A core asset identification method for a specific network

Abstract

The application relates to a core asset identification method of a specific network, and belongs to the network security field. The method comprises the following steps: acquiring specific network asset information, and obtaining a specific network asset graph data set through preprocessing; adopting an overlapping community detection algorithm to detect an asset subgraph point set; calculating the betweenness centrality, the degree centrality, the closeness centrality and the feature vector centrality of each asset information node in the asset subgraph point set, respectively performing node sorting, and calculating the similarity coefficient of the node sorting; calculating the weight coefficient of the node sorting according to the similarity coefficient, calculating the comprehensive coefficient of the node sorting according to the weight coefficient, obtaining the final result of the node sorting according to the comprehensive coefficient, and further obtaining the main asset information node and the key link of the asset subgraph. The method can accurately identify the core assets of the specific network.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to a method for identifying core assets of a specific network. Background Technology

[0002] In recent years, with the development of the internet, cybersecurity issues have become increasingly serious. In the field of information security, all entities related to information and networks can be referred to as network assets. Some actors possess a certain number of interconnected network assets, such as domain names, IP addresses, security certificates, or autonomous system numbers, which they use to conduct activities that pose a risk to network security, such as phishing websites and Trojan viruses. A specific network refers to a network that is suspected of being insecure or risky to the entire network.

[0003] Currently, the main approach to combating these cybersecurity risks is to first search for and flag these potentially dangerous networks, then perform querying and identification processes to block those identified as insecure or risky network assets. However, because insecure or risky websites often have numerous copies, short lifespans, and frequent domain name changes, identifying these insecure or risky network assets is computationally intensive, inefficient, time-consuming, and has poor accuracy. Since blocking network assets has a significant impact, accurately identifying insecure or risky network assets is therefore crucial.

[0004] Existing network asset identification technologies first employ community classification algorithms, such as the Louvain algorithm, to calculate and divide all nodes in the network into communities, resulting in multiple asset subgraphs. Then, the PageRank algorithm is used to rank the nodes, followed by the deletion of some nodes to obtain key asset information nodes and critical links. The main drawback of the Louvain algorithm is that it requires global calculation of all nodes, which is time-consuming. Even after ranking the nodes, the PageRank algorithm may still mistakenly delete a small number of key asset information nodes, thus resulting in poor accuracy in identifying core assets. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention proposes a method for identifying core assets of a specific network. This method can accurately identify the core network assets, namely the main asset information nodes and critical links, of a specific network from numerous insecure or risky networks. The method of this invention specifically includes the following steps:

[0006] S1: Obtain specific network asset information, preprocess the specific network asset information, and obtain a specific network asset graph dataset;

[0007] S2: The overlapping community detection algorithm is used to process the specific network asset graph dataset to obtain the asset subgraph point set;

[0008] S3: Calculate the betweenness centrality, degree centrality, proximity centrality, and eigenvector centrality of each asset information node in the asset subgraph point set;

[0009] S4: Based on the betweenness centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result A of the nodes with the highest sorting.

[0010] S5: Based on the degree centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result B of the nodes with the highest sorting.

[0011] S6: Based on the proximity centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result C of the nodes with the highest sorting.

[0012] S7: Based on the feature vector centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result D of the nodes with the highest sorting.

[0013] S8: Compare the node sorting results A, B, C and D with each pair of node sorting results, calculate the similarity coefficient of the node sorting, and calculate the weight coefficient of the node sorting based on the similarity coefficient.

[0014] S9: Calculate the comprehensive coefficient of node sorting based on the weight coefficient of the node sorting, and obtain the final result of node sorting of all asset information nodes in the asset sub-graph point set based on the comprehensive coefficient of node sorting.

[0015] S10: Based on the final result of the node sorting, obtain the main asset information nodes in the asset subgraph point set, and query the key links based on the main asset information nodes. The main asset information nodes and the key links constitute the core assets of a specific network subgraph.

