Security vulnerability early warning methods, devices, equipment and media

Abstract

The present invention discloses a security vulnerability early warning method, device, equipment and medium, including: constructing a network knowledge graph based on collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network equipment data; determining a first target node corresponding to the network equipment to be warned in the network knowledge graph, and determining a first network subgraph corresponding to the first target node in the network knowledge graph; outputting early warning information to the network equipment to be warned based on the node importance score of the second target node in the first network subgraph, and the node importance score of the third target node. On the one hand, since the network knowledge graph is constructed by integrating multi-source heterogeneous target network data, it can improve the ability to identify new security vulnerabilities. On the other hand, due to the connection characteristics of the nodes in the knowledge graph, it has the ability to extract valuable information from massive data, and can output relevant early warning information in time.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security vulnerability early warning method, device, equipment and medium. Background Art

[0002] With the continuous development of information technology, the complexity and diversity of network threats have made traditional security defense methods gradually appear inadequate.

[0003] In traditional security defense, rules and pattern matching are often used to detect threats, but this method is difficult to cope with the rapidly evolving threat situation. In addition, the amount of threat information in large-scale network environments is huge, and traditional methods are difficult to extract valuable information from these massive data, making it impossible to output relevant warning information in a timely manner.

[0004] Therefore, we urgently need a method that can perceive the network situation more intelligently and comprehensively. Summary of the invention

[0005] The present invention provides a security vulnerability early warning method, device, equipment and medium to solve the problem that traditional security defense means cannot extract valuable information from massive data and thus cannot output relevant early warning information in a timely manner.

[0006] According to one aspect of the present invention, a security vulnerability early warning method is provided, comprising:

[0007] Constructing a network knowledge graph based on the collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network device data;

[0008] Determine a first target node corresponding to the network device to be warned in the network knowledge graph, and determine a first network subgraph corresponding to the first target node in the network knowledge graph;

[0009] Output warning information to the network device to be warned based on the node importance score of the second target node in the first network subgraph and the node importance score of the third target node; wherein the second target node is a node corresponding to at least one target attack organization in the first network subgraph, and the third target node is a node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability whose vulnerability risk score is greater than a risk score threshold.

[0010] According to another aspect of the present invention, there is provided a security vulnerability early warning device, comprising:

[0011] A network knowledge graph construction module, used to construct a network knowledge graph based on the collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network device data;

[0012] A network subgraph determination module, used to determine a first target node corresponding to the network device to be warned in the network knowledge graph, and to determine a first network subgraph corresponding to the first target node in the network knowledge graph;

[0013] An early warning information output module is used to output early warning information to the network device to be warned according to the node importance score of the second target node in the first network subgraph and the node importance score of the third target node; wherein the second target node is a node corresponding to at least one target attack organization in the first network subgraph, and the third target node is a node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability whose vulnerability risk score is greater than a risk score threshold.

[0014] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security vulnerability early warning method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security vulnerability early warning method described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention constructs a network knowledge graph based on the collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network device data; determines the first target node corresponding to the network device to be warned in the network knowledge graph, and determines the first network subgraph corresponding to the first target node in the network knowledge graph; outputs warning information to the network device to be warned according to the node importance score of the second target node in the first network subgraph and the node importance score of the third target node; wherein the second target node is a node corresponding to at least one target attack organization in the first network subgraph, the third target node is a node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability with a vulnerability risk score greater than a risk score threshold, thereby achieving the effect of outputting warning information to the network device to be warned using the network knowledge graph. On the one hand, since the network knowledge graph is constructed by integrating multi-source heterogeneous target network data, it can improve the ability to identify new security vulnerabilities. On the other hand, due to the connection characteristics of each node in the knowledge graph, it has the ability to extract valuable information from massive data, so that relevant warning information can be output in time.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a security vulnerability early warning method provided in Embodiment 1 of the present invention;

[0023] Figure 2A A flowchart of a security vulnerability early warning method provided in Embodiment 2 of the present invention;

[0024] Figure 2B A schematic diagram of the structure of a network knowledge graph provided in the second embodiment of the present invention;

[0025] Figure 3 A schematic diagram of the structure of a security vulnerability early warning device provided in Embodiment 3 of the present invention;

[0026] Figure 4It is a structural schematic diagram of an electronic device for implementing the early warning method for security vulnerabilities according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", "third", "to be warned", "target", "network", "initial", "auxiliary", "public", "attacked", "history", "risk", "candidate", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 This is a flowchart of a security vulnerability warning method provided in the first embodiment of the present invention. This embodiment is applicable to the case where a network knowledge graph is constructed to output warning information to a network device to be warned. The method can be executed by a security vulnerability warning device, which can be implemented in the form of hardware and / or software, for example, using a server. Figure 1 As shown, the method includes:

[0031] S101. Construct a network knowledge graph based on the collected target network data.

[0032] The target network data is obtained by the server through real-time network data collection through preset security devices, including but not limited to intrusion detection systems (IDS), firewalls, and network traffic analysis tools. The server integrates heterogeneous target network data into a global data set, laying the foundation for the construction of the network knowledge graph. The target network data includes public security vulnerability data, historical attack event data, and network device data.

