A method for constructing a smart grid network security knowledge graph

Abstract

The application discloses a kind of construction methods of smart grid network security knowledge graph, first, data is crawled, including structured data, semi-structured data and unstructured data;Ontology model is built, by analyzing the information type contained in structured data, in combination with existing ontology model and expert experience, the initial mode layer of knowledge graph is constructed from top to bottom;Then, according to the characteristics of different semi-structured and unstructured texts, the knowledge extraction method based on rules or deep learning is used to complete data annotation, entity extraction and relationship construction;Then, after knowledge fusion, the data layer is constructed under the guidance of the initial mode layer;After that, knowledge update, including mode layer update and data layer update.The application is trained on small-scale mixed language data set manually annotated, and the performance is better than the benchmark model, realizes the entity extraction of power grid network security text, so as to serve the construction of knowledge graph.

Description

Technical Field

[0001] This invention belongs to the field of smart grid technology in power technology, and specifically relates to a method for constructing a smart grid network security knowledge graph. Background Technology

[0002] While modern information and communication technologies bring convenience to the intelligent development of power grids, they also bring cybersecurity risks. To effectively respond to and prevent the damage and impact that cyberattacks may cause, it is essential to fully explore the cybersecurity vulnerabilities existing in the power system and identify the attack methods that cyber attackers may employ. However, cybersecurity knowledge in the power sector is often found in vulnerability databases, security knowledge bases, and technical forums related to Industrial Control Systems (ICS), resulting in fragmented sources, significant structural differences, and a mix of Chinese and English. Therefore, it is urgent to use intelligent technologies to extract and refine cybersecurity knowledge related to the power system from massive amounts of multi-source heterogeneous data and organize this knowledge into a structured and visualized presentation.

[0003] Knowledge graphs, proposed by Google, are a knowledge representation method that can represent entities and their relationships in the real world in the form of a graph. By integrating and extracting knowledge from multi-source heterogeneous data, knowledge graphs contain richer semantic association information between entities and are often used in the construction of knowledge bases.

[0004] Knowledge graphs have been widely used in finance, healthcare, and other fields, and their application in the power sector has also been explored extensively. Currently, researchers mainly use knowledge graph technology as a knowledge management method, applying it to the health management of power equipment, fault location in power systems, and heterogeneous data management in power systems (see reference: Ye Xinzhi, Shang Lei, Dong Xuzhu, et al. Research and application of knowledge graphs for distribution network fault handling [J]. Power System Technology, 2022, 46(10):3739-3749). However, there is still no research on knowledge graph construction methods for smart grid network security.

[0005] Existing knowledge graph construction schemes typically include schema layer construction and data layer construction. The data layer is constructed through three stages: knowledge extraction, knowledge fusion, and knowledge updating. The knowledge extraction stage further includes entity extraction, relation extraction, and attribute extraction. Entity extraction and attribute extraction can both be implemented using Named Entity Recognition (NER) algorithms. Existing NER algorithms have undergone three stages of development: dictionary- and rule-based methods, machine learning-based methods, and deep learning-based methods. Since the advent of the BERT pre-trained model, the benchmark model for NER tasks has evolved from BiLSTM-CRF to the BERT-BiLSTM-CRF three-layer model.

[0006] BERT is a language representation model based on the Transformer architecture, capable of generating embeddings for each word in a text based on contextual semantic information. BERT perfectly replaces the previous Word2vec model, serving as the embedding layer in a NER model to generate a sequence of word vectors for the input text. A Bi-direction Long Short-Term Memory (BiLSTM) network can simultaneously capture both forward and backward information of the sequence, thereby learning contextual semantics. After inputting the word vector sequence, the BiLSTM layer outputs the score probability of each word corresponding to each label. A Conditional Random Field (CRF) layer learns the dependencies between labels, constrains the label classification of each word, and corrects the output of the BiLSTM layer, thus ensuring the reasonableness of the predicted labels.

[0007] However, the BERT-BiLSTM-CRF model cannot solve the problem of small dataset size in NER tasks due to high data annotation costs; the BERT-BiLSTM-CRF model is only applicable to specific languages ​​and cannot handle multilingual mixed text.

