereby ensuring a unified standard for scoring and ranking, and ensuring the accuracy of the evaluation results.

[0185] In some embodiments, each tail entity test group is scored and sorted in a loop. For example, if there are 10 first-tail entity test groups in the first-tail entity test set, the loop is repeated 10 times. Each time, one of the first-tail entity test groups is scored and sorted. If there are 20 test vectors in the first-tail entity test group, there are 20 corresponding scores, which are sorted in descending order according to the scores. After 10 cycles of scoring and sorting, the corresponding first-tail entity evaluation set is obtained.

[0186] Step S803: Perform embedded evaluation on the static evaluation vector to obtain static evaluation data.

[0187] In some embodiments, an embedded evaluation is performed on the static evaluation vector, specifically, the static evaluation vector is scored using the same scoring function. It can be understood that the scoring of the static evaluation vector can be performed in a loop with the first head entity test set and the first tail entity test set. When scoring each test vector in the first head entity test group or the first tail entity test group, the corresponding static evaluation vector is also scored to obtain static evaluation data. This embodiment does not impose any restrictions on this.

[0188] Step S804 , obtaining first sorting data according to the sorting order of the static evaluation data in the first head entity evaluation set and the first tail entity evaluation set.

[0189] In some embodiments, a first evaluation set, i.e., first sorted data, can be obtained based on the sorting order of the static evaluation data in the first head entity evaluation set and the first tail entity evaluation set. Specifically, the static evaluation data corresponds to the scoring score of the static evaluation vector, and is combined with the sorting order of the first head entity test group corresponding to the static evaluation data in the first head entity evaluation set and the sorting order of the first tail entity test group corresponding to the static evaluation data in the first tail entity evaluation set to obtain the corresponding first sorted data.

[0190] For example, there are 10 static evaluation vectors, corresponding to 10 first-head entity test groups and 10 first-tail entity test groups, and there are 20 test vectors in each test group. If the sorting order of the third static evaluation vector in the corresponding third-first-head entity test group is 5, and the sorting order in the corresponding third-first-tail entity test group is 3, then the sorting data of the static evaluation vector is (5,3), and the sorting data of the 10 static evaluation vectors are combined to obtain the first sorting data.

[0191] Reference Figure 9 As shown, in some embodiments of the present application, the above step S108 may also include but is not limited to the following steps S901 to S904.

[0192] Step S901 : Perform head entity embedding evaluation on each test vector in the second head entity test set to obtain a second head entity evaluation set.

[0193] In some embodiments, the second evaluation set includes a second head entity evaluation set, and head entity embedding evaluation is performed on each test vector in the second head entity test set. Specifically, the test vectors can be scored using the same scoring function.

[0194] In some embodiments, each head entity test group can be scored and sorted through a loop. For example, if there are 10 second head entity test groups in the second head entity test set, the loop is repeated 10 times. Each time, one of the second head entity test groups is scored and sorted. If there are 20 test vectors in the second head entity test group, there are 20 corresponding scores, and the scores are sorted in descending order. After 10 cycles of scoring and sorting, the corresponding second head entity evaluation set is obtained.

[0195] Step S902 , performing tail entity embedding evaluation on each test vector in the second tail entity test set to obtain a second tail entity evaluation set.

[0196] In some embodiments, the second evaluation set includes a second tail entity evaluation set, and tail entity embedding evaluation is performed on each test vector in the second tail entity test set, specifically, the test vector is scored using the same scoring function.

[0197] In some embodiments, each second-end entity test group is scored and sorted in a loop. For example, if there are 10 second-end entity test groups in the second-end entity test set, the loop is repeated 10 times, scoring and sorting each second-end entity test group. If there are 20 test vectors in the second-end entity test group, there are 20 corresponding scores, and the scores are sorted in descending order. After 10 cycles of scoring and sorting, the corresponding second entity evaluation set is obtained.

[0198] Step S903: perform embedding evaluation on the spatiotemporal evaluation vector to obtain spatiotemporal evaluation data.