[0033] Public security vulnerability data refers to security vulnerability data that is already in a public state on the Internet. Public security vulnerability data consists of structured data and unstructured data. Among them, structured data includes but is not limited to CVE (Common Vulnerabilities & Exposures), CPE (Common Platform Enumeration), CWE (Common Weakness Enumeration), CNNVD (China National Vulnerability Database of Information Security) and other data sets. Such structured data can be obtained through crawler scripts on their corresponding official websites. Unstructured data includes but is not limited to CPE description information, vulnerability analysis article information, POC (Proof of Concept) code, EXP (Exploit) code and other network security tools, etc. Such unstructured data can be crawled and downloaded from multiple source websites using the Scrapy library with the help of the Python programming language.

[0034] Historical attack event data refers to the description information of attack events that occurred on the Internet at historical moments, including but not limited to being collected through at least one of the following data sources:

[0035] 1) Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) logs. Logs generated by IDS and IPS contain detailed information about possible attacks, abnormal activities, and blocked events. 2) Firewall logs. Firewall logs contain information about network traffic, connections, and blocked attacks, which helps detect and prevent malicious activities. 3) Network traffic analysis tools. Use network traffic analysis tools to monitor real-time network traffic in order to detect abnormal behavior and potential attack patterns. 4) Security Information and Event Management System (SIEM). SIEM integrates multiple data sources, including IDS / IPS, firewalls, and endpoint security solutions, to provide centralized event management and analysis. 5) Web Application Firewall (WAF) logs. For web applications, logs generated by WAF record information about web application attacks (such as SQL injection and cross-site scripting attacks). 6) Operating system logs. Log files generated by the operating system may contain information about system access, permission changes, and abnormal activities. 7) Network Security Incident Response Platform. Deploy a network security incident response platform to monitor, analyze, and respond to security incidents on the network in real time.

[0036] Network device data is used to describe the various types of hardware network devices and / or software network devices deployed in Internet hosts, as well as the hierarchical relationships between network devices, including but not limited to collection through at least one of the following data sources: 1) Asset management system, which records and tracks all hardware and software assets in the organization, including servers, routers, switches, firewalls, etc. 2) Network device logs, which collect and analyze log files of network devices, including logs of routers, switches, and firewalls, to gain insights into network traffic and events. 3) Configuration management database (CMDB), which uses the configuration management database, which contains detailed information about the configuration of the organization's IT infrastructure, including hardware, software, network devices, etc. 4) Terminal device management system, which uses the terminal device management system to track all terminal devices in the organization, including desktops, laptops, etc.

[0037] In one embodiment, after the server completes the collection of target network data, entity recognition is performed on security vulnerability data, historical attack event data, and network device data, respectively. The entity recognition method includes a rule-based recognition method and / or a model-based recognition method.

[0038] The rule-based identification method refers to identifying characters that meet the data representation rules from the target network data as corresponding entities based on pre-set data representation rules. For example, for "IP-type network devices", there is a clear data representation rule, which is composed of four integers. Each integer has a value range of 0 to 255, and the integers are separated by periods. Then the server can identify the characters that meet the data representation rules from the network device data as "IP-type network devices" based on the data representation rules.

[0039] The model-based identification method refers to the use of entity recognition models trained for three different types of target network data to perform entity recognition. For example, Bert1 model, Bert2 model and Bert3 model are trained for security vulnerability data, historical attack event data, and network equipment data respectively. The Bert1 model is used to identify entities contained in security vulnerability data, the Bert2 model is used to identify entities contained in historical attack event data, and the Bert3 model is used to identify entities contained in network equipment data.

[0040] For example, suppose a historical attack event data is: "Attacker A exploited the SQL injection vulnerability to launch a large number of malicious requests to the host 192.168.xx on XX / XX / XX", then the Bert2 model is used to perform entity recognition on the historical attack event data and output "[1,4], attacker], [[20,24], security vulnerability], [[31,42], network device]". In this example, the 1st to 4th characters indicate that it is an attacker-type entity, the 20th to 24th characters are a security vulnerability-related entity, and the 31st to 42nd characters are a network device entity.

[0041] After the server completes entity recognition of the target network data, it extracts the association relationship of the entities. The relationship extraction relies on the regular relationship of the data itself. For example, a specific CVE security vulnerability number has its own unique network device information, such as:

[0042] The CVE-2022-33666 security vulnerability (a security vulnerability entity), whose affected CPE component (a network device entity) is microsoft:azure_site_recovery_vmware_to_azure, can extract the association between "CVE-2022-33666 security vulnerability" and "microsoft:azure_site_recovery_vmware_to_azure" based on the regular relationship of the data itself.

[0043] On the other hand, relation extraction uses the inclusion relationship between data to extract unstructured target network data. For example, in an alarm log, if an attacker attacks a host and service, the attacker can be associated with the service deployed by the host and the IP and URL of the host. The key to this process is to visualize abstract network information and clarify the relationship between entities through association.

[0044] Based on the above process, the server can identify entities and the associations between entities based on the collected target network data, and then generate nodes based on the identified entities, and generate connection relationships between nodes based on the associations between entities, and then generate a network knowledge graph based on the generated nodes and the connection relationships between nodes. For example, assuming that entity 1, entity 2, entity 3, and entity 4 are identified, where entity 1 has an association relationship with entity 2, and entity 2 has an association relationship with entity 3 and entity 4, then nodes 1, node 2, node 3, and node 4 are generated based on entity 1, entity 2, entity 3, and entity 4, respectively, and a connection relationship is established between node 1 and node 2, and a connection relationship is established between node 2 and node 3 and node 4, to generate a network knowledge graph.