[0008] Purpose of the invention

[0009] The purpose of this invention is to address the shortcomings of existing technologies by proposing a method for constructing a knowledge graph for smart grid network security, solving the problem of multilingual entity extraction with limited labeled data, and providing strong support for identifying network security risks in power systems. Summary of the Invention

[0010] This invention provides a method for constructing a knowledge graph for smart grid network security, comprising the following steps:

[0011] Step 1: Crawl data, including structured data, semi-structured data, and unstructured data; Build an ontology model by analyzing the types of information contained in the structured data, and combining existing ontology models and expert experience to build the initial schema layer of the knowledge graph from top to bottom.

[0012] Step 2: Based on the characteristics of different semi-structured and unstructured texts, adopt rule-based or deep learning-based knowledge extraction methods to complete data annotation, entity extraction, and relation construction;

[0013] Step 3: After knowledge integration, construct the data layer under the guidance of the initial schema layer.

[0014] Preferably, when constructing the ontology model, the ontology is divided into cybersecurity domain ontology and power domain ontology, and a smart grid cybersecurity knowledge graph ontology model is constructed using a "seven-step method".

[0015] Preferably, in step 2, a rule-based knowledge extraction method is used to process semi-structured data, and a deep learning method is used to process unstructured data. A five-layer architecture DA-XLMR-BiLSTM-FC-CRF model is constructed, which includes five parts: a data augmentation DA layer, an XLMR layer, a BiLSTM layer, a feature concatenation FC layer, and a CRF layer.

[0016] Preferably, in the data augmentation (DA) layer, the data augmentation method is divided into a training phase and a generation phase. In the training phase, label information is inserted before and after entity words to mark their position and type. Then, a full-word masking strategy is used to randomly mask entity words, which are then fed into a pre-trained masked language model (MLM) for fine-tuning. The fine-tuned MLM model can predict entity words that conform to the context.

[0017] In the generation phase, the original tagged corpus undergoes the same label insertion and random masking process as in the training phase, and is then fed into the fine-tuned MLM model to obtain sentences with replaced entity words. After script processing, these enhanced sentences are transformed into tagged corpus with the same structure as the original corpus. Finally, the original corpus and the enhanced corpus are mixed and used for training the overall model.

[0018] Optionally, the data augmentation algorithm used is replaced with a synonym replacement, a tagged word replacement, or an untagged word replacement algorithm.

[0019] Preferably, the text input to the XLMR layer is first processed by a tokenizer tool for word segmentation. After the text is divided into sub-tokens, special symbols are added to identify the beginning and end of the sentence. <s> "and"< / s>Then, through dictionary mapping, a sub-word token sequence T is formed; after that, the XLMR model embeds each sub-word token in the sequence T to obtain a word vector sequence E = {E1, E2, E3, ..., En}; where Ei is the vector representation corresponding to the i-th sub-word token, and each word vector has a dimension of 768.

[0020] Preferably, after the word vector sequence E is input into the BiLSTM layer, the forward LSTM obtains the hidden vector sequence h. L ={h L1 ,h L2 ,h L3 ,…,h Ln The backward LSTM yields the hidden vector sequence h. R ={h R1 ,h R2 ,h R3 ,…,h Rn}, finally h L and h R The hidden layer sequence is obtained by concatenating vectors {[h] L1 ,h R1 ],[h L2 ,h R2 ],[h L3 ,h R3 ],…,[h Ln h Rn ]}, that is, the output of the BiLSTM layer is h={h1,h2,h3,…,hn}.

[0021] Preferably, the feature concatenation FC layer performs a feature concatenation operation on the output E of the XLMR layer and the output h of the BiLSTM layer to obtain the output vector sequence H = {[E1,h1],[E2,h2],[E3,h3],…,[E...}. n ,h n Afterwards, it is transformed into a score sequence P = {P1, P2, P3, ..., P} through a fully connected layer. n}, where P i The dimension is equal to the number of entity label types, P ij This represents the score at which the i-th sub-word "token" is classified as the j-th type of entity tag.

[0022] Preferably, the score sequence P is used as the emission score input to the CRF layer, and the CRF layer is trained to generate a transition matrix M, with matrix elements M... ij This represents the transition score when the previous label type is i and the current label type is j. The CRF layer calculates the loss function using the emission score and the transition score, thereby continuously updating the transition matrix M. Finally, the CRF layer uses the Viterbi algorithm to solve for the optimal entity label sequence O = {O1, O2, O3, ..., O...}.n}, where O i This indicates the entity tag type of the i-th sub-word token.