[0199] In some embodiments, the spatiotemporal evaluation vector is embedded and evaluated, specifically the spatiotemporal evaluation vector is scored by the same scoring function. It can be understood that the scoring of the spatiotemporal evaluation vector can be performed in a loop with the second entity test set and the second tail entity test set. When scoring each test vector in the second head entity test group or the second tail entity test group, the corresponding spatiotemporal evaluation vector is also scored to obtain spatiotemporal evaluation data. This embodiment does not impose any restrictions on this.

[0200] Step S904 , obtaining second sorting data according to the sorting order of the spatiotemporal evaluation data in the second head entity evaluation set and the second tail entity evaluation set.

[0201] In some embodiments, a second evaluation set, i.e., second sorted data, can be obtained based on the sorting order of the spatiotemporal evaluation data in the second head entity evaluation set and the second tail entity evaluation set. Specifically, the spatiotemporal evaluation data corresponds to the scoring score of the spatiotemporal evaluation vector, and is combined according to the sorting order of the second head entity test group corresponding to the spatiotemporal evaluation data in the second entity evaluation set and the sorting order of the second tail entity test group corresponding to the second tail entity evaluation set to obtain the corresponding first sorted data.

[0202] Exemplarily, there are 10 spatiotemporal evaluation vectors, corresponding to 10 second-head entity test groups and 10 second-tail entity test groups, and there are 20 test vectors in each test group. If the sorting order of the 5th spatiotemporal evaluation vector in the corresponding 5th second-head entity test group is 7, and the sorting order in the corresponding 5th second-tail entity test group is 2, then the sorting data of the spatiotemporal evaluation vector is (7,2), and the sorting data of the 10 spatiotemporal evaluation vectors are combined to obtain the second sorting data.

[0203] Reference Figure 10 As shown, in some embodiments of the present application, the above-mentioned step S109 may include but is not limited to the following steps S1001 to S1002.

[0204] Step S1001 : Associating the first sorting data with the second sorting data according to a preset association weight to obtain total sorting data.

[0205] In some embodiments, the first ranked data corresponding to the first evaluation set and the second ranked data corresponding to the second evaluation set are correlated according to a preset correlation weight to obtain total ranked data. It is understood that the preset correlation weight can be set based on the static data vector and the spatiotemporal data vector, and based on the proportion of entity vectors in the vector, thereby achieving correlation analysis of static features and spatiotemporal features, and this embodiment does not impose any limitation on this.

[0206] It is understood that the evaluation vectors in the evaluation vector set include static evaluation vectors and spatiotemporal evaluation vectors, and therefore there is a one-to-one correspondence between the static evaluation vectors and the spatiotemporal evaluation vectors. Specifically, for each static evaluation vector's first ranking data, the corresponding second ranking data of the spatiotemporal evaluation vector is found. The static data and spatiotemporal data are then associated using the association weights to calculate the total ranking data for the evaluation vector.

[0207] Step S1002: construct target evaluation data based on preset evaluation indicators and total ranking data.

[0208] In some embodiments, evaluation indicators of the embedding effect include but are not limited to MRR, MR and Hits@n. Specifically, the MRR indicator is to average the inverse of the ranking data of each evaluation vector in the evaluation vector set. The larger the value of the MRR indicator, the better the embedding effect. The MR indicator is to average the ranking of the evaluation vectors in the evaluation vector set in the obtained ranking. The smaller the value of the MR indicator, the better the embedding effect. In the Hits@n indicator, n can take values ​​of 1, 3, 5, 10, etc., which means that the proportion of the ranking data of the evaluation vectors in the evaluation vector set in the first n positions is calculated, and then the average value is taken. The larger the value of the Hits@n indicator, the better the embedding effect.

[0209] In some embodiments, target evaluation data can be constructed based on preset evaluation indicators and total ranking data, wherein the target evaluation data represents the embedding effect of the vector space in the MDATA map. The static features and spatiotemporal features in the MDATA map can be correlated and analyzed through the total ranking data, thereby ensuring the accuracy of the embedding evaluation.