[0045] S102: Determine a first target node corresponding to the network device to be warned in the network knowledge graph, and determine a first network subgraph corresponding to the first target node in the network knowledge graph.

[0046] Among them, the network device to be warned refers to the network device that needs to be warned on the Internet, for example, it can be a server, it can also be an IP address, etc. The network device to be warned can be selected from various network devices according to actual business needs. The first target node refers to the node corresponding to the network device to be warned in the network knowledge graph, that is, the node generated for the network to be warned when the network knowledge graph is constructed. For example, when node A is generated for the network to be warned when the network knowledge graph is constructed, then node A is the first target node corresponding to the network device to be warned in the network knowledge graph. The first network subgraph is composed of nodes in the network knowledge graph that have a direct or indirect connection relationship with the first target node.

[0047] In one embodiment, the server obtains network devices that need to be warned as network devices to be warned, and traverses the node labels corresponding to each node in the network knowledge graph, wherein the node labels record the node names of the corresponding nodes. If it is determined that the node name recorded in the node label of any node matches the device name of the network device to be warned, the node is used as the first target node.

[0048] According to the connection relationship between the first target node and other nodes in the network knowledge graph, other nodes that have a connection relationship with the first target node are obtained from the network knowledge graph, and according to the connection relationship between the first target node, other nodes, and each other node and the first target node, the first network subgraph corresponding to the first target node in the network knowledge graph is determined.

[0049] Among them, the connection relationship between other nodes and the first target node can be a direct connection relationship, that is, the first-level sub-node corresponding to the first target node in the network knowledge graph is taken as the other node, and the first network sub-graph corresponding to the first target node in the network knowledge graph is determined according to the first target node, the first-level sub-node and the connection relationship between each first-level sub-node and the first target node.

[0050] The connection relationship between other nodes and the first target node can also be an indirect connection relationship, that is, in addition to taking the first-level sub-node corresponding to the first target node in the network knowledge graph as other nodes, the multi-level sub-nodes corresponding to the first target node in the network knowledge graph are also taken as other nodes. According to the first target node, the first-level sub-node, the multi-level sub-nodes, the connection relationship between each first-level sub-node and the first target node, and the connection relationship between each multi-level sub-node and the first-level sub-node, the first network sub-graph corresponding to the first target node in the network knowledge graph is determined.

[0051] It can be understood that the multi-level sub-nodes can be second-level sub-nodes, third-level sub-nodes, fourth-level sub-nodes, etc. The specific dimensions of the multi-level sub-nodes need to be set and adjusted according to business needs. If the dimension of the multi-level sub-nodes is too large, it will cause the calculation to run slowly. Correspondingly, if the dimension of the multi-level sub-nodes is too small, the reliability and richness of the final output warning information will be low.

[0052] S103: Output warning information to the network device to be warned according to the node importance score of the second target node in the first network subgraph and the node importance score of the third target node.

[0053] Among them, the second target node is the node corresponding to at least one target attack organization in the first network subgraph, the third target node is the node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability whose vulnerability risk score is greater than the risk score threshold. The target attack organization is composed of at least one attacker who has launched a network attack, which is used to reflect the relevance of these attackers. The vulnerability risk score is used to reflect the degree of danger of the security vulnerability, that is, when the vulnerability risk score of any security vulnerability is high, it means that the security vulnerability is more dangerous; when the vulnerability risk score of any security vulnerability is low, it means that the security vulnerability is less dangerous. The risk score threshold is used to distinguish between high-risk security vulnerabilities and non-high-risk security vulnerabilities. It can be understood that a security vulnerability with a vulnerability risk score greater than the risk score threshold is regarded as a high-risk security vulnerability, that is, the target security vulnerability is a high-risk security vulnerability. The vulnerability risk score can be optionally implemented by including a CVSS score, and accordingly, the risk score threshold can be optionally set to a score of 7.0.

[0054] The node importance score reflects the importance of each node in the first network subgraph. That is, when the node importance score of any node is high, it means that the node is more important in the first network subgraph and has a greater influence on the first network subgraph; when the node importance score of any node is low, it means that the node is less important in the first network subgraph and has a smaller influence on the first network subgraph.

[0055] The warning information refers to information used to prompt the device user of the network device to be warned to protect against security vulnerabilities, including the potential security vulnerabilities of the network device to be warned that may be attacked, and the protection measures corresponding to these potential security vulnerabilities that may be attacked.

[0056] In one embodiment, the server executes a random walk algorithm, such as a PageRank algorithm, based on the first network subgraph, to determine the node importance score of each node in the first network subgraph. Obtain the node importance score of the second target node and the node importance score of the third target node in the first network subgraph, and compare the node importance score of the second target node and the node importance score of the third target node with the importance score threshold, respectively. If it is determined that the node importance score of the second target node and the node importance score of the third target node are both greater than the importance score threshold, it means that the target attack organization is good at using some high-risk security vulnerabilities (such as target security vulnerabilities with vulnerability risk scores greater than the risk score threshold) to attack the network device to be warned, and then mine the security vulnerabilities that can be exploited by the target attack organization according to the connection relationship between each node in the network knowledge graph. These mined security vulnerabilities can be regarded as potential security vulnerabilities that may be attacked by the network device to be warned. Therefore, these mined security vulnerabilities and corresponding protection measures are output to the network device to be warned as warning information, so that the device user of the network device to be warned can perform security protection on the relevant security vulnerabilities based on the warning information.