[0016] The beneficial effects of this invention are as follows: First, based on the betweenness centrality, degree centrality, proximity centrality, and eigenvector centrality of each asset information node, this invention employs four node ranking methods to obtain four node ranking results for the same asset subgraph. The similarity coefficient is then calculated, followed by the weight coefficient for node ranking, resulting in a comprehensive coefficient for node ranking. The final ranking result of asset information nodes obtained through this comprehensive coefficient is more accurate, leading to more accurate identification of major asset nodes and key links, thus improving the accuracy of identification. Then, in complex directed graph networks, the LEMON algorithm, a local expansion algorithm that minimizes the first norm, is used to find the community to which the seed node belongs (this community is used to partition the subgraph). This eliminates reliance on global node calculations, greatly saving memory space and facilitating parallel computing, further improving computational efficiency. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the steps of an embodiment of the present invention;

[0018] Figure 2 This is a flowchart illustrating the specific steps of the local expansion algorithm for minimizing the first norm in this embodiment of the invention.

[0019] Figure 3 This is the core asset view of a specific network subgraph in this embodiment of the invention;

[0020] Figure 4 This is a view of the control panel in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention provides a method for identifying core assets in a specific network, such as... Figure 1 As shown, the method includes the following steps:

[0023] S1: Obtain specific network asset information, preprocess the specific network asset information, and obtain a specific network asset graph dataset;

[0024] S2: The overlapping community detection algorithm is used to process the specific network asset graph dataset to obtain the asset subgraph point set;

[0025] S3: Calculate the betweenness centrality, degree centrality, proximity centrality, and eigenvector centrality of each asset information node in the asset subgraph point set;

[0026] S4: Based on the betweenness centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result A of the nodes with the highest sorting.

[0027] S5: Based on the degree centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result B of the nodes with the highest sorting.

[0028] S6: Based on the proximity centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result C of the nodes with the highest sorting.

[0029] S7: Based on the feature vector centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result D of the nodes with the highest sorting.

[0030] S8: Compare the node sorting results A, B, C and D with each pair of node sorting results, calculate the similarity coefficient of the node sorting, and calculate the weight coefficient of the node sorting based on the similarity coefficient.

[0031] S9: Calculate the comprehensive coefficient of node sorting based on the weight coefficient of the node sorting, and obtain the final result of node sorting of all asset information nodes in the asset sub-graph point set based on the comprehensive coefficient of node sorting.

[0032] S10: Based on the final result of the node sorting, obtain the main asset information nodes in the asset subgraph point set, and query the key links based on the main asset information nodes. The main asset information nodes and the key links constitute the core assets of a specific network subgraph.

[0033] Preferably, in step S1, the specific network asset information refers to network assets marked as insecure or with security risks, specifically including domain names, IP addresses, security certificates, and autonomous system numbers marked as insecure or with security risks. Using big data analysis and retrieval strategies, network security departments or service providers have already retrieved and marked these suspected insecure or risky specific network assets, forming a specific network asset information database. Therefore, this invention first needs to acquire the specific network asset information, then analyze and preprocess the specific network asset information, analyzing whether it has the same attributes and data items, adding and deleting column attributes for those that are different, obtaining a unified data format, and thus obtaining a specific network asset graph dataset. This specific network asset graph dataset describes a specific directed graph network, which is a directed graph network composed of specific network assets.

[0034] Preferably, in step S1, the network asset information graph dataset includes a set of network asset information nodes and a set of links for specific network asset information. Specifically, the set of network asset information nodes and the set of links are the node.csv node set and the link.csv link set.

[0035] Preferably, in step S1, the preprocessing includes: adding a numeric index to the set of network asset information nodes for the specific network asset information, and searching for data based on the index; if there are errors in the fields of the numeric index, modifying the erroneous field content, and correcting the data in conjunction with the field description. A specific example is: adding a numeric index to the asset information node set, adding a "nid" field to each asset information node in Node.csv to facilitate data retrieval based on the index; modifying field content errors, such as the "industry" field being marked as ["A", "AB"], and correcting the data to ["A", "B"] in conjunction with the field description.

[0036] The LEMON algorithm, short for Local Expansion via Minimum One Norm, is an algorithm for detecting overlapping communities. It involves inputting m seed asset information nodes, the preprocessed node.csv point set, and link.csv edge set into the LEMON algorithm model to obtain an asset subgraph point set containing these m seed asset information nodes.