[0210] Reference Figure 11 As shown, in some embodiments of the present application, before the above step S901, the following steps S1101 to S1106 may also be included but not limited to.

[0211] Step S1101, obtaining the number of entities in the static feature data to obtain a first entity number.

[0212] In some embodiments, the number of entities in the static feature data is obtained, specifically the number of head entities and tail entities in the static feature data is obtained to obtain a first entity number N1.

[0213] Step S1102: Acquire the number of entities in the spatiotemporal feature data to obtain a second entity number.

[0214] In some embodiments, the number of entities in the spatiotemporal feature data is obtained, specifically the number of head entities and tail entities in the static feature data, that is, the number of source addresses and destination addresses, to obtain the second entity number N2.

[0215] Step S1103: summing the first entity quantity and the second entity quantity to obtain the total entity quantity.

[0216] In some embodiments, the first entity quantity and the second entity quantity are summed, ie, N1+N2, to obtain the total entity quantity.

[0217] Step S1104: taking the ratio between the first entity quantity and the total entity quantity as the first weight.

[0218] In some embodiments, the ratio between the first entity quantity and the total entity quantity is used as the first weight ratio1, so rat io1 = N1 / (N1+N2).

[0219] Step S1105 : Taking the ratio between the second entity quantity and the total entity quantity as the second weight.

[0220] In some embodiments, the ratio between the second entity quantity and the total entity quantity is used as the second weight ratio2, so rat io2 = N2 / (N1+N2).

[0221] Step S1106: construct an association weight based on the first weight and the second weight.

[0222] In some embodiments, an association weight can be constructed based on the first weights rat io1 and rat io2, thereby analyzing and detecting the static features and spatiotemporal features in the MDATA graph based on the association weights, thereby ensuring the accuracy of the embedded evaluation. When applied to the field of network security technology, it can accurately detect and evaluate network attacks and their spatiotemporal changes, and promote the development of the embedding work of existing dynamic knowledge graphs.

[0223] The following is a complete example to illustrate:

[0224] Reference Figure 12The embedding process diagram shown in the figure obtains the target MDATA graph, divides the MDATA static graph according to the static feature data, and divides the MDATA spatiotemporal graph according to the spatiotemporal feature data. Then, according to the preset static embedding model, the MDATA static graph is embedded in the preset vector space to obtain a static embedding vector, and according to the preset spatiotemporal embedding model, the MDATA spatiotemporal graph is embedded in the preset vector space to obtain a spatiotemporal embedding vector. Finally, according to the static embedding vector, a first entity vector set including a static head entity vector and a static tail entity vector is obtained, and according to the spatiotemporal embedding vector, a second entity vector set including a spatiotemporal head entity vector and a spatiotemporal tail entity vector is obtained.

[0225] Reference Figure 13 The embedding evaluation replacement scoring diagram shown in the figure assumes that the first entity vector set includes at least three static embedding vectors, such as E = {1:E1, 2:E2, 3:E3, ...}, where 1:E1 indicates that the static embedding vector corresponding to the entity numbered 1 is E1. Each static embedding vector includes a static head entity vector and a static tail entity vector. Assuming that the number of static head entity vectors is the same as the number of static tail entity vectors, for example, E1 = (E11, E12), where E11 represents the static head entity vector of the static embedding vector E1, and E12 represents the static tail entity vector of the static embedding vector E1, that is, E2 = (E21, E22), and E3 = (E31, E32). Similarly, the second entity vector set includes at least three spatiotemporal embedding vectors, assuming that the number of temporal head entity vectors is the same as the number of spatiotemporal tail entity vectors, such as T = {1:T1, 2:T2, 3:T3, ...}, T1 = (T11, T12), T2 = (T21, T22), T3 = (T31, T32). The evaluation vector set includes at least two evaluation vectors, each of which can be divided into a static evaluation vector and a spatiotemporal evaluation vector. Specifically, (m1, m2, m3) in the evaluation vector (m1, m2, m3, m4, m5, m6) represents a static evaluation vector, m1 represents the first head entity evaluation vector, m3 represents the first tail entity evaluation vector, and m2 represents the relationship vector between m1 and m3. In addition, (m4, m5, m6) in the evaluation vector (m1, m2, m3, m4, m5, m6) represents the corresponding spatiotemporal evaluation vector, m5 represents the time vector, m4 represents the source address vector, and m6 represents the destination address vector, where m4 corresponds to the second head entity evaluation vector and m6 corresponds to the second tail entity evaluation vector. This embodiment does not impose any restrictions on this.