[0057] The technical solution of the embodiment of the present invention constructs a network knowledge graph based on the collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network device data; determines the first target node corresponding to the network device to be warned in the network knowledge graph, and determines the first network subgraph corresponding to the first target node in the network knowledge graph; outputs warning information to the network device to be warned according to the node importance score of the second target node in the first network subgraph and the node importance score of the third target node; wherein the second target node is a node corresponding to at least one target attack organization in the first network subgraph, the third target node is a node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability with a vulnerability risk score greater than a risk score threshold, thereby achieving the effect of outputting warning information to the network device to be warned using the network knowledge graph. On the one hand, since the network knowledge graph is constructed by integrating multi-source heterogeneous target network data, it can improve the ability to identify new security vulnerabilities. On the other hand, due to the connection characteristics of each node in the knowledge graph, it has the ability to extract valuable information from massive data, so that relevant warning information can be output in time.

[0058] Embodiment 2

[0059] Figure 2A This is a flowchart of a security vulnerability early warning method provided by Embodiment 2 of the present invention. This embodiment further optimizes and expands the above embodiment and can be combined with the above optional implementation methods. Figure 2A As shown, the method includes:

[0060] S201. Construct an initial knowledge graph based on the target network data, and use any two nodes in the initial knowledge graph as the first auxiliary node and the second auxiliary node respectively.

[0061] Among them, the initial knowledge graph refers to the knowledge graph generated only by using the entities and the relationships between entities in the collected target network data. It can be understood that the initial knowledge graph only contains the corresponding nodes generated according to each entity, and the connection relationship between each node generated according to the relationship between each entity. However, the initial knowledge graph can only reflect the relationship between the entities clearly recorded in the target network data, but cannot reflect the hidden relationship between the entities not recorded in the target network data, so it is necessary to further explore the hidden relationship between the entities.

[0062] In one embodiment, after the server completes the collection of the target network data, entity recognition is performed on the security vulnerability data, historical attack event data, and network device data. Among them, the entity recognition method includes a rule-based recognition method and / or a model-based recognition method. After the server completes the entity recognition of the target network data, it extracts the association relationship of the entities therein, identifies the entities and the association relationship between the entities based on the collected target network data, and then generates nodes based on the identified entities, and generates the connection relationship between the nodes based on the association relationship between the entities, and then generates an initial knowledge graph based on the generated nodes and the connection relationship between the nodes.

[0063] The initial knowledge graph is traversed, and any two nodes in the initial knowledge graph are respectively used as the first auxiliary node and the second auxiliary node. It can be understood that the first auxiliary node and the second auxiliary node do not specifically refer to any two nodes in the initial knowledge graph, but generally refer to two different nodes randomly selected from the initial knowledge graph as the first auxiliary node and the second auxiliary node, that is, all combinations of two different nodes in the initial knowledge graph are used as the first auxiliary node and the second auxiliary node.

[0064] S202: Determine a node in the initial knowledge graph that has a connection relationship with the first auxiliary node as a first child node, and a node that has a connection relationship with the second auxiliary node as a second child node.

[0065] In one embodiment, the server traverses the initial knowledge graph, determines a node having a connection relationship with the first auxiliary node as a first child node, and determines a node having a connection relationship with the second auxiliary node as a second child node.

[0066] Among them, the connection relationship between the first child node and the first auxiliary node can be a direct connection relationship, that is, the first-level child node corresponding to the first auxiliary node in the network knowledge graph is used as the first child node; the connection relationship between the first child node and the first auxiliary node can also be an indirect connection relationship, that is, the multi-level child node corresponding to the first auxiliary node in the network knowledge graph is used as the first child node.

[0067] Correspondingly, the connection relationship between the second child node and the second auxiliary node can be a direct connection relationship, that is, the first-level child node corresponding to the second auxiliary node in the network knowledge graph is used as the second child node; the connection relationship between the second child node and the second auxiliary node can also be an indirect connection relationship, that is, the multi-level child node corresponding to the second auxiliary node in the network knowledge graph is used as the second child node.

[0068] It is understandable that the multi-level sub-nodes may be second-level sub-nodes, third-level sub-nodes, fourth-level sub-nodes, ..., and the specific dimensions of the multi-level sub-nodes need to be set and adjusted according to business needs.

[0069] S203: Take the same nodes in the first child node and the second child node as common nodes, and determine the node correlation between the first auxiliary node and the second auxiliary node according to the number of the common nodes.

[0070] In one embodiment, the server compares the first subnode and the second subnode respectively, determines the same nodes in the first subnode and the second subnode as common nodes, and determines the node correlation between the first auxiliary node and the second auxiliary node based on the number of common nodes and the total number of nodes included in the first subnode and the second subnode.

[0071] For example, assuming that the first sub-node includes node 1, node 2, node 3, node 4 and node 5, and the second sub-node includes node 2, node 4, node 5, node 6 and node 7, the same nodes "node 2", "node 4" and "node 5" in the first sub-node and the second sub-node are taken as common nodes. It can be understood that the number of common nodes is "3".

[0072] Optionally, determining the node correlation between the first auxiliary node and the second auxiliary node according to the number of nodes of the common node includes:

[0073] Determine the total number of nodes included in the first child node and the second child node, and determine the common node ratio value based on the node number of the common nodes and the total number of nodes; determine the node correlation between the first auxiliary node and the second auxiliary node based on the common node ratio value.