[0023] Preferably, during knowledge fusion, the text coreference problem is resolved, including two aspects: the presence of mixed abbreviations and capitalization, and inconsistencies in expression from different data sources. The mixed abbreviations and capitalization occur in entities of the "company" class. This is resolved by constructing an electrical enterprise dictionary and performing dictionary matching on entities of the "company" class. Inconsistencies in expression are manifested in CAPEC attack type enumeration and ATT&CK attack techniques. This is resolved by using the SBERT algorithm to calculate the similarity of attack description text, thereby merging attack methods with similar expression.

[0024] Preferably, after constructing the data layer, knowledge updates are also required, including updates to the schema layer and the data layer. Incremental updates are used to reduce resource consumption. The schema layer is updated manually, adding new entity types that appear in the new data to the schema layer and setting their relationships with existing entity types. The data layer is updated under the guidance of the schema layer, using the original knowledge extraction methods to process the new data, and then adding the entities and relationships to the knowledge graph. Attached Figure Description

[0025] Figure 1 This is a flowchart of the method for constructing a smart grid network security knowledge graph as described in this invention.

[0026] Figure 2 This is a schematic diagram of the structure of the DA-XLMR-BiLSTM-FC-CRF model based on a five-layer architecture.

[0027] Figure 3 This is a schematic diagram of the knowledge extraction method of the present invention. Detailed Implementation

[0028] The present invention will be further described below with reference to the accompanying drawings and examples. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0029] Those skilled in the art will understand that the step numbers used herein are for ease of description only and are not intended to limit the order in which the steps are performed. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” may include the plural forms unless the context clearly indicates otherwise. The term “and / or” refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. In the description of this invention, “a plurality” means at least two, such as two, three, etc., unless otherwise expressly specified.

[0030] Example

[0031] This embodiment adopts a top-down approach to construct a smart grid network security knowledge graph. The construction process is as follows: Figure 1 As shown, firstly, by analyzing the information types contained in structured data, and combining existing ontology models and expert experience, an initial schema layer of the knowledge graph is constructed from top to bottom. Then, based on the characteristics of different semi-structured and unstructured texts, rule-based or deep learning-based knowledge extraction methods are used to extract entities and relationships. After knowledge fusion, a data layer is constructed under the guidance of the schema layer.

[0032] The schema layer is the knowledge organization architecture of the knowledge graph. The smart grid network security knowledge graph constructed by this invention can be regarded as a fusion of the network security knowledge graph and the power system knowledge graph. Therefore, when constructing the ontology model, the ontology is also divided into network security domain ontology and power domain ontology. The final smart grid network security knowledge graph ontology model was constructed using the "seven-step method".

[0033] The data layer comprises the knowledge topics of the knowledge graph. In this embodiment, it is completed through three steps: knowledge extraction, knowledge fusion, and knowledge updating. Specifically, the knowledge extraction stage uses knowledge extraction methods to obtain entities and relationships between entities from the original text; the knowledge fusion stage performs entity disambiguation on the extracted knowledge; and the knowledge updating stage continuously updates and corrects the knowledge graph content during application.

[0034] Here, we need to explain the following seven concepts:

[0035] 1. BERT is a language representation model based on the transformer architecture. It is pre-trained on large-scale unlabeled data through the Masked Language Model (MLM) task and the Next Sentence Prediction (NSP) task. The BERT model can fully integrate contextual semantic information to generate embeddings for each word in the text. Therefore, BERT perfectly replaces the previous Word2vec model as the embedding layer of the NER model to generate word vectors for the input text.

[0036] 2. Long Short-Term Memory (LSTM) networks are a special type of Recurrent Neural Network (RNN). They address the vanishing and exploding gradient problems encountered during RNN training by introducing memory units and a threshold mechanism. While unidirectional LSTM models can only capture information passed from front to back, bidirectional networks can capture both forward and backward information simultaneously, enabling a more comprehensive utilization of textual information. After word vectors are input into the Bi-LSTM layer, the network learns contextual information and outputs the score probability of each word corresponding to each label.