[0226] In some embodiments, the static evaluation vector is replaced according to the first entity vector set to obtain a first test vector set. Specifically, the first head entity evaluation vector (m1, m7...) is replaced according to each static head entity vector (E11, E21 and E31, etc.) and each static tail entity vector (E12, E22 and E32, etc.) in the first entity vector set E to obtain a first head entity test set, and then the first tail entity evaluation vector (m3, m9...) is replaced according to each static head entity vector (E11, E21 and E31, etc.) and each static tail entity vector (E12, E22 and E32, etc.) in the first entity vector set E to obtain a first tail entity test set, thereby obtaining a first test vector set. It can be understood that, with reference to Figure 13 As shown, at the same time, the second entity vector set performs the same replacement operation, replacing the second head entity evaluation vector and the second tail entity evaluation vector in the spatiotemporal evaluation vector to obtain the second test vector set.

[0227] Depend on Figure 13It can be seen that when scoring and evaluating the first-head entity test set and the second entity test set obtained after replacement, each test vector in a first-head entity test group can be scored in one cycle, and the corresponding evaluation vector can be scored. The various scoring scores obtained can be sorted, and the sorting data corresponding to the evaluation vector can be obtained, so as to calculate the embedded evaluation effect according to the preset association weights and evaluation indicators. For example, when scoring the first head entity test group in the first head entity test set, that is, scoring (E11, m2, m3), (E21, m2, m3), (E31, m2, m3), (E12, m2, m3), (E22, m2, m3), (E32, m2, m3), etc., and scoring the corresponding evaluation vectors (m1, m2, m3), sorting the scores, and obtaining the sorting order R_h1 of (m1, m2, m3) in the first head entity test set. Combined with the sorting order R_t1 of scoring the first tail entity test group in the first tail entity test set, the first ranking data RANK1 of (m1, m2, m3) can be obtained. The same processing is performed on the spatiotemporal evaluation vector to obtain the corresponding second ranking data RANK2 of (m4, m5, m6). Based on the first ranking data and the second ranking data and the associated weights rat io1 and ratio2, the static features and spatiotemporal features are combined for analysis and evaluation. Specifically, RANK=rat io1*RANK1+rat io2*RANK2, where RANK1 includes R_h1 and R_t1, and RANK2 includes R_h2 and R_t2. Rh1 represents the sorting order of (m1, m2, m3) in the first head entity test set, R_t1 represents the sorting order of (m1, m2, m3) in the first tail entity test set, R_h2 represents the sorting order of (m4, m5, m6) in the second head entity test set, and R_t2 represents the sorting order of (m4, m5, m6) in the second tail entity test set. The evaluation index of the evaluation vector (m1, m2, m3, m4, m5, m6) can be calculated. The specific index calculation is as follows:

[0228]

[0229]

[0230]

[0231] The embodiment of the present invention also provides an evaluation device for MDATA graph embedding, which can implement the above-mentioned evaluation method for MDATA graph embedding, referring to Figure 14 As shown, in some embodiments of the present application, the device includes:

[0232] The first acquisition module 100 is used to acquire a target MDATA map; wherein the target MDATA map includes: an MDATA static map and an MDATA spatiotemporal map, wherein the MDATA static map is constructed by static feature data in the network monitoring data, and the MDATA spatiotemporal map is constructed by spatiotemporal feature data in the network monitoring data;

[0233] The first embedding module 200 embeds entities in the MDATA static graph into a preset vector space to obtain a first entity vector set;

[0234] The second embedding module 300 embeds the entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set;

[0235] The second acquisition module 400 is used to acquire an evaluation vector set; wherein the evaluation vector set includes: a static evaluation vector and a spatiotemporal evaluation vector;

[0236] A first replacement module 500 is configured to replace the static evaluation vector according to the first entity vector set to obtain a first test vector set;

[0237] A second replacement module 600 is configured to replace the spatiotemporal evaluation vectors according to the second entity vector set to obtain a second test vector set;

[0238] A first evaluation module 700 is configured to perform an embedding evaluation process on each test vector in the first test vector set according to the static evaluation vector to obtain a first evaluation set;

[0239] A second evaluation module 800 is configured to perform an embedding evaluation process on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain a second evaluation set;

[0240] The embedding evaluation module 900 is used to construct target evaluation data based on the first evaluation set and the second evaluation set; wherein the target evaluation data represents the embedding effect of the vector space in the MDATA graph.

[0241] The specific implementation of the MDATA graph embedding evaluation device of this embodiment is basically consistent with the specific implementation of the above-mentioned MDATA graph embedding evaluation method, and will not be repeated here.

[0242] Figure 15 An electronic device 1000 provided in an embodiment of the present application is shown. The electronic device 1000 includes: a processor 1001, a memory 1002, and a computer program stored in the memory 1002 and executable on the processor 1001. When the computer program is executed, it is used to execute the above-mentioned MDATA graph embedding evaluation method.

[0243] The processor 1001 and the memory 1002 may be connected via a bus or other means.

[0244] Memory 1002, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs, such as the MDATA graph embedding evaluation method described in the embodiments of the present application. Processor 1001 implements the above-mentioned MDATA graph embedding evaluation method by running the non-transitory software program and instructions stored in memory 1002.

[0245] The memory 1002 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store an evaluation method for executing the above-mentioned MDATA map embedding. In addition, the memory 1002 may include a high-speed random access memory 1002, and may also include a non-volatile memory 1002, such as at least one storage device memory device, a flash memory device or other non-volatile solid-state memory device. In some embodiments, the memory 1002 may optionally include a memory 1002 remotely located relative to the processor 1001, and these remote memories 1002 may be connected to the electronic device 1000 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0246] The non-transient software program and instructions required to implement the above-mentioned MDATA map embedding evaluation method are stored in the memory 1002. When executed by one or more processors 1001, the above-mentioned MDATA map embedding evaluation method is executed, for example, Figure 1 Steps S101 to S109 of the method, execution Figure 2 Steps S201 to S203 of the method, Figure 3 Steps S301 to S304 of the method, Figure 4 Steps S401 to S404 of the method, Figure 5 Steps S501 to S504 of the method, Figure 6 Steps S601 to S602 of the method, Figure 7 Steps S701 to S702 of the method, Figure 8 Steps S801 to S804 of the method, Figure 9 Steps S901 to S904 of the method, Figure 10 Steps S1001 to S1002 of the method, Figure 11 Method steps S1101 to S1106.

[0247] The embodiment of the present application also provides a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, which implements the above-mentioned MDATA map embedding evaluation method when the computer program is executed by the processor. The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory optionally includes a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0248] The evaluation method and related device for MDATA graph embedding provided in the embodiment of the present application accurately evaluate the embedding effect of the vector space in the MDATA graph by associating static data and corresponding spatiotemporal data, which solves the deficiency of the embedding evaluation method in the related art when applied to the dynamic knowledge graph without considering the influence of timeliness and spatial transfer on authenticity. It realizes the association evaluation of dynamic knowledge on the basis of effectively expressing the highly evolved spatiotemporal characteristics, and obtains more accurate evaluation results by designing association weights. And when applied to the field of network security technology, it can accurately evaluate the spatiotemporal change impact of network attacks, thereby maximally evaluating the time when the attack occurs and the change of the IP address, so that the embedding model is further optimized and promotes the development of the embedding work of existing dynamic knowledge graphs. The evaluation method of this embodiment is also widely applicable to various static knowledge graph embedding methods, and can be applied to other dynamic scenarios by adjusting the weights.