[0037] Preferably, in step S2, the overlapping community detection algorithm minimizes the local expansion algorithm of the first norm, i.e., the LEMON algorithm, as follows: Figure 2 As shown, the specific implementation steps of the LEMON algorithm model include:

[0038] S201 randomly obtains several seed asset information nodes, inputs these seed asset information nodes into the LEMON algorithm model, and generates a local spectrum V. k,l The specific process is as follows:

[0039] Randomly select m seed asset information nodes, obtain their adjacency matrix A based on the m seed asset information nodes, and perform standardization to obtain the standardized adjacency matrix.

[0040]

[0041] Where D is a diagonal matrix composed of the vertex degrees of m seed asset information nodes, and I is the identity matrix.

[0042] A random walk begins with an asset information node set S consisting of m seed asset information nodes, denoted by p0 as the initial probability vector. All probabilities are uniformly distributed among the members of the seed asset information node set, spanned by the l-dimensional probability vector in l consecutive random walks, forming a space P. 0,l A spanned space is a vector space obtained by multiplying two vectors by different coefficients. The spanned space P... 0,l Specifically:

[0043] P 0,l =[p0,p1,…,p l ]

[0044] Where p1 is the probability vector of the first random walk, p l The probability vector of the l-th random walk.

[0045] V 0,l The invariant subspace of the initialization is represented by the space spanned by computation, P. 0,l The orthonormal basis is obtained; then the l-dimensional orthonormal basis V obtained after k random walks is calculated iteratively. k,l Specifically:

[0046]

[0047] Among them, orthogonal basis V k,l Used for local spectral clustering, V k-1,l Let l-dimensional orthonormal basis be defined for k-1 random walks. It was chosen to make V k,l They are orthogonal.

[0048] S202. According to the local spectrum V k,l The new set of seed asset information nodes S′ is obtained through the following process:

[0049] In local spectrum V k,l Based on this, the following linear programming problem needs to be solved:

[0050] min e T y = ||y||1

[0051] st y=V k,l x,

[0052] y≥0,

[0053] y(S)≥0,

[0054] Where e is a vector of all 1s, e T It is the transpose of vector e, where x and y are unknown vectors; the first constraint is y = V. k, l x indicates that y is in space V k,lThe first constraint is y ≥ 0, where each element in y represents the probability that the corresponding vertex belongs to the target community and must be non-negative; the second constraint is y(S) ≥ 0, which ensures that the seed is in the support set of the sparse vector y.

[0055] The vector is obtained by arranging the elements of the sparse vector y in non-ascending order. Get The |T| elements at the top are added to the community of the asset information node set S, resulting in a new seed asset information node set S′.

[0056] S203. Reseeding: Input the seed asset information node set S′ into the LEMON algorithm model, perform iterative calculations, and update the seed asset information node set S′.

[0057] S204. Obtain the vertex set of the seed asset information node set S′, calculate the conductance φ(C) of the vertex set, and terminate the iteration when the minimum value of the conductance φ(C) is obtained, thus obtaining the target community.

[0058] In this embodiment of the invention, the set of asset information nodes S′ is referred to as community C. The vertex set of the seed asset information node set S′ is obtained, and the conductance φ(C) of the vertex set is calculated. The specific formula for calculating the conductance φ(C) is as follows:

[0059]

[0060] Among them, set C represents the communities that were detected, including nodes containing seed asset information. The value represents the size of the cut set, which is the sum of the number of edges that the community extends outwards. Vol(C) represents the sum of the degrees of the vertices in the community. Let min(Vol(C)) represent the sum of the degrees of all points in the graph minus the sum of the degrees of the points in the community. This indicates taking Vol(C) and The minimum of the two.

[0061] The termination condition is that the conductance φ(C) reaches its minimum value, indicating the optimal community detection performance for the target community. This target community includes the seed asset information nodes. Since the conductance φ(C) exhibits a monotonic behavior of first decreasing and then increasing, the conductance φ(C) after the (t-1)th iteration is used. t-1 When φ(C) t-1 <φ(C) t , and φ(C) t-1 <φ(C) t-2 When, where φ(C) t Let φ(C) be the conductance after the t-th iteration. t-2 The iteration is terminated when the conductivity is the value after the (t-2)th iteration.

[0062] S205. Based on the target community, obtain the asset subgraph point set S′, which includes the seed asset information node, i.e., community C.