[0037] 3. Conditional Random Fields (CRFs) can solve for the conditional probability distribution of the output sequence given an input sequence and are widely used in sequence labeling tasks. The score probability output by the BiLSTM layer only considers the context of words but not the constraints between labels. NER is a joint labeling task where labels are dependent on each other. Taking the BIO labeling strategy as an example, the preceding label of a word labeled "IX" can be "BX" or "IX", but not "O". The main role of the CRF layer is to learn the order dependency information between labels, further constrain the label classification of each word, and correct the output of the BiLSTM layer, thereby ensuring the reasonableness of the predicted labels.

[0038] 4. Facebook's XLM model overcomes the challenge of information incompatibility between languages ​​in the BERT model. The XLM model uses byte-pair encoding (BPE) for its input to increase the vocabulary shared across languages ​​and proposes two unsupervised training objectives that only require monolingual corpora: the Causal Language Model (CLM) task and an improved MLM task, both of which provide strong cross-lingual capabilities. Furthermore, the XLM model proposes a supervised training objective using parallel corpora, namely the Translation Language Model (TLM) task, which can further enhance the model's training performance on cross-lingual data.

[0039] 5. The RoBERTa model is a powerfully optimized BERT model. It modifies the static mask of the MLM task to a dynamic mask task, eliminates the NSP task, increases the training data scale, and uses a larger batch size and learning rate for training, achieving more refined tuning. Furthermore, by introducing adversarial training during the pre-training phase, the RoBERTa model has stronger robustness and can handle more complex inputs.

[0040] 6. The XLM-RoBERTa model (XLMR) is an efficient and scalable cross-lingual pre-trained model proposed by Facebook. It adopts a Transformer architecture similar to the RoBERTa model and uses the MLM and TLM training methods of the XLM model, while further expanding the number and scale of languages ​​in the training data. Specifically, the XLMR model uses a pre-processed CommonCrawl dataset of over 2TB and is pre-trained on 100 languages, enabling it to achieve state-of-the-art results on various natural language processing (NLP) tasks.

[0041] 7. NER tasks require word-level labeled data, which incurs higher data annotation costs compared to NLP tasks such as text classification, making them more prone to resource shortages. Data augmentation (DA) techniques effectively alleviate the data shortage problem in deep learning and are widely used in computer vision, later extending to NLP and achieving good results on many tasks.

[0042] The method described in this embodiment is explained in detail below:

[0043] Step 1: Knowledge Extraction

[0044] This embodiment employs a rule-based knowledge extraction method to process semi-structured data and a deep learning method to process unstructured data, proposing a five-layer architecture-based DA-XLMR-BiLSTM-FC-CRF model. The model structure is as follows: Figure 2 As shown, it is mainly divided into 5 parts: data augmentation layer, XLMR layer, BiLSTM layer, feature concatenation layer, and CRF layer.

[0045] Data augmentation (DA) techniques can effectively alleviate the problem of insufficient data in deep learning by generating task-relevant data. This invention utilizes a MELM method improved by a full-word masking strategy to address the issue of small dataset size caused by high annotation costs. Specifically, the data augmentation method used in this model is divided into a training phase and a generation phase, as follows: Figure 3 As shown.

[0046] During the training phase, we insert label information before and after entity words to mark their position and type; then, we use a full-word masking strategy to randomly mask entity words and feed them into a pre-trained Masked Language Model (MLM) for fine-tuning. The fine-tuned MLM can predict entity words that fit the context.

[0047] In the generation phase, we perform the same label insertion and random masking processing on the original tagged corpus as in the training phase, and then feed it into a fine-tuned masked language model (MLM) to obtain sentences with replaced entity words. After script processing, these enhanced sentences can be transformed into tagged corpus with the same structure as the original corpus. Finally, the original corpus and the enhanced corpus are mixed for use in training the overall model.

[0048] The text input to the XLMR layer is first processed by the Tokenizer tool for tokenization. After the text is divided into sub-tokens, special symbols are added to identify the beginning and end of sentences. <s> "and"< / s> Then, through dictionary mapping, a token sequence T is formed. Afterwards, the XLMR model embeds each token in sequence T, resulting in a word vector sequence E = {E1, E2, E3, ..., E...}. n}. Among them, E i This is the vector representation of the i-th token, and each word vector has a dimension of 768.

