Network asset map node feature extraction method and similar node search method

Abstract

The application relates to the field of data analysis, and discloses a network asset graph node feature extraction method and device, a network asset graph similar node search method and device, electronic equipment and a computer readable storage medium. The node feature extraction method comprises the following steps: acquiring a structure vector and a content vector of each node in a network asset graph; selecting a plurality of target feature elements through a target attention neural network model according to the structure vector and the content vector of each node, and fusing the plurality of target feature elements to obtain a fused feature vector of each node; and acquiring a node graph embedding vector of each node according to a target graph neural network model and the fused feature vector. Compared with the prior art, the technical scheme provided in the application embodiment has the advantages that the node features in the network asset graph can be extracted from multiple aspects, and the accuracy of the similar node search result is improved.

Description

Technical Field

[0001] This invention relates to the field of data analysis, and more specifically, to a method and apparatus for extracting node features from a network asset graph, a method and apparatus for searching similar nodes in a network asset graph, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Network assets refer to the various entities and resources that make up the infrastructure and network environment of a network. These include the various devices, systems, applications, data, and information that constitute the network.

[0003] A network asset graph is a graphical structure used to classify, associate, and analyze various assets within a network. It graphically presents the topology, attributes, and relationships of network assets, helping security teams better understand and manage them, and improving the visualization and intelligence of network security. In the field of network security, a network asset graph is a graph model that structures and associates network assets and their related information. It consists of numerous nodes and edges connecting these nodes, helping organizations comprehensively understand and manage network assets, improving the effectiveness and efficiency of network security. By collecting and analyzing network traffic, logs, and other information within the internal network, assets can be automatically discovered and identified, and added to the network asset graph. Furthermore, by associating with other nodes, the relationships between network assets can be better understood and analyzed, helping security teams to better perform threat detection, vulnerability management, and security protection.

[0004] The process of processing and analyzing network asset graphs is inseparable from the analysis of nodes, which in turn relies on the extraction of node features. However, the node features extracted by existing technologies are rather one-sided, leading to low accuracy in subsequent network asset graph analyses based on these features, such as searching for similar nodes. Summary of the Invention

[0005] The purpose of this invention is to provide a method and apparatus for extracting node features from a network asset graph, a method and apparatus for searching similar nodes in a network asset graph, an electronic device, and a computer-readable storage medium, which can extract node features from a network asset graph from multiple aspects and improve the accuracy of similar node search results.

[0006] In a first aspect, embodiments of this application provide a method for extracting node features from a network asset graph, comprising: obtaining a structure vector and a content vector for each node in the network asset graph, wherein the node is used to represent a network asset; selecting multiple target feature elements by means of a target attention neural network model based on the structure vector and content vector of each node, and fusing the multiple target feature elements to obtain a fused feature vector for each node; and obtaining a node graph embedding vector for each node based on the target graph neural network model and the fused feature vector.

[0007] Compared with the prior art, the node feature extraction method in the network asset graph provided in this application extracts the structure vector and content vector of each node in the network asset graph separately. Then, according to the target attention neural network model, multiple target feature elements are selected from the structure vector and content vector of each node, and the multiple target feature elements are fused to obtain the fused feature vector of the node. Based on the target graph neural network model and the fused feature vector, the node graph embedding vector of each node is obtained. The attention neural network model and the graph neural network model are used in combination to comprehensively focus on the structure vector and content vector of each node in the network asset graph. The attention neural network model can flexibly assign weights to the structure vector and content vector according to actual needs, and the graph neural network model can make full use of the structural information and content information in the graph data, that is, extract the node features in the network asset graph from multiple aspects.

[0008] In an optional embodiment, the step of selecting multiple target feature elements through a target attention neural network model based on the structure vector and content vector of each node, and fusing the multiple target feature elements, includes: for any node, calculating the sum vector of the structure vector and content vector of the node, and inputting the sum vector into the target attention neural network model; obtaining the element score of each feature element in the sum vector through the target attention neural network model, and selecting the multiple target feature elements based on the element scores; and concatenating the multiple target feature elements to obtain the fused feature vector of the node.