[0063] The LEMON algorithm detects a target community from a small seed set. Given a set of points S as input to the algorithm model, the output is a community C containing the seed set S, which is the specific network asset node group you want to obtain.

[0064] Discovering a small community cluster in a large, complex network with billions of vertices would be extremely costly if global community detection were performed, requiring consideration of all asset information nodes. The goal of this invention is to accurately discover the target group while keeping the number of asset information nodes examined relatively small. The LEMON method effectively addresses the memory consumption problem when searching for local communities in large graphs because it avoids loading the entire graph into memory. This is the advantage of the LEMON algorithm compared to other community detection algorithms.

[0065] The betweenness centrality of an asset information node refers to the number of times that an asset information node acts as a bridge between two other asset information nodes in the shortest path. The more times an asset information node acts as an intermediate bridge, the greater its betweenness centrality.

[0066] In step S3, the betweenness centrality BC of a certain asset information node is determined. i The calculation formula is as follows:

[0067]

[0068] in: This represents the number of shortest paths among asset information nodes s and t that pass through asset information node i; g st This represents the number of shortest paths connecting asset information nodes s and t.

[0069] Degree centrality is the most direct measure of node centrality in network analysis. The higher the degree of an asset information node, the higher its degree centrality, and the more important the asset information node is in the network.

[0070] In step S3, the degree centrality DC of a certain asset information node is determined. i The calculation formula is as follows:

[0071]

[0072] Where, k iN represents the number of edges connected to asset information node i; N-1 represents the number of edges that connect asset information node i to all other asset information nodes.

[0073] Proximity centrality requires considering the average length of the shortest path from each asset information node to other asset information nodes. For an asset information node, the closer it is to other asset information nodes, the higher its centrality.

[0074] In step S3, the proximity centrality (CC) of a certain asset information node is determined. i The calculation formula is as follows:

[0075]

[0076]

[0077] Where, d i d represents the average distance from asset information node i to all other asset information nodes. ij This represents the average distance between asset information node i and asset information node j, where i and j are positive integers ranging from 1 to N.

[0078] The importance of an asset information node also depends on the importance of its neighboring asset information nodes. The basic idea of ​​eigenvector centrality is that the centrality of an asset information node is a function of the centralities of its neighboring asset information nodes.

[0079] In step S3, the eigenvector centrality EC of a certain asset information node i The calculation steps are as follows:

[0080] S301. Describe the connection relationships between asset information nodes in a specific network asset subgraph as an adjacency matrix A. A ij Indicates whether there is a connection between asset information node i and asset information node j. If there is, A ij If it is 1, then it is 0; if not, then it is 0.

[0081] S302. Calculate the degree matrix D, which is a diagonal matrix. ii The degree of asset information node i is represented by D, which is the number of edges connected to asset information node i. ii Specifically:

[0082]

[0083] S303. Calculate the Laplace matrix L, which is the difference between the degree matrix D and the adjacency matrix A.

[0084] The Laplace matrix L is specifically: L = DA.

[0085] S304. Eigenvalue Decomposition: The Laplacian matrix L is decomposed into eigenvalues ​​to obtain eigenvalues ​​λ and corresponding eigenvectors υ, specifically as follows:

[0086] L·υ=λ·υ

[0087] Where λ is the eigenvalue and υ is its corresponding eigenvector.

[0088] S305. Select the largest eigenvalue: Select the eigenvector with the largest eigenvalue. This typically corresponds to the second smallest eigenvalue of the Laplace matrix. Note that the smallest eigenvalue of the Laplace matrix is ​​zero, corresponding to a vector where all elements are identical.

[0089] S306. Standardization: Standardize the eigenvector with the largest eigenvalue so that the sum of squares of its elements is 1. The standardized eigenvector is the eigenvector centrality (EC) of the asset information node. i .

[0090]

[0091] Among them, υ i υ is the i-th element of the eigenvector, and ||υ|| is the norm of the eigenvector, i.e., the square root of the sum of squares.

[0092] Eigenvector centrality represents the centrality of an asset information node as being related to the centrality of its neighboring asset information nodes, and the centrality of neighboring asset information nodes is in turn related to the centrality of their respective neighboring asset information nodes, forming a cycle. This calculation method fully considers the relative influence of asset information nodes in the entire network.