[0074] In one embodiment, the server determines a node union between the first child node and the second child node, and determines the total number of nodes included in the first child node and the second child node according to the node union. The number of shared nodes is divided by the total number of nodes to calculate the shared node ratio value as the node correlation between the first auxiliary node and the second auxiliary node.

[0075] Exemplarily, assuming that A is the first child node corresponding to the first auxiliary node, and B is the second child node corresponding to the second auxiliary node, the node correlation between the first auxiliary node and the second auxiliary node is:

[0076]

[0077] Among them, |A∩B| represents the number of nodes in the node intersection between the first child node and the second child node, that is, the number of nodes in common. |A∪B| represents the number of nodes in the node union between the first child node and the second child node, that is, the total number of nodes. J(A,B) represents the node correlation between the first auxiliary node and the second auxiliary node.

[0078] By determining the total number of nodes included in the first child node and the second child node, and determining the proportion of common nodes based on the number of common nodes and the total number of nodes; determining the node correlation between the first auxiliary node and the second auxiliary node based on the proportion of common nodes, it is achieved that the node correlation between the first auxiliary node and the second auxiliary node is determined based on the dimension of the proportion of common nodes between the two, thereby ensuring the rationality and accuracy of the determination of node correlation.

[0079] S204: When the node relevance is greater than the relevance threshold, a connection relationship between the first auxiliary node and the second auxiliary node is added to the initial knowledge graph to generate a network knowledge graph.

[0080] In one embodiment, if the server determines that the node correlation between the first auxiliary node and the second auxiliary node is greater than the correlation threshold, the first auxiliary node and the second auxiliary node are determined to be similar nodes, that is, there is a hidden relationship between the first auxiliary node and the second auxiliary node, and then the server adds the connection relationship between the first auxiliary node and the second auxiliary node to the initial knowledge graph to generate a network knowledge graph.

[0081] For example, assuming that the first auxiliary node is the node corresponding to "vulnerability exploitation tool" and the second auxiliary node is the node corresponding to "security vulnerability", if the node correlation between the first auxiliary node and the second auxiliary node is greater than the correlation threshold, then the connection relationship between the first auxiliary node and the second auxiliary node is added to the initial knowledge graph, that is, the connection relationship from the "vulnerability exploitation tool" node to the "security vulnerability" node is "vulnerability exploitation".

[0082] An initial knowledge graph is constructed according to target network data, and any two nodes in the initial knowledge graph are respectively used as the first auxiliary node and the second auxiliary node; the node in the initial knowledge graph that has a connection relationship with the first auxiliary node is determined as the first child node, and the node that has a connection relationship with the second auxiliary node is determined as the second child node; the same nodes in the first child node and the second child node are used as common nodes, and the node correlation between the first auxiliary node and the second auxiliary node is determined according to the number of common nodes; when the node correlation is greater than the correlation threshold, the connection relationship between the first auxiliary node and the second auxiliary node is added to the initial knowledge graph to generate a network knowledge graph, thereby mining the hidden relationship between the nodes in the initial knowledge graph, optimizing and improving the connection relationship between the nodes in the initial knowledge graph, and improving the reliability and integrity of the finally generated network knowledge graph.

[0083] S205. Determine the first target node corresponding to the network device to be warned in the network knowledge graph, and determine the first network subgraph corresponding to the first target node in the network knowledge graph.

[0084] S206: If the node importance score of the second target node and the node importance score of the third target node are both greater than the importance score threshold, the target attack organization is regarded as a high-risk attack organization.

[0085] Among them, if the node importance score of the second target node and the node importance score of the third target node are both greater than the importance score threshold, it means that the target attack organization is good at using some high-risk security vulnerabilities (such as target security vulnerabilities with vulnerability risk scores greater than the risk score threshold) to launch attacks on warning network devices, and the target attack organization is regarded as a high-risk attack organization.

[0086] S207. Nodes in the network knowledge graph that have a connection relationship with the second target node and whose node type is a security vulnerability type are regarded as risk vulnerability nodes, and the security vulnerability corresponding to the risk vulnerability node is determined as a risk security vulnerability.

[0087] In one embodiment, the server determines the nodes in the network knowledge graph that have a connection relationship with the second target node as the nodes to be identified, and screens the nodes to be identified according to their node types, and uses the nodes whose node types are security vulnerability types as risk vulnerability nodes. In addition, the server further determines the security vulnerability corresponding to each risk vulnerability node as a risk security vulnerability.

[0088] S208. Determine the target protection measures associated with the risk security vulnerability based on the association relationship between the candidate security vulnerabilities and the candidate protection measures, and output the risk security vulnerability and the target protection measures as warning information to the network device to be warned.

[0089] In one implementation, the server obtains a preset association relationship between candidate security vulnerabilities and candidate protection measures, matches the risk security vulnerability with the association relationship between the candidate security vulnerability and the candidate protection measures, and uses the candidate protection measures matched with the risk security vulnerability as target protection measures. The server then outputs the risk security vulnerability and the target protection measures as warning information to the network device to be warned.

[0090] If the node importance score of the second target node and the node importance score of the third target node are both greater than the importance score threshold, the target attack organization is regarded as a high-risk attack organization; the node in the network knowledge graph that has a connection relationship with the second target node and whose node type is a security vulnerability type is regarded as a risk vulnerability node, and the security vulnerability corresponding to the risk vulnerability node is determined as a risk security vulnerability; according to the association relationship between the candidate security vulnerability and the candidate protection measures, the target protection measures associated with the risk security vulnerability are determined, and the risk security vulnerability and the target protection measures are output together as warning information to the network equipment to be warned, so as to ensure the timely output of relevant warning information, so as to further enhance the defense and detection capabilities of network security, create a more secure and reliable network environment, and promote the innovation and development of network security technology.