[0009] In an optional embodiment, training the target attention neural network model and the target graph neural network model includes: acquiring a sample network asset graph, the sample network asset graph including multiple sample nodes, each sample node representing a corresponding sample network asset; acquiring the sample structure vector and sample content vector of each sample node in the sample network asset graph; selecting multiple target sample elements through an initial attention neural network model based on the sample structure vector and sample content vector, and fusing the multiple target sample elements to obtain a sample fusion feature vector for each sample node; for any two sample nodes, obtaining a probability score of direct connection between the two sample nodes through an initial graph neural network model based on the two sample fusion feature vectors of the two sample nodes; and training the initial attention neural network model and the initial graph neural network model based on the probability score to obtain the target attention neural network model and the target graph neural network model.

[0010] In an optional embodiment, obtaining the structure vector of each node in the network asset graph includes: for any target node in the network asset graph, obtaining the K-hop subgraph data of the target node, and obtaining the structure vector of the target node based on the target autoencoder model and the K-hop subgraph data, where K is a positive integer.

[0011] In an optional embodiment, obtaining the content vector of each node in the network asset graph includes: for any target node in the network asset graph, traversing all edge structures connected to the target node, obtaining target resource data connected to the target node, wherein the edge structure is used to characterize the connection relationship between two nodes, and the target resource data is parameter data of other nodes connected to the target node through the edge structure; and obtaining the content vector of the target node based on the target resource data.

[0012] In an optional embodiment, the target node is an intranet IP asset node; obtaining the target resource data connected to the target node includes: obtaining port information data connected to the intranet IP asset node, wherein the port information data includes the type and number of ports connected to the intranet IP asset node. Intranet IP assets are randomly allocated by intranet users and do not have significant characteristics such as location compared to extranet IP assets. In the intranet asset map, the type and number of ports connected to the intranet IP asset node are counted as characteristics of the intranet IP asset node, thus solving the problem of feature extraction of intranet IP assets.

[0013] Secondly, embodiments of this application provide a method for searching similar nodes in a network asset graph, comprising: obtaining a node graph embedding vector for each node in the network asset graph according to the node feature extraction method described above; obtaining a retrieval node graph embedding vector for a retrieval node; calculating the vector similarity between the node graph embedding vector of each node in the network asset graph and the retrieval node graph embedding vector; and identifying nodes whose vector similarity satisfies preset retrieval conditions as similar nodes of the retrieval node.

[0014] Compared with the prior art, the method for searching similar nodes in a network asset graph provided in this application obtains the node graph embedding vector of each node in the network asset graph through the node feature extraction method in the network asset graph as described above. Therefore, the node graph embedding vector extracted in this application is a node feature extracted from multiple aspects. Using the node graph embedding vector to search for similar nodes can effectively improve the accuracy of the search results.

[0015] Thirdly, embodiments of this application provide a node feature extraction device for a network asset graph, comprising: a vector acquisition module, which acquires the structure vector and content vector of each node in the network asset graph; a vector fusion module, which selects multiple target feature elements based on the structure vector and content vector of each node using a target attention neural network model, and fuses the multiple target feature elements to obtain a fused feature vector for each node; and a feature determination module, which acquires a node graph embedding vector for each node based on a target graph neural network model and the fused feature vector.

[0016] Fourthly, embodiments of this application provide a similar node search device in a network asset graph, comprising: a feature vector acquisition module, which is used to acquire the node graph embedding vector of each node in the network asset graph according to the node feature extraction method in the network asset graph described above; and a retrieval module, which is used to acquire the retrieval node graph embedding vector of the retrieval node, calculate the vector similarity between the node graph embedding vector of each node in the network asset graph and the retrieval node graph embedding vector, and acquire nodes whose vector similarity satisfies preset retrieval conditions as similar nodes of the retrieval node.

[0017] Fifthly, embodiments of this application provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a node feature extraction method in a network asset graph as described above or a similar node search method in a network asset graph as described above.

[0018] Sixthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which is executed by a processor to implement the node feature extraction method in the network asset graph as described above or the similar node search method in the network asset graph as described above. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating the node feature extraction method in the network asset graph provided in Embodiment 1 of this application;

[0021] Figure 2 This is a schematic diagram of a network asset map provided in one embodiment of this application;

[0022] Figure 3 This is a flowchart illustrating the method for searching similar nodes in a network asset graph provided in Embodiment 2 of this application.