[0093] Preferably, the betweenness centrality BC of each asset information node in the asset subgraph point set is calculated. i Degree centrality DC i Proximity centrality CC i and eigenvector centrality EC i Then, normalization operations are performed on each of them. The following formula is used for normalization:

[0094]

[0095] Where x is the centrality value of each asset information node, x min x is the minimum value among the centrality values ​​of all asset information nodes. max x is the maximum value among the centrality values ​​of each asset information node, and x′ is the centrality value after normalization.

[0096] BC the betweenness centrality of each asset information node. iReturn to the original specific network asset subgraph, sort it from high to low, and perform normalization to obtain the new betweenness centrality BC′. i , represented as BC′ i =f(BC) i This refers to the betweenness centrality of each asset information node after normalization.

[0097] Similarly, for degree-centrality DC i Proximity centrality CC i and eigenvector centrality EC i The normalization processes performed separately yield the degree centrality DC′ of each asset information node after normalization, denoted as DC′. i =f(DC) i ), proximity centrality CC′ i , represented as CC′ i =f(CC) i ) and eigenvector centrality EC′ i , represented as EC′ i =f(EC) i ).

[0098] S4: Based on the betweenness centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result A of the nodes with the highest sorting.

[0099] S5: Based on the degree centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result B of the nodes with the highest sorting.

[0100] S6: Based on the proximity centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result C of the nodes with the highest sorting.

[0101] S7: Based on the feature vector centrality of each asset information node, sort all asset information nodes in the asset subgraph point set and obtain the sorting result D of the nodes with the highest sorting.

[0102] Preferably, in step S8, the similarity coefficient of the node sorting is calculated using the following formula:

[0103]

[0104]

[0105] Among them, K αβ Let K represent the similarity coefficient of node ranking, where α and β represent two different node ranking results, n represents the number of asset information nodes, and K is a positive integer.αβ,i This indicates whether the asset information node at rank i is the same in both node sorting results, α. i For an asset information node ranked at position i in a node sorting result, β i Let i be the node ranked at position i in another node sorting result, where α and β are any one of the node sorting results A, B, C, and D.

[0106] After calculation, K αβ The range is 0-1. When K αβ The larger the value, the more similar the specific network asset subgraphs are under the two node sorting results.

[0107] For example, the similarity coefficient K between node sorting result A and node sorting result B. AB The specific calculation formula is as follows:

[0108]

[0109]

[0110] Among them, A i For the asset information node ranked at position i in the node sorting result A, B i Let n be the node ranked at position i in the node sorting result B, where n represents the number of asset information nodes and is a positive integer.

[0111] Similarly, the similarity coefficient K between node sorting result A and node sorting result C is calculated. AC The similarity coefficient K between node sorting results A and node sorting results D AD The similarity coefficient K between node sorting result B and node sorting result C BC The similarity coefficient K between node sorting result B and node sorting result D BD The similarity coefficient K between node sorting results C and node sorting results D CD .

[0112] Based on the betweenness centrality, degree centrality, proximity centrality, and eigenvector centrality of each asset information node, four node ranking methods were applied to the asset information nodes in the same specific network asset subgraph, resulting in four node ranking results. The closer the similarity coefficient K of these four node ranking results, the closer their degree of similarity. The above six similarity coefficients K... AB K AC K AD K BC K BD and K CD They have a mutually verifying relationship. For example: K ABK AC K AD The closer the similarity coefficients are, the more accurate and reasonable the node ranking result A is.

[0113] Preferably, in step S8, the weight coefficient W for node sorting A W B W C W D Specifically:

[0114]

[0115]

[0116]

[0117]

[0118] Among them, the weighting coefficient W A W B W C W D ∈(0,1), and W A +W B +W C +W D =1.