[0091] Optionally, after the target attack organization is identified as a high-risk attack organization, the following is also included:

[0092] The nodes in the network knowledge graph that have a connection relationship with the second target node and whose node type is a network device type are regarded as risk network device nodes, and the network devices corresponding to the risk network device nodes are determined as risk network devices; the risk security vulnerabilities and target protection measures are output to the risk network devices as warning information.

[0093] In one embodiment, if the server determines that the target attack organization is a high-risk attack organization, it further mines nodes that have a connection relationship with the second target node and whose node type is a network device type based on the network knowledge graph. It can be understood that these nodes are also at risk of being attacked by the target attack organization. Therefore, these nodes are regarded as risky network device nodes, and then the network devices corresponding to the risky network device nodes are determined as risky network devices. The server finally outputs the risk security vulnerabilities and target protection measures as warning information to the risky network devices.

[0094] By identifying the nodes in the network knowledge graph that have a connection relationship with the second target node and whose node type is a network device type as risk network device nodes, and determining the network devices corresponding to the risk network device nodes as risk network devices; outputting risk security vulnerabilities and target protection measures as warning information to the risk network devices, in addition to outputting warning information to the network devices to be warned, warning information will also be output to the risk network device nodes that are at risk of being attacked by the target attack organization, further ensuring the comprehensiveness of the warning, which is conducive to further enhancing the network security defense capabilities and creating a more secure and reliable network environment.

[0095] Optionally, construct an initial knowledge graph based on the target network data, including:

[0096] According to the public security vulnerability data, at least one public security vulnerability and the attacked network device affected by the public security vulnerability are identified; nodes corresponding to the public security vulnerability and the attacked network device are generated, and connection relationships are added between the nodes corresponding to the public security vulnerability and the attacked network device to construct an initial knowledge graph.

[0097] In one embodiment, the server parses the public security vulnerability data, identifies at least one public security vulnerability, and the attacked network device affected by each public security vulnerability, and then generates corresponding nodes for each public security vulnerability and each attacked network device, and adds connection relationships between the associated public security vulnerabilities and the attacked network devices to construct an initial knowledge graph.

[0098] At least one public security vulnerability and the attacked network device affected by the public security vulnerability are identified based on the public security vulnerability data; nodes corresponding to the public security vulnerability and the attacked network device are generated, and connection relationships are added between the nodes corresponding to the public security vulnerability and the attacked network device to construct an initial knowledge graph, so that the initial knowledge graph can reflect the information of the public security vulnerability and the attacked network device, as well as the association between the public security vulnerability and the attacked network device, thereby ensuring the richness and comprehensiveness of the information contained in the initial knowledge graph.

[0099] Optionally, construct an initial knowledge graph based on the target network data, including:

[0100] A. Identify historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices based on historical attack event data.

[0101] Among them, historical attackers belong to historical attack organizations, which use historical vulnerability tools to exploit historical security vulnerabilities to launch network attacks on historically attacked network devices.

[0102] In one implementation, the server parses historical attack event data to identify historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices that have associated relationships.

[0103] For example, suppose a target network data is a historical attack organization D including historical attackers A, B, and C, which uses historical vulnerability tool E to exploit historical security vulnerability F to launch a network attack on historical attacked network device G. Then the entities "historical attacker A, B, and C", "historical attack organization D", "historical vulnerability tool E", "historical security vulnerability F", and "historical attacked network device G" can be identified.

[0104] B. Generate nodes corresponding to historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices, and add connection relationships between the nodes corresponding to historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices to construct an initial knowledge graph.

[0105] In one embodiment, the server generates corresponding nodes for historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices, and adds connection relationships between historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices that have associated relationships to construct an initial knowledge graph.

[0106] By identifying historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices based on historical attack event data, nodes corresponding to historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices are generated, and connection relationships are added between the corresponding nodes of historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices to construct an initial knowledge graph, so that the initial knowledge graph can reflect the information of historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices, as well as the association relationship between historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices, thereby ensuring that the initial knowledge graph contains richness and comprehensiveness of information.

[0107] Optionally, construct an initial knowledge graph based on the target network data, including:

[0108] According to the network device data, the target network devices included in the network and the hierarchical relationship between the target network devices are identified; the nodes corresponding to the target network devices are generated, and the connection relationships between the target network devices are added according to the hierarchical relationship between the target network devices to construct an initial knowledge graph.

[0109] In one embodiment, the server parses the network device data, identifies the target network devices included in the network, and the hierarchical relationship between the target network devices, and then generates a corresponding node for each target network device, and adds a connection relationship between the target network devices with an upper and lower hierarchical relationship to construct an initial knowledge graph.

[0110] By identifying the target network devices included in the network and the hierarchical relationship between the target network devices based on the network device data; generating nodes corresponding to each target network device, and adding connection relationships between the target network devices based on the hierarchical relationship between the target network devices to construct an initial knowledge graph, the initial knowledge graph can reflect the information of the target network devices and the hierarchical relationship between the target network devices, thereby ensuring the richness and comprehensiveness of the information contained in the initial knowledge graph.