[0023] Figure 4 This is a schematic diagram of the retrieval node and the target node in one embodiment of this application;

[0024] Figure 5 This is a schematic diagram of the structure of the node feature extraction device in the network asset graph provided in Embodiment 3 of this application;

[0025] Figure 6 This is a schematic diagram of the structure of a node feature extraction device in a network asset graph provided in one embodiment of this application;

[0026] Figure 7 This is a schematic diagram of the structure of the similar node search device in the network asset graph provided in Embodiment 4 of this application;

[0027] Figure 8 This is a schematic diagram of the structure of the electronic device provided in Embodiment 5 of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0029] Therefore, the following detailed description of embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention.

[0030] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0031] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0032] Embodiment 1 of the present invention provides a method for extracting node features from a network asset graph, such as... Figure 1 As shown, it includes:

[0033] Step S101: Obtain the structure vector and content vector of each node in the network asset graph.

[0034] Step S102: Based on the structure vector and content vector of each node, select multiple target feature elements through the target attention neural network model, and fuse the multiple target feature elements to obtain the fused feature vector of each node.

[0035] Step S103: Based on the target graph neural network model and the fused feature vector, obtain the node graph embedding vector of each node.

[0036] Compared with the prior art, the node feature extraction method in the network asset graph provided in Embodiment 1 of this application extracts the structure vector and content vector of each node in the network asset graph separately, then selects multiple target feature elements from the structure vector and content vector of each node, and fuses the multiple target feature elements to obtain the fused feature vector of the node. Based on the target graph neural network model and the fused feature vector, the node graph embedding vector of each node is obtained. The attention neural network model and the graph neural network model are used in combination to comprehensively focus on the structure vector and content vector of each node in the network asset graph. The attention neural network model can flexibly assign weights to the structure vector and content vector according to actual needs, automatically select the target feature elements that are most important to the task, reduce the subjectivity and limitations of feature selection, and the graph neural network model can make full use of the structural information and content information of other nodes in the graph data, that is, extract the node features in the network asset graph from multiple aspects.

[0037] In step S101, as Figure 2 As shown, a network asset graph refers to information about network assets collected through cybersecurity tools and technologies, visualized and analyzed graphically. This graph data helps security teams better understand and manage network assets, and identify potential security risks and threats. Graph data is typically stored in NebulaGraph or Neo4j graph databases, and the exported graph data is stored in JSON format. Each JSON record contains a head node and a tail node. For example:

[0038]

[0039] In step S101, the network asset graph includes multiple nodes and an edge structure connecting these nodes. Nodes represent network assets, such as an IP address or a specific network port. The edge structure represents the connections between the nodes. Obtaining the structure vector of each node in the network asset graph specifically includes: for any target node in the network asset graph, obtaining the K-hop subgraph data of the target node; and obtaining the structure vector of the target node based on the target autoencoder model and the K-hop subgraph data, where K is a positive integer.

[0040] Specifically, in some embodiments of this application, the structure vector of each node can be extracted separately. When extracting the structure vector of any node, that node is the target node, and the K-hop subgraph data of that node is obtained. The K-hop subgraph data of a node refers to the subgraph found by using the K-hop algorithm (k-hop) to find all nodes associated with it at level K through breadth-first search (BFS) starting from the starting point. This subgraph is also called the "ego-net" of the target node. Here, K is a positive integer, which can be flexibly set according to actual needs.

[0041] After obtaining the K-hop subgraph data, each target node and its corresponding K-hop subgraph data can be stored in a dictionary data structure. For example, it can be stored as {'A': {'port': 10, 'domain': 5, 'ip': 6}}, where A is the target node, 'port': 10 represents the number of ports connected to the target node A is 10, 'domain': 5 represents the number of domains connected to the target node A is 5, and 'ip': 6 represents the number of IPs connected to the target node A is 6.

[0042] Then, the K-hop subgraph data of the target node A is input into the trained autoencoder model. Using the trained autoencoder model with the K-hop subgraph data of the target node as model input, the structure vector of the target node is obtained. In the embodiments of this application, the structure vector is a multi-dimensional vector, including multiple structural elements, each structural element representing a structural feature of the target node A. For example, in the aforementioned structure vector {'A': {'port': 10, 'domain': 5, 'ip': 6}}, 'port': 10, 'domain': 5, and 'ip': 6 are the feature elements of the structure vector, i.e., structural elements.