[0119] Among them, W A W represents the weight coefficient for sorting nodes based on betweenness centrality. B W represents the weight coefficient for sorting nodes based on degree centrality. C W represents the weight coefficient for sorting nodes based on proximity centrality. D K represents the weight coefficients for sorting nodes based on eigenvector centrality. AB K represents the similarity coefficient between node sorting result A and node sorting result B. AC K represents the similarity coefficient between node sorting results A and node sorting results C. AD K represents the similarity coefficient between node sorting results A and node sorting results D. BC K represents the similarity coefficient between node sorting results B and node sorting results C. BD K represents the similarity coefficient between node sorting results B and node sorting results D. CD This represents the similarity coefficient between node ranking results C and node ranking results D. The weight coefficient W... A W B W C W DThese are used to evaluate the accuracy and stability of the node ranking results within the community after ranking nodes according to their corresponding centrality. The stability and accuracy are reflected by the magnitude of the weight coefficient. The larger the weight coefficient, the more accurate and reasonable the corresponding node ranking method is, and the greater its contribution to the final result in the subsequent comprehensive coefficient calculation.

[0120] Preferably, in step S9, the comprehensive coefficient for node sorting is calculated using the following formula:

[0121] TC i =W A ·BC′ i +W B ·DC′ i +W C ·CC′ i +W D ·EC′ i

[0122] Among them, TC i BC′ represents the overall coefficient for node sorting. i DC' represents the normalized betweenness centrality, and CC' represents the normalized degree centrality. i EC′ represents the proximity centrality after normalization. i The eigenvector centrality is represented by the normalized eigenvector. Each weight coefficient is used to evaluate the accuracy and stability of the node ranking result within the community after ranking the nodes according to their corresponding centrality. Multiplying this weight coefficient by the normalized centrality of each asset information node indicates the contribution of this centrality ranking method to the overall coefficient. Naturally, the larger the weight coefficient, the greater its contribution and the greater its impact on the overall coefficient value. Conversely, if a centrality ranking method is not reasonable or accurate within the community, it will have a smaller contribution. In summary, through the above processing, this invention obtains a more accurate and reasonable overall coefficient for each node in each community.

[0123] In the embodiments of the present invention, the comprehensive coefficient TC is calculated. iIn this process, instead of simply using a few centrality coefficients for weighted calculation, a significant amount of computation is employed to compare the results of various centrality ranking algorithms. The stability of each algorithm's ranking result is calculated based on whether the position of each node after ranking is the same as the other three ranking results. Its accuracy relative to other centrality algorithms is also calculated, and a weight coefficient W is used to measure the stability and accuracy of this centrality algorithm. The effect of this computationally intensive weight coefficient calculation is that the final node ranking result is more accurate and comprehensive, and more convincing than existing single evaluation indicators. The calculation is performed by allocating weights according to the centrality ranking algorithm, completing the calculation of the comprehensive centrality coefficient for each community. This calculation method is adaptive and does not involve human intervention. Each community calculates different weight coefficients based on its own node ranking, resulting in a unique comprehensive coefficient for each community. This comprehensive coefficient varies from community to community; therefore, this centrality evaluation method is an adaptive calculation method. This method differs from methods using machine learning and deep learning for comprehensive centrality prediction. Machine learning requires extensive training data; if data is insufficient or unrepresentative, the model struggles to generalize. Furthermore, deep learning is a black box, often making it difficult to understand why it makes certain predictions, thus limiting its interpretability. Using machine learning to predict a comprehensive coefficient from multiple similarity coefficients is also unstable and inaccurate. In contrast, the method described in this invention, which identifies the main asset nodes and critical links of a specific network asset subgraph, yields more accurate and interpretable results.

[0124] In existing technologies, nodes in an asset subgraph are often ranked based on one or two of betweenness centrality, degree centrality, proximity centrality, and eigenvector centrality to identify key asset information nodes. For example, considering only degree centrality and betweenness centrality as metrics only takes into account the number of edges a node has and the number of times it acts as a bridge to other pathways, while ignoring the influence of surrounding nodes, such as the importance of other nodes around the node affecting its weight. In other words, relying solely on a relatively singular centrality evaluation metric leads to inaccurate results. Therefore, the calculation method is rather one-sided and simplistic, resulting in inaccurate calculations and poor node ranking performance.

[0125] This invention calculates the similarity coefficient of node ranking. By comprehensively considering the factors, the influence of each node ranking method on the final ranking result is reflected in the weight coefficient. By comprehensively considering the weight coefficients of the four node ranking methods, a comprehensive coefficient TC for node ranking is finally obtained. iThis allows for a more accurate calculation of the importance of each asset information node.