[0111] Figure 2B A schematic diagram of the structure of a network knowledge graph provided in the second embodiment of the present invention is shown in FIG. Figure 2B As shown, a certain network knowledge graph includes attack event node 200, attack organization node 201, attacker node 202, IP network device node 203, URL network device node 204, service node 205, server node 206, network device node 207, vulnerability exploitation tool node 208, and security vulnerability node 209.

[0112] Among them, the connection relationship between the attack event node 200 and the IP network device node 203, the URL network device node 204 and the network device node 207 is "attack", the connection relationship between the attack event node 200 and the attack organization node 201 is "mapping", the connection relationship between the attacker node 202 and the attack organization node 201 is "belong to", the connection relationship between the attack organization node 201 and the vulnerability exploitation tool node 208 is "use", the connection relationship between the vulnerability exploitation tool node 208 and the security vulnerability node 209 is "vulnerability exploitation", the connection relationship between the URL network device node 204 and the service node 205 is "provide", the connection relationship between the service node 205 and the server node 206 is "deployment", the connection relationship between the IP network device node 203 and the URL network device node 204 is "send data", and the connection relationship between the network device node 207 and the service node 205 is "include".

[0113] It is understandable that Figure 2B It only explains the structure of a certain network knowledge graph, but does not specifically limit the structure of the network knowledge graph.

[0114] Embodiment 3

[0115] Figure 3 This is a schematic diagram of the structure of a security vulnerability early warning device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0116] A network knowledge graph construction module 31 is used to construct a network knowledge graph based on the collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network device data;

[0117] A network subgraph determination module 32 is used to determine a first target node corresponding to the network device to be warned in the network knowledge graph, and to determine a first network subgraph corresponding to the first target node in the network knowledge graph;

[0118] The warning information output module 33 is used to output warning information to the network device to be warned based on the node importance score of the second target node in the first network subgraph and the node importance score of the third target node; wherein the second target node is a node corresponding to at least one target attack organization in the first network subgraph, and the third target node is a node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability whose vulnerability risk score is greater than the risk score threshold.

[0119] Optionally, the network knowledge graph construction module 31 is specifically used for:

[0120] Construct an initial knowledge graph according to the target network data, and use any two nodes in the initial knowledge graph as the first auxiliary node and the second auxiliary node respectively;

[0121] Determine a node in the initial knowledge graph that has a connection relationship with the first auxiliary node as a first child node, and a node that has a connection relationship with the second auxiliary node as a second child node;

[0122] The same nodes in the first child node and the second child node are taken as common nodes, and according to the number of the common nodes, the node correlation between the first auxiliary node and the second auxiliary node is determined;

[0123] When the node relevance is greater than the relevance threshold, the connection relationship between the first auxiliary node and the second auxiliary node is added to the initial knowledge graph to generate a network knowledge graph.

[0124] Optionally, the network knowledge graph construction module 31 is further used for:

[0125] Determine the total number of nodes included in the first child node and the second child node, and determine the proportion of shared nodes according to the number of shared nodes and the total number of nodes;

[0126] The node correlation between the first auxiliary node and the second auxiliary node is determined according to the common node ratio value.

[0127] Optionally, the network knowledge graph construction module 31 is further used for:

[0128] Identify at least one public security vulnerability and an attacked network device affected by the public security vulnerability based on the public security vulnerability data;

[0129] Generate nodes corresponding to public security vulnerabilities and attacked network devices, and add connection relationships between the nodes corresponding to public security vulnerabilities and attacked network devices to construct an initial knowledge graph.

[0130] Optionally, the network knowledge graph construction module 31 is further used for:

[0131] Identify historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices based on historical attack event data; among them, historical attackers belong to historical attack organizations, and historical attack organizations use historical vulnerability tools to exploit historical security vulnerabilities to launch network attacks on historical attacked network devices;

[0132] Generate nodes corresponding to historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices, and add connection relationships between the nodes corresponding to historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices, so as to construct an initial knowledge graph.

[0133] Optionally, the network knowledge graph construction module 31 is further used for:

[0134] Identify target network devices included in the network and the hierarchical relationship between the target network devices according to the network device data;

[0135] Generate a node corresponding to each target network device, and add a connection relationship between each target network device according to the hierarchical relationship between each target network device to construct an initial knowledge graph.

[0136] Optionally, the warning information output module 33 is specifically used for:

[0137] If the node importance score of the second target node and the node importance score of the third target node are both greater than the importance score threshold, the target attack organization is regarded as a high-risk attack organization;

[0138] A node in the network knowledge graph that has a connection relationship with the second target node and whose node type is a security vulnerability type is used as a risk vulnerability node, and the security vulnerability corresponding to the risk vulnerability node is determined as a risk security vulnerability;

[0139] According to the correlation between the candidate security vulnerabilities and the candidate protection measures, the target protection measures associated with the risk security vulnerabilities are determined, and the risk security vulnerabilities and the target protection measures are output together as warning information to the network devices to be warned.

[0140] Optionally, the apparatus further includes a risk network device node, which is specifically used to:

[0141] A node in the network knowledge graph that has a connection relationship with the second target node and whose node type is a network device type is used as a risky network device node, and a network device corresponding to the risky network device node is determined as a risky network device;

[0142] The risk security vulnerabilities and target protection measures are output to the risk network devices as early warning information.

[0143] The security vulnerability early warning device provided in the embodiment of the present invention can execute the security vulnerability early warning method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0144] Embodiment 4

[0145] Figure 4 A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0146] like Figure 4As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0147] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0148] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 executes the various methods and processes described above, such as an early warning method for security vulnerabilities.