[0249] The embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0250] Those skilled in the art will appreciate that all or some of the steps and systems in the method disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include computer storage media (or non-transitory media) and communication media (or temporary media). As known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical disk storage, magnetic cassettes, magnetic tapes, storage device storage, or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically includes computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0251] It should also be understood that the various implementations provided in the embodiments of this application can be arbitrarily combined to achieve different technical effects. The above is a specific description of the preferred implementation of this application, but this application is not limited to the above implementation. Those skilled in the art can also make various equivalent modifications or substitutions under the conditions that do not violate the spirit of this application.

Claims

1. A method for evaluating MDATA graph embedding, characterized in that: The evaluation method includes: Obtain network monitoring data at each time point, extract network attack data from the network monitoring data, construct an MDATA static graph based on the static feature data, and construct a target MDATA spatiotemporal graph based on the spatiotemporal feature data, wherein the network attack data includes: static feature data and spatiotemporal feature data, and the target MDATA graph includes: an MDATA static graph and an MDATA spatiotemporal graph, wherein the MDATA static graph is constructed by the static feature data in the network monitoring data, and the MDATA spatiotemporal graph is constructed by the spatiotemporal feature data in the network monitoring data; Embed the entities in the MDATA static graph into a preset vector space to obtain a first entity vector set; Embed the entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set; Acquire an evaluation vector set; wherein the evaluation vector set includes: a static evaluation vector and a spatiotemporal evaluation vector; Replacing the static evaluation vector according to the first entity vector set to obtain a first test vector set; Replacing the spatiotemporal evaluation vectors according to the second entity vector set to obtain a second test vector set; Performing embedding evaluation processing on each test vector in the first test vector set according to the static evaluation vector to obtain a first evaluation set, wherein the first evaluation set includes a first head entity evaluation set and a first tail entity evaluation set; Performing embedding evaluation processing on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain a second evaluation set, where the second evaluation set includes a second head entity evaluation set and a second tail entity evaluation set; Perform embedding evaluation on the static evaluation vector to obtain static evaluation data, obtain first ranking data according to the sorting order of the static evaluation data in the first head entity evaluation set and the first tail entity evaluation set, perform embedding evaluation on the spatiotemporal evaluation vector to obtain spatiotemporal evaluation data, obtain second ranking data according to the sorting order of the spatiotemporal evaluation data in the second head entity evaluation set and the second tail entity evaluation set, the first evaluation set is the first ranking data, the second evaluation set is the second ranking data, and the first ranking data and the second ranking data are associated with each other according to the preset association weight to obtain total ranking data; wherein, the static evaluation vector corresponds to the spatiotemporal evaluation vector one-to-one, and the association processing includes: for each of the first ranking data of the static evaluation vector and the second ranking data of the corresponding spatiotemporal evaluation vector, calculate the total ranking data through the association weight, and construct target evaluation data according to the preset evaluation index and the total ranking data, wherein the target evaluation data characterizes the embedding effect of the vector space in the MDATA graph.

2. The evaluation method for MDATA graph embedding according to claim 1, characterized in that: The static feature data includes a head entity, a relationship, and a tail entity, and the spatiotemporal feature data includes a source address, time information, and a destination address; constructing the MDATA static graph based on the static feature data and constructing the MDATA spatiotemporal graph based on the spatiotemporal feature data include: The head entity is taken as the first head entity, the relationship is taken as the first relationship, and the tail entity is taken as the first tail entity; Associating the first head entity and the first tail entity according to the first relationship to construct the MDATA static graph; The source address is used as a second header entity, the time information is used as a second relationship, and the destination address is used as a second tail entity; The second head entity and the second tail entity are associated according to the second relationship to construct the MDATA spatiotemporal graph.