[0126] The comprehensive coefficient TC based on the final node ranking in a specific network asset subgraph i Based on the network size, a specific number of asset information nodes can be extracted. For example, the top 50 asset information nodes in the final sorting result can be extracted to obtain the main asset information nodes. The main asset information nodes are then returned to the specific network asset network, and the key links connected to the main asset information nodes can be obtained through database SQL query.

[0127] Furthermore, the core assets of the specific network subgraph are visualized to obtain a core asset view of the specific network subgraph.

[0128] The obtained major network asset nodes and critical links are visualized using D3.js technology. The software used in this embodiment is IntelliJ IDEA 2020.1.1, and its simulation view is as follows. Figure 3 As shown. In the view, when the mouse hovers over a node, the node name information is displayed. In the control panel view, as... Figure 4 As shown, multiple drop-down menus are used, including one for selecting the seed set, which allows you to choose the input seed set used in the algorithm; another for selecting the sorted size, which adjusts the number of key asset information nodes extracted at the end for displaying the core asset view; and the third adjusts the betweenness centrality weight (corresponding to the weight coefficient W). A ), Adjustment centrality weight (corresponding to the weight coefficient W) B Adjusting the proximity centrality weights (corresponding to the weight coefficient W) C Adjusting the eigenvector centrality weights (corresponding to the weight coefficient W) D The four drop-down option boxes allow users to adjust the values ​​and proportions of the four weight coefficients. Although the comprehensive coefficients are already the most accurate after centrality sorting, this invention still provides users with the ability to interactively adjust the weight values ​​and explore different effects of the visualization system.

[0129] By visualizing core assets, users can intuitively experience the effectiveness of this visual analysis method. They can accurately locate the relevant community based on the seed node set and identify its core assets, while also enjoying interactive and exploratory functions. After making multiple centrality adjustments, users can also intuitively perceive changes in node rankings, making it beneficial for researchers conducting network asset graph visualization studies.

[0130] The beneficial effects of this invention are as follows: First, based on the betweenness centrality, degree centrality, proximity centrality, and eigenvector centrality of each asset information node, this invention employs four node ranking methods to obtain four node ranking results for the same asset subgraph. The similarity coefficient is then calculated, followed by the weight coefficient for node ranking, resulting in a comprehensive coefficient for node ranking. The final ranking result of asset information nodes obtained through this comprehensive coefficient is more accurate, leading to more accurate identification of major asset nodes and key links, thus improving the accuracy of identification. Then, in complex directed graph networks, the LEMON algorithm, a local expansion algorithm that minimizes the first norm, is used to find the community (which is a subgraph in the entire graph) belonging to a seed node. This eliminates reliance on global node calculations, greatly saving memory space and facilitating parallel computing, further improving computational efficiency.

[0131] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for identifying core assets of a specific network, characterized by, The method comprises: S1: obtaining specific network asset information, preprocessing the specific network asset information to obtain a specific network asset graph data set, the specific network asset information being network asset information marked as unsafe or having security risks, specifically including domain names, IP addresses, security certificates and autonomous system numbers marked as unsafe or having security risks; S2: processing the specific network asset graph data set using an overlapping community detection algorithm to obtain an asset subgraph point set; S3: respectively calculating the betweenness centrality, degree centrality, closeness centrality and eigenvector centrality of each asset information node in the asset subgraph point set; S4: According to the betweenness centrality of each asset information node, node sorting is performed on all asset information nodes in the asset subgraph point set, and a node sorting result with a high ranking is obtained A ; S5: According to the degree centrality of each asset information node, the node sorting of all asset information nodes in the asset subgraph point set is performed to obtain a node sorting result with a high ranking B ; S6: According to the closeness centrality of each asset information node, node ranking is performed on all asset information nodes in the asset subgraph point set, and a node ranking result with a high ranking is obtained C ; S7: According to the feature vector centrality of each asset information node, the node sorting of all asset information nodes in the asset subgraph point set is performed to obtain the node sorting result with high ranking D ; S8: ranking results of the nodes A ranking results of the nodes B ranking results of the nodes C ranking results of the nodes D The similarity coefficient of the node ranking is calculated by comparing the node ranking between each two, and the weight coefficient of the node ranking is calculated according to the similarity coefficient. S9: calculating a comprehensive coefficient of the node ranking according to the weight coefficient of the node ranking, and obtaining a final result of the node ranking of all asset information nodes in the asset subgraph point set according to the comprehensive coefficient of the node ranking; S10: obtaining main asset information nodes in the asset subgraph point set according to the final result of the node ranking, and querying key links according to the main asset information nodes, the main asset information nodes and the key links constituting core assets of a specific network subgraph.