[0049] After the word vector sequence E is input into the BiLSTM layer, the forward LSTM obtains the hidden vector sequence h. L ={h L1 ,h L2 ,h L3 ,…,h Ln The backward LSTM yields the hidden vector sequence h. R ={h R1 ,h R2 ,h R3 ,…,h Rn}, finally h L and h R The hidden layer sequence is obtained by concatenating vectors {[h] L1 ,h R1 ],[h L2 ,h R2 ],[h L3 ,h R3 ],…,[h Ln h Rn That is, the output of the BiLSTM layer is h = {h1, h2, h3, ..., h}. n}

[0050] The feature concatenation FC layer performs a feature concatenation operation on the output E of the XLMR layer and the output h of the BiLSTM layer to obtain the output vector sequence H = {[E1,h1],[E2,h2],[E3,h3],…,[E...}. n ,h n Afterwards, it is transformed into a score sequence P = {P1, P2, P3, ..., P} through a fully connected layer. n}, where P i The dimension is equal to the number of entity label types, P ij This represents the score at which the i-th sub-word "token" is classified as the j-th type of entity tag.

[0051] The score sequence P is used as the input to the CRF layer, which trains a transition matrix M, with matrix elements M. ij This represents the transition score when the previous label type is i and the current label type is j. The CRF layer calculates the loss function using the emission score and the transition score, thereby continuously updating the transition matrix M. Finally, the CRF layer uses the Viterbi algorithm to solve for the optimal entity label sequence O = {O1, O2, O3, ..., O...}. n}, where O i This indicates the entity tag type of the i-th sub-word token.

[0052] Step Two: Knowledge Integration

[0053] In the process of constructing a knowledge graph, the extracted knowledge often needs to undergo knowledge fusion for entity disambiguation and coreference resolution. The smart grid network security text processed in this invention has terminology limited to the fields of electricity and network security, both of which have clear terminology standards, thus largely eliminating entity ambiguity issues. However, the text contains several coreference problems: firstly, there are instances of mixed use of abbreviations and capitalization; secondly, there are inconsistencies in the expressions from different data sources.

[0054] The use of abbreviations and inconsistent capitalization in nouns primarily occurs in entities classified as "company". For example, entities such as "Siemens", "Simense", "SIEMENS", "German Siemens", and "German Simense Company" all refer to "Siemens (Germany) Company". This invention resolves coreference by constructing an electrical enterprise dictionary and performing dictionary matching on "company" entities.

[0055] Inconsistencies in descriptions primarily arise in CAPEC's attack type enumeration and ATT&CK's attack techniques. For example, CAPEC's "Install Rootkit" and ATT&CK's "Rootkit," despite their different names, describe the same attack method, thus requiring merging. This invention employs the SBERT algorithm to calculate the similarity of attack description text, thereby merging attack methods with similar descriptions.

[0056] Step 3: Knowledge Update

[0057] Knowledge updates include updates to the schema layer and updates to the data layer. This invention employs incremental updates to reduce resource consumption. Schema layer updates primarily rely on manual methods, adding new entity types appearing in the new data to the schema layer and defining their relationships with existing entity types. Data layer updates, guided by the schema layer, utilize existing knowledge extraction methods to process the new data, then add the entities and relationships to the knowledge graph.

Claims

1. A method for constructing a knowledge graph for smart grid network security, characterized in that, Includes the following steps: Step 1: Crawl data, including structured data, semi-structured data, and unstructured data; Build an ontology model by analyzing the types of information contained in the structured data, and combining existing ontology models and expert experience to build the initial schema layer of the knowledge graph from top to bottom. Step 2: Based on the characteristics of different semi-structured and unstructured texts, adopt rule-based or deep learning-based knowledge extraction methods to complete data annotation, entity extraction, and relation construction; Step 3: After knowledge fusion, construct the data layer under the guidance of the initial schema layer; In step 2, a rule-based knowledge extraction method is used to process semi-structured data, and a deep learning method is used to process unstructured data. A five-layer architecture DA-XLMR-BiLSTM-FC-CRF model is constructed, which includes five parts: data augmentation DA layer, XLMR layer, BiLSTM layer, feature concatenation FC layer and CRF layer. In the data augmentation (DA) layer, the data augmentation method is divided into a training phase and a generation phase. In the training phase, label information is inserted before and after entity words to mark their position and type. Then, a full-word masking strategy is used to randomly mask entity words and feed them into a pre-trained masked language model (MLM) for fine-tuning. The fine-tuned MLM model can predict entity words that conform to the context. In the generation phase, the original tagged corpus undergoes the same label insertion and random masking processing as in the training phase, and is then fed into the fine-tuned MLM model to obtain sentences with replaced entity words. After script processing, these enhanced sentences are transformed into tagged corpus with the same structure as the original corpus. Finally, the original corpus and the enhanced corpus are mixed and used for training the overall model. The text input to the XLMR layer is first processed by the Tokenizer tool for tokenization. After the text is divided into sub-tokens, special symbols are added to identify the beginning and end of the sentence. <s> "and"< / s> Then, through dictionary mapping, a sub-word token sequence T is formed; afterwards, the XLMR model embeds each sub-word token in the sequence T to obtain a word vector sequence E={E1, E2, E3, …, En}; where Ei is the vector representation corresponding to the i-th sub-word token, and each word vector has a dimension of 768.