[0043] In step S101, obtaining the content vector of each node in the network asset graph specifically includes: for any target node in the network asset graph, traversing all edge structures connected to the target node, obtaining the target resource data connected to the target node, and obtaining the content vector of the target node based on the target resource data. The target resource data is pre-set data related to the target resource from which content vector extraction is required. In different application scenarios, the target resources can be flexibly set according to the network asset type of the network asset graph, the relevant needs of content vector extraction, and other actual conditions. Step S101 involves obtaining the relevant data of the target resources.

[0044] In this embodiment, an example is taken where the target node is an internal network IP asset node. When the target node is an internal network IP asset node, the target resource can be set as port information resource, for example. Therefore, obtaining the target resource data connected to the target node is equivalent to obtaining the port information data connected to the internal network IP asset node. The port information data includes the type and number of ports connected to the internal network IP asset node. Internal network IP assets are randomly allocated by users within the internal network and do not have significant characteristics such as location compared to external network IP assets. In the internal network asset map, the type and number of ports connected to the internal network IP asset node are statistically analyzed as characteristics of the internal network IP asset node, thus solving the problem of feature extraction for internal network IP assets.

[0045] After acquiring the target resource data, it can be stored using a dictionary data structure. Taking the target node as an internal network IP asset node and the target resource as port information as an example, it can be stored as {'10.252.19.10': ['80', '135', '1136', '443', '443']}, where 10.252.19.10 represents the target IP node, and ['80', '135', '1136', '443', '443'] represents the list of port names connected to the IP node. To avoid anomalies caused by a large number of IP assets connecting to the same port, it is necessary to statistically analyze the number of each type of port. The results are stored in a dictionary data structure, for example, {'10.252.19.10': {'80': 1, '135': 1, '1136': 1, '443': 2}}, where '80': 1 represents a connection to one '80' port, and '443': 2 represents a connection to two '443' ports. In the embodiments of this application, the content vector is a multi-dimensional vector, including multiple content elements, each content element representing a content feature of the target node A. For example, in the aforementioned content vector {'10.252.19.10': ['80', '135', '1136', '443', '443']}, '80', '135', '1136', '443', and '443' are the feature elements of the content vector, i.e., content elements.

[0046] For target resource data, the MurmurHash3 algorithm can be used to convert the input data into hash values ​​as the content vector of the target node, or methods such as neural networks and data dimensionality reduction can be used to obtain the content vector of the target node. This allows complex input data to be mapped to a fixed-length feature space, facilitating tasks such as feature matching, clustering, and classification.

[0047] It is understood that the foregoing are merely illustrative examples of specific methods for obtaining the structure vector and content vector of each node in the network asset graph in some embodiments of this application, and do not constitute a limitation. In some other embodiments of this application, other methods may also be used to obtain the structure vector and content vector of each node, and can be used flexibly according to actual needs.

[0048] In step S102, based on the structure vector and content vector of each node, multiple target feature elements are selected through the target attention neural network model, and the multiple target feature elements are fused. Specifically, for any node, the sum vector of the node's structure vector and content vector is calculated, and the sum vector is input into the target attention neural network model; the element score of each feature element in the sum vector is obtained through the target attention neural network model, and multiple target feature elements are selected based on the element scores; the multiple target feature elements are concatenated to obtain the fused feature vector of the node.

[0049] The target attention neural network model is a pre-trained attention neural network model. See below for specific training methods. In the prediction phase, the structure vector of the target node is X. s The content vector is X c For example, in calculating the structure vector X s and content vector X c Before the sum vector, the structure vector X can be processed by a fully connected layer of a neural network model. s The content vector is X c Feature enhancement is performed, and the enhanced structure vector is: The enhanced content vector is Among them, W c and W s This generates augmentation vectors for the fully connected layers of the neural network model. Then, the sum of the augmented structure vector and the augmented content vector is calculated. Let the sum vector X m When input into the target attention neural network model, the target attention neural network model can calculate the element score of each feature element in the vector, and select multiple target feature elements whose element scores are greater than a threshold based on the element scores; the multiple target feature elements are concatenated to obtain the fused feature vector of the node.

[0050] The specific calculation process includes: Q = W q X m K = W k X m V = W v X m A = K T Q; A′=softmax(A); Y=VA′.

[0051] Among them, Q and W q K, W k V, W v A and T are intermediate values ​​generated by the target attention neural network model; A′ is the importance score of each feature element in the sum vector. Based on the importance scores, the feature elements selected from the sum vector can be called target feature elements. Multiple selected target feature elements are concatenated together to form a fused feature vector.