2. The method of claim 1, wherein, In step S1, the network asset information graph data set includes a network asset information node point set and a link edge set of specific network asset information, and the network asset information node point set and the link edge set are specifically node.csv point set and link.csv edge set.

3. The method for identifying core assets of a specific network according to claim 1, characterized in that, In step S1, the preprocessing includes: adding a digital index to the network asset information node set of the specific network asset information, and searching data according to the index; if there is incorrect content in the field of the digital index, modifying the incorrect field content, and correcting the data in combination with the field description.

4. The method of claim 1, wherein the core assets of the specific network are identified by the steps of: In step S2, the overlapping community detection algorithm uses a local expansion algorithm with a minimum one-norm, and the implementation steps of the local expansion algorithm with a minimum one-norm include: ​ S201. Randomly obtain a plurality of seed asset information nodes, input the seed asset information nodes into a local expansion algorithm model of minimizing a norm, and generate a local spectrum V k,l； S202. According to the local spectrum V k,l A new set of seed asset information nodes S' is obtained. S203. Reseeding: inputting the seed asset information node set S' into the local expansion algorithm model with a minimum one-norm, iteratively calculating, and updating the seed asset information node set S'; S204. Obtain the vertex set of the seed asset information node set S', and calculate the conductance of the vertex set When the minimum value of the conductance is calculated, terminate the iteration, and obtain the target community; S205. Obtaining an asset subgraph point set S' including the seed asset information node according to the target community.

5. The method of claim 1, wherein the core assets of the specific network are identified by the steps of: The betweenness centrality, degree centrality, closeness centrality and eigenvector centrality of each asset information node are normalized to obtain normalized betweenness centrality, degree centrality, closeness centrality and eigenvector centrality. ​ 6. The method according to any one of claims 1-5, wherein, In step S8, the similarity coefficient of the node ranking has a specific calculation formula: ， ， wherein, denotes a similarity coefficient of node ranking, n denotes the number of asset information nodes, and is a positive integer, denotes whether the asset information nodes with the ranking position of in the two node ranking results are the same, denotes the asset information node with the ranking position of in one node ranking result, denotes the node with the ranking position of in another node ranking result, , respectively denote two different node ranking results, and specifically any one of the node ranking result A , the node ranking result B , the node ranking result C , and the node ranking result D .

7. The method for identifying core assets of a specific network according to claim 6, characterized in that, In step S8, the weight coefficient of the node ranking has a specific calculation formula: ， , and ; wherein, denotes a weight coefficient for ranking nodes according to betweenness centrality, denotes a weight coefficient for ranking nodes according to degree centrality, denotes a weight coefficient for ranking nodes according to closeness centrality, denotes a weight coefficient for ranking nodes according to eigenvector centrality, denotes a similarity coefficient of the node ranking result A and the node ranking result B, denotes a similarity coefficient of the node ranking result A and the node ranking result C, denotes a similarity coefficient of the node ranking result A and the node ranking result D, denotes a similarity coefficient of the node ranking result B and the node ranking result C, denotes a similarity coefficient of the node ranking result B and the node ranking result D, denotes a similarity coefficient of the node ranking result C and the node ranking result D.

8. The method for identifying core assets of a specific network according to claim 7, characterized in that, In step S5, the comprehensive coefficient of the node ranking has a specific calculation formula: ， wherein, denotes a comprehensive coefficient of node ranking, denotes a normalized betweenness centrality, denotes a normalized degree centrality, denotes a normalized closeness centrality, denotes a normalized eigenvector centrality.

9. The method of claim 1, wherein the core assets of the specific network are identified by the steps of: The core assets of the specific network subgraph are visualized to obtain a core asset view of the specific network subgraph. ​

Images