3. The evaluation method for MDATA graph embedding according to claim 1, characterized in that: The embedding of entities in the MDATA static graph into a preset vector space to obtain a first entity vector set includes: Input the entities in the MDATA static graph into a preset static embedding model for vector space conversion to obtain a static embedding vector; Performing loss calculation based on a preset static evaluation vector and the static embedding vector to obtain a first loss value; Allowing the static embedding model to perform a first training process according to the first loss value; wherein the first training process is to update the static embedding vector using a stochastic gradient descent algorithm and update the first loss value; Until the updated first loss value satisfies a first preset condition, the updated static embedding vector is used as the output of the static embedding model to obtain the first entity vector set.

4. The evaluation method for MDATA graph embedding according to claim 1, characterized in that: The embedding of entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set includes: Input the entities in the MDATA spatiotemporal graph into a preset spatiotemporal embedding model for vector space conversion to obtain a spatiotemporal embedding vector; Performing loss calculation based on the preset spatiotemporal evaluation vector and the spatiotemporal embedding vector to obtain a second loss value; Allowing the spatiotemporal embedding model to perform a second training process according to the second loss value; wherein the second training process is to update the spatiotemporal embedding vector using a stochastic gradient descent algorithm and update the second loss value; Until the updated second loss value satisfies a second preset condition, the updated spatiotemporal embedding vector is used as the output of the spatiotemporal embedding model to obtain the second entity vector set.

5. The evaluation method for MDATA graph embedding according to claim 1, characterized in that: The first entity vector set includes a plurality of static embedding vectors, the static embedding vectors include a static head entity vector and a static tail entity vector, the static evaluation vector includes a first head entity evaluation vector and a first tail entity evaluation vector, and the first test vector set includes a first head entity test set and a first tail entity test set; The replacing the static evaluation vector according to the first entity vector set to obtain a first test vector set includes: replacing the first head entity evaluation vector according to each of the static head entity vectors and each of the static tail entity vectors in the first entity vector set to obtain the first head entity test set; The first tail entity evaluation vector is replaced according to each of the static head entity vectors and each of the static tail entity vectors in the first entity vector set to obtain the first tail entity test set.

6. The evaluation method for MDATA graph embedding according to claim 1, characterized in that: The second entity vector set includes a plurality of spatiotemporal embedding vectors, the spatiotemporal embedding vectors include a spatiotemporal head entity vector and a spatiotemporal tail entity vector, the spatiotemporal evaluation vector includes a second head entity evaluation vector and a second tail entity evaluation vector, and the second test vector set includes a second head entity test set and a second tail entity test set; The replacing the spatiotemporal evaluation vector according to the second entity vector set to obtain a second test vector set includes: Replace the second head entity evaluation vector according to each of the spatiotemporal head entity vectors and each of the spatiotemporal tail entity vectors in the second entity vector set to obtain the second head entity test set; The second tail entity evaluation vector is replaced according to each of the spatiotemporal head entity vectors and each of the spatiotemporal tail entity vectors in the second entity vector set to obtain the second tail entity test set.

7. The evaluation method for MDATA graph embedding according to claim 5, characterized in that: The step of performing embedded evaluation processing on each test vector in the first test vector set according to the static evaluation vector to obtain a first evaluation set includes: Performing head entity embedding evaluation on each test vector in the first head entity test set to obtain the first head entity evaluation set; Perform tail entity embedding evaluation on each of the test vectors in the first tail entity test set to obtain the first tail entity evaluation set.

8. The method for evaluating MDATA graph embedding according to claim 6, wherein: The step of performing embedding evaluation processing on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain a second evaluation set includes: Performing head entity embedding evaluation on each test vector in the second head entity test set to obtain the second head entity evaluation set; Perform tail entity embedding evaluation on each of the test vectors in the second tail entity test set to obtain the second tail entity evaluation set.