[0052] It is understood that the aforementioned input of structural vectors and content vectors into the attention neural network model is merely an illustrative example of a specific method for inputting structural vectors and content vectors into the attention neural network model in some embodiments of this application. In some embodiments of this application, structural vectors and content vectors can also be input into the attention neural network model separately. The target attention neural network model can automatically calculate the importance score for each structural element of the structural vector and each content element of the content vector. The importance score is the weight value of the structural vector and the content vector, that is, to calculate the structural element score of each structural element and the content element score of each content element respectively. Finally, multiple target structural elements and multiple target content elements are selected based on the structural element score and the content element score. The multiple target structural elements and multiple target content elements together form multiple target feature elements. The fusion of multiple target feature elements yields the fused feature vector of the target node. Specifically, the selection of multiple target structural elements and multiple target content elements based on the structural element score and the content element score can be based on the required number of target structural elements and target content elements. The required number of structural elements and content elements with larger structural element scores and content element scores can be selected as target structural elements and target content elements. Alternatively, structural elements and content elements with scores greater than a score threshold can be selected as target structural elements and target content elements.

[0053] The calculation of the structural element score for each structural element can be done by calculating each structural element individually, or by combining multiple structural elements as a whole to obtain the overall structural element score. The overall structural element score is the same as the structural element scores of each structural element in the whole. Alternatively, a combination of individual structural element calculations and calculations combining multiple elements can be used, depending on the actual needs.

[0054] In step S103, the target graph neural network model is a trained graph neural network model. The specific training process of the target attention neural network model and the target graph neural network model includes: acquiring a sample network asset graph, which includes multiple sample nodes, each of which represents a corresponding sample network asset; acquiring the sample structure vector and sample content vector of each sample node in the sample network asset graph; selecting multiple target sample elements through the initial attention neural network model based on the sample structure vector and sample content vector, and fusing the multiple target sample elements to obtain the sample fusion feature vector of each sample node; for any two sample nodes, obtaining the probability score of the direct connection between the two sample nodes through the initial graph neural network model based on the two sample fusion feature vectors of the two sample nodes; and training the initial attention neural network model and the initial graph neural network model based on the probability score to obtain the target attention neural network model and the target graph neural network model.

[0055] Specifically, the method described above can be used to obtain the sample fusion feature vectors of each sample node in the sample network asset graph through an initial attention neural network model. Then, the sample fusion feature vectors of all sample nodes are input into the initial graph neural network model for model training. During training, any sample node can be used as a training sample node, with its directly connected neighboring nodes as positive samples and other sample nodes as negative samples. For any two sample nodes u and v, their corresponding sample fusion feature vector is represented as h. u and h v The initial graph neural network model calculates a score y indicating the probability of a link between them. u,v =φ(h) u ,h v This compares the score between two connected nodes to the score between any two nodes. For example, given an edge structure connecting u and v, a good model aims for a higher score between u and v than between u and a node v' sampled from an arbitrary noise distribution v' ~ Pn(v). Cross-entropy loss is used.

[0056]

[0057] Using the prediction of whether there is an edge structure connection between two nodes as the task objective of unsupervised training, a target attention neural network model and a target graph neural network model are obtained after training.

[0058] Embodiment 2 of this application provides a method for searching similar nodes in a network asset graph. Please refer to... Figure 3 , Figure 4 , Figure 3This is a flowchart illustrating the method for searching similar nodes in a network asset graph provided in Embodiment 2 of this application. Figure 4 The diagram shown is a schematic representation of the retrieval node and the target node in one embodiment of this application. Figure 4 As shown, by searching for similar nodes of node a in the network asset graph, similar nodes b and c can be obtained. Similar nodes b and c have similar structural features and port information to node a.

[0059] like Figure 3 The methods for searching similar nodes in the network asset graph shown include:

[0060] Step S201: Obtain the node graph embedding vector of each node in the network asset graph.

[0061] In this step, the node graph embedding vector of each node in the network asset graph can be obtained by using the node feature extraction method in the network asset graph provided in the foregoing embodiments. The specific process of obtaining the node graph embedding vector can be referred to the specific description in the foregoing embodiments.

[0062] Step S202: Obtain the retrieval node graph embedding vector of the retrieval node, and obtain the target node based on the retrieval node graph embedding vector.