2. The method for constructing a smart grid network security knowledge graph according to claim 1, characterized in that, When constructing the ontology model, the ontology was divided into cybersecurity ontology and power ontology, and a smart grid cybersecurity knowledge graph ontology model was constructed using a "seven-step method".

3. The method for constructing a smart grid network security knowledge graph according to claim 1, characterized in that, The data augmentation algorithm used in the data augmentation DA layer has been replaced with synonym replacement, same-label word replacement, and unlabeled word replacement algorithms.

4. The method for constructing a smart grid network security knowledge graph according to claim 1, characterized in that, After the word vector sequence E is input into the BiLSTM layer, the forward LSTM obtains the hidden vector sequence h. L ={h L1 , h L2 , h L3 , …, h Ln The backward LSTM yields the hidden vector sequence h. R ={h R1 , h R2 , h R3 , …, h Rn }, finally h L and h R The hidden layer sequence is obtained by concatenating vectors {[h] L1 , h R1 ], [h L2 , h R2 ], [h L3 , h R3 ], …, [h Ln h Rn That is, the output of the BiLSTM layer is h={h1, h2, h3, …, hn}.

5. The method for constructing a smart grid network security knowledge graph according to claim 1, characterized in that, The feature concatenation FC layer performs a feature concatenation operation on the output E of the XLMR layer and the output h of the BiLSTM layer to obtain the output vector sequence H={[E1,h1], [E2,h2], [E3,h3],…,[E n ,h n Afterwards, it is transformed into a score sequence P={P1,P2,P3,…,P} through a fully connected layer. n }, where P i The dimension is equal to the number of entity label types, P ij This represents the score at which the i-th sub-word "token" is classified as the j-th type of entity tag.

6. The method for constructing a smart grid network security knowledge graph according to claim 1, characterized in that, The score sequence P is used as the input to the CRF layer, which trains a transition matrix M, with matrix elements M. ij This represents the transition score when the previous label type is i and the current label type is j. The CRF layer calculates the loss function using emission and transition scores, thereby continuously updating the transition matrix M. Finally, the CRF layer uses the Viterbi algorithm to solve for the optimal entity label sequence O={O1, O2, O3, …, O n }, where O i This indicates the entity tag type of the i-th sub-word token.

7. The method for constructing a smart grid network security knowledge graph according to claim 1, characterized in that, During knowledge fusion, the problem of coreference in text is addressed, including two aspects: the presence of mixed abbreviations and capitalization, and inconsistencies in representations from different data sources. The mixed abbreviations and capitalization occur in entities of the "company" class. This is resolved by constructing an electrical enterprise dictionary and performing dictionary matching on entities of the "company" class. Inconsistencies in representations are manifested in CAPEC's attack type enumeration and ATT&CK's attack techniques. This is resolved by using the SBERT algorithm to calculate the similarity of the attack description text, thereby merging attack methods with similar representations.

8. The method for constructing a smart grid network security knowledge graph according to claim 1, characterized in that, After building the data layer, knowledge updates are also required, including updates to the schema layer and the data layer. Incremental updates are used to reduce resource consumption. The schema layer is updated manually, adding new entity types that appear in the new data to the schema layer and setting their relationships with existing entity types. The data layer is updated under the guidance of the schema layer, using the original knowledge extraction methods to process the new data, and then adding the entities and relationships to the knowledge graph.

Images