9. The evaluation method for MDATA graph embedding according to claim 1, characterized in that: Before associating the first sorting data with the second sorting data according to the preset association weight to obtain the total sorting data, the evaluation method further includes: The association weight is preset, specifically including: Obtaining the number of entities in the static feature data to obtain a first entity number; Obtaining the number of entities in the spatiotemporal feature data to obtain a second entity number; Summing the first entity quantity and the second entity quantity to obtain a total entity quantity; using a ratio between the first entity quantity and the total entity quantity as a first weight; using a ratio between the second entity quantity and the total entity quantity as a second weight; The association weight is constructed according to the first weight and the second weight.

10. An evaluation device for MDATA graph embedding, characterized in that: The method for evaluating MDATA graph embedding according to any one of claims 1 to 9 comprises: The first acquisition module is used to acquire the network monitoring data at each time point, extract the network attack data from the network monitoring data, construct the MDATA static graph according to the static feature data, and construct the target MDATA spatiotemporal graph according to the spatiotemporal feature data, wherein the network attack data includes: static feature data and spatiotemporal feature data, wherein the target MDATA graph includes: MDATA static graph and MDATA spatiotemporal graph, the MDATA static graph is constructed by the static feature data in the network monitoring data, and the MDATA spatiotemporal graph is constructed by the spatiotemporal feature data in the network monitoring data; A first embedding module embeds entities in the MDATA static graph into a preset vector space to obtain a first entity vector set; A second embedding module embeds entities in the MDATA spatiotemporal graph into the vector space to obtain a second entity vector set; A second acquisition module is used to acquire an evaluation vector set; wherein the evaluation vector set includes: a static evaluation vector and a spatiotemporal evaluation vector; A first replacement module, configured to replace the static evaluation vector according to the first entity vector set to obtain a first test vector set; A second replacement module, configured to replace the spatiotemporal evaluation vector according to the second entity vector set to obtain a second test vector set; a first evaluation module, configured to perform an embedding evaluation process on each test vector in the first test vector set according to the static evaluation vector to obtain a first evaluation set, wherein the first evaluation set includes a first head entity evaluation set and a first tail entity evaluation set; a second evaluation module, configured to perform embedding evaluation processing on each test vector in the second test vector set according to the spatiotemporal evaluation vector to obtain a second evaluation set, where the second evaluation set includes a second head entity evaluation set and a second tail entity evaluation set; An embedding evaluation module is used to perform embedding evaluation on the static evaluation vector to obtain static evaluation data, obtain first ranking data based on the sorting order of the static evaluation data in the first head entity evaluation set and the first tail entity evaluation set, perform embedding evaluation on the spatiotemporal evaluation vector to obtain spatiotemporal evaluation data, obtain second ranking data based on the sorting order of the spatiotemporal evaluation data in the second head entity evaluation set and the second tail entity evaluation set, the first evaluation set is the first ranking data, the second evaluation set is the second ranking data, and the first ranking data and the second ranking data are associated with each other according to a preset association weight to obtain total ranking data; wherein, the static evaluation vector corresponds one-to-one to the spatiotemporal evaluation vector, and the association processing includes: for each of the first ranking data of the static evaluation vector and the second ranking data of the corresponding spatiotemporal evaluation vector, the total ranking data is calculated using the association weight, and target evaluation data is constructed according to the preset evaluation index and the total ranking data; wherein, the target evaluation data characterizes the embedding effect of the vector space in the MDATA graph.

11. An electronic device, characterized in that: It includes a memory and a processor, the memory stores a computer program, and the processor implements the MDATA graph embedding evaluation method as described in any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium, characterized in that The storage medium stores a program, and the program is executed by a processor to implement the evaluation method of MDATA graph embedding as described in any one of claims 1 to 9.

Images