[0063] In this step, the target node is the node whose vector similarity to the retrieved node's graph embedding vector satisfies a preset retrieval condition. Specifically, the retrieval node is the source node for similarity node retrieval, and the retrieved target node is the node similar to the retrieval node. This can be achieved by traversing and calculating the vector similarity between the graph embedding vector of each node in the network asset graph and the graph embedding vector of the retrieved node. Vector similarity can be, for example, Euclidean distance, cosine similarity, etc. Then, nodes whose vector similarity satisfies the preset retrieval condition are selected as target nodes. For example, nodes with vector similarity greater than a certain preset threshold can be selected as target nodes, or several nodes with the highest vector similarity can be selected as target nodes, etc. The specific settings can be flexibly configured according to actual needs.

[0064] In some embodiments of this application, the Faiss framework can be used to construct the index structure, and a suitable index type can be selected based on the data scale and search requirements of the network asset graph. During retrieval, the retrieval node graph embedding vector of the retrieval node is added to the index. The index structure can then use the similarity search algorithm provided by the Faiss framework to find the target node by calculating the similarity between the vector of the query node and the node vectors in the index.

[0065] Compared with the prior art, the method for searching similar nodes in a network asset graph provided in Embodiment 2 of this application obtains the node graph embedding vector of each node in the network asset graph through the node feature extraction method in the network asset graph as described above. Therefore, the node graph embedding vector extracted in this embodiment is a node feature extracted from multiple aspects. Using the node graph embedding vector to search for similar nodes can effectively improve the accuracy of the search results.

[0066] Embodiment 3 of this application provides a device for extracting node features from a network asset graph, such as... Figure 5 As shown, it includes: a vector acquisition module 301, which is used to acquire the structure vector and content vector of each node in the network asset graph; a vector fusion module 302, which is used to select multiple target feature elements through a target attention neural network model based on the structure vector and content vector of each node, and fuse the multiple target feature elements to obtain the fused feature vector of each node; and a feature determination module 303, which is used to acquire the node graph embedding vector of each node based on the target graph neural network model and the fused feature vector.

[0067] Specifically, in some embodiments of this application, such as Figure 6 As shown, the vector acquisition module 301 can be, for example, a neural network model, the vector fusion module 302 can be, for example, a target attention neural network model, and the feature determination module 303 can be, for example, a target graph neural network model.

[0068] It is understood that the node feature extraction device in the network asset graph provided in this embodiment is an embodiment of the device corresponding to the node feature extraction method in the network asset graph provided in the foregoing embodiment. Therefore, it also has the same technical effect as the foregoing node feature extraction method in the network asset graph. For details, please refer to the specific description in the foregoing embodiment.

[0069] Embodiment 4 of this application provides a similar node search device in a network asset graph, such as... Figure 7 As shown, it includes: a feature vector acquisition module 401, which is used to acquire the node graph embedding vector of each node in the network asset graph according to the node feature extraction method in the network asset graph as described above; and a retrieval module 402, which is used to acquire the retrieval node graph embedding vector of the retrieval node, calculate the vector similarity between the node graph embedding vector of each node in the network asset graph and the retrieval node graph embedding vector, and select nodes whose vector similarity satisfies the preset retrieval conditions as similar nodes of the retrieval node.

[0070] It is understood that the network asset graph similar node search device provided in this embodiment is an embodiment of the device corresponding to the network asset graph similar node search method provided in the foregoing embodiment. Therefore, it also has the same technical effect as the foregoing network asset graph similar node search method. For details, please refer to the specific description in the foregoing embodiment.

[0071] Embodiment 5 of the present invention relates to an electronic device, such as... Figure 8 As shown, it includes: at least one processor 501; and a memory 502 communicatively connected to at least one processor 501; wherein the memory 502 stores instructions executable by at least one processor 501, the instructions being executed by at least one processor 501 to enable at least one processor 501 to perform the methods in the above embodiments.

[0072] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0073] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0074] Embodiment 6 of the present invention relates to a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the above-described method embodiments.

[0075] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0076] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for extracting features of nodes in a network asset graph, characterized in that, include: Obtain the structure vector and content vector of each node in the network asset graph, where the node is used to represent the network asset; Based on the structure vector and content vector of each node, a target attention neural network model is used to select multiple target feature elements, and the multiple target feature elements are fused to obtain a fused feature vector for each node. This includes: for any node, calculating the sum vector of the node's structure vector and content vector, and inputting the sum vector into the target attention neural network model; calculating the element score of each feature element in the sum vector using the target attention neural network model, and selecting the multiple target feature elements based on the element scores; and concatenating the multiple target feature elements to obtain the fused feature vector of the node. Based on the target graph neural network model and the fused feature vector, obtain the node graph embedding vector for each node.

2. The method of claim 1, wherein, Training the target attention neural network model and the target graph neural network model includes: Obtain a sample network asset graph, which includes multiple sample nodes, each of which is used to represent a corresponding sample network asset. Obtain the sample structure vector and sample content vector for each sample node in the sample network asset graph; Based on the sample structure vector and sample content vector, multiple target sample elements are selected through an initial attention neural network model, and the multiple target sample elements are fused to obtain the sample fusion feature vector of each sample node; For any two sample nodes, based on the two sample fusion feature vectors of the two sample nodes, the probability score of direct connection between the two sample nodes is obtained through the initial graph neural network model. Based on the probability scores, the initial attention neural network model and the initial graph neural network model are trained to obtain the target attention neural network model and the target graph neural network model.

3. The method of claim 1, wherein, The process of obtaining the structure vector of each node in the network asset graph includes: For any target node in the network asset graph, obtain the K-hop subgraph data of the target node, and obtain the structure vector of the target node based on the target autoencoder model and the K-hop subgraph data, where K is a positive integer.

4. The method of claim 1, wherein, Obtain the content vector of each node in the network asset graph, including: For any target node in the network asset graph, traverse all edge structures connected to the target node to obtain the target resource data connected to the target node. The edge structure is used to represent the connection relationship between two nodes, and the target resource data is the parameter data of other nodes connected to the target node through the edge structure. The content vector of the target node is obtained based on the target resource data.

5. The method of claim 4, wherein, The target node is an internal network IP asset node; The step of obtaining the target resource data connected to the target node includes: Obtain port information data connected to the internal network IP asset node, the port information data including the type and number of ports connected to the internal network IP asset node.

6. A method for searching similar nodes in a network asset map, characterized by, include: The node graph embedding vector of each node in the network asset graph is obtained according to the node feature extraction method in any one of claims 1 to 5. Obtain the retrieval node graph embedding vector of the retrieval node, calculate the vector similarity between the node graph embedding vector of each node in the network asset graph and the retrieval node graph embedding vector, and obtain the nodes whose vector similarity satisfies the preset retrieval conditions as similar nodes of the retrieval node.

7. A network asset map node feature extraction apparatus, comprising: include: A vector acquisition module is used to acquire the structure vector and content vector of each node in the network asset graph, wherein the node is used to represent the network asset. A vector fusion module is used to select multiple target feature elements based on the structure vector and content vector of each node through a target attention neural network model, and fuse the multiple target feature elements to obtain a fused feature vector for each node. The feature determination module is used to obtain the node graph embedding vector of each node based on the target graph neural network model and the fused feature vector; The vector fusion module is further configured to, for any given node, calculate the sum vector of the node's structure vector and content vector, input the sum vector into the target attention neural network model, obtain the element score of each feature element in the sum vector through the target attention neural network model, and select the plurality of target feature elements based on the element scores; The multiple target feature elements are concatenated to obtain the fused feature vector of the node.

8. A similar node search device in a network asset graph, characterized in that, include: The feature vector acquisition module is used to acquire the node graph embedding vector of each node in the network asset graph according to the node feature extraction method in the network asset graph as described in any one of claims 1 to 5. The retrieval module is used to obtain the retrieval node graph embedding vector of the retrieval node, calculate the vector similarity between the node graph embedding vector of each node in the network asset graph and the retrieval node graph embedding vector, and obtain the nodes whose vector similarity satisfies the preset retrieval conditions as similar nodes of the retrieval node.

9. An electronic device, comprising: include: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the node feature extraction method in the network asset graph as described in any one of claims 1 to 5 or the similar node search method in the network asset graph as described in claim 6.

10. A computer readable storage medium storing a computer program, characterized in that, The computer program is executed by a processor to implement the node feature extraction method in the network asset graph as described in any one of claims 1 to 5 or the similar node search method in the network asset graph as described in claim 6.

Images