[0149] In some embodiments, the early warning method of the security vulnerability can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the early warning method of the security vulnerability described above can be performed. Alternatively, in other embodiments, the processor 41 can be configured to execute the early warning method of the security vulnerability in any other appropriate manner (for example, by means of firmware).

[0150] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0151] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0152] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0153] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0154] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0155] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0156] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0157] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A security vulnerability early warning method, characterized in that: include: Constructing a network knowledge graph based on the collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network device data; Determine a first target node corresponding to the network device to be warned in the network knowledge graph, and determine a first network subgraph corresponding to the first target node in the network knowledge graph; Outputting warning information to the network device to be warned according to the node importance score of the second target node in the first network subgraph and the node importance score of the third target node; wherein the second target node is a node corresponding to at least one target attack organization in the first network subgraph, the third target node is a node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability whose vulnerability risk score is greater than a risk score threshold; The step of constructing a network knowledge graph based on the collected target network data includes: Construct an initial knowledge graph according to the target network data, and use any two nodes in the initial knowledge graph as a first auxiliary node and a second auxiliary node respectively; Determine a node in the initial knowledge graph that has a connection relationship with the first auxiliary node as a first child node, and a node that has a connection relationship with the second auxiliary node as a second child node; taking the same nodes in the first subnode and the second subnode as common nodes, and determining the node correlation between the first auxiliary node and the second auxiliary node according to the number of nodes in the common nodes; In the case where the node relevance is greater than a relevance threshold, a connection relationship between the first auxiliary node and the second auxiliary node is added to the initial knowledge graph to generate the network knowledge graph.

2. The method according to claim 1, characterized in that The determining, according to the number of nodes of the common nodes, the node correlation between the first auxiliary node and the second auxiliary node comprises: Determine the total number of nodes included in the first sub-node and the second sub-node, and determine the proportion of shared nodes according to the number of shared nodes and the total number of nodes; A node correlation between the first auxiliary node and the second auxiliary node is determined according to the common node ratio value.

3. The method according to claim 1, characterized in that The constructing an initial knowledge graph according to the target network data includes: Identifying at least one public security vulnerability and an attacked network device affected by the public security vulnerability according to the public security vulnerability data; Generate nodes corresponding to the public security vulnerability and the attacked network device, and add connection relationships between the nodes corresponding to the public security vulnerability and the attacked network device, so as to construct the initial knowledge graph.

4. The method according to claim 1, characterized in that: The constructing an initial knowledge graph according to the target network data includes: Identify historical attackers, historical attack organizations, historical vulnerability tools, historical security vulnerabilities, and historical attacked network devices according to the historical attack event data; wherein the historical attackers belong to the historical attack organizations, and the historical attack organizations use the historical vulnerability tools to exploit the historical security vulnerabilities to carry out network attacks on the historical attacked network devices; Generate nodes corresponding to the historical attackers, the historical attack organizations, the historical vulnerability tools, the historical security vulnerabilities, and the historical attacked network devices, respectively, and add connection relationships between the nodes corresponding to the historical attackers, the historical attack organizations, the historical vulnerability tools, the historical security vulnerabilities, and the historical attacked network devices, respectively, to construct the initial knowledge graph.

5. The method according to claim 1, characterized in that The constructing an initial knowledge graph according to the target network data includes: Identifying target network devices included in the network and the hierarchical relationship between the target network devices according to the network device data; Generate a node corresponding to each of the target network devices, and add a connection relationship between each of the target network devices according to the hierarchical relationship between the target network devices to construct the initial knowledge graph.

6. The method according to claim 1, characterized in that Outputting warning information to the network device to be warned according to the node importance score of the second target node in the first network subgraph and the node importance score of the third target node includes: If the node importance score of the second target node and the node importance score of the third target node are both greater than the importance score threshold, the target attack organization is regarded as a high-risk attack organization; A node in the network knowledge graph that has a connection relationship with the second target node and whose node type is a security vulnerability type is used as a risk vulnerability node, and a security vulnerability corresponding to the risk vulnerability node is determined as a risk security vulnerability; According to the association relationship between the candidate security vulnerabilities and the candidate protection measures, the target protection measures associated with the risk security vulnerabilities are determined, and the risk security vulnerabilities and the target protection measures are output together as the warning information to the network device to be warned.

7. The method according to claim 6, after the target attack organization is identified as a high-risk attack organization, further comprising: A node in the network knowledge graph that has a connection relationship with the second target node and whose node type is a network device type is used as a risky network device node, and a network device corresponding to the risky network device node is determined as a risky network device; The risk security vulnerability and the target protection measures are output to the risk network device as the warning information.

8. A security vulnerability early warning device, characterized in that: include: A network knowledge graph construction module, used to construct a network knowledge graph based on the collected target network data; wherein the target network data includes public security vulnerability data, historical attack event data, and network device data; A network subgraph determination module, used to determine a first target node corresponding to the network device to be warned in the network knowledge graph, and to determine a first network subgraph corresponding to the first target node in the network knowledge graph; An early warning information output module is used to output early warning information to the network device to be warned according to the node importance score of the second target node in the first network subgraph and the node importance score of the third target node; wherein the second target node is a node corresponding to at least one target attack organization in the first network subgraph, and the third target node is a node corresponding to at least one target security vulnerability in the first network subgraph, and the target security vulnerability is a security vulnerability whose vulnerability risk score is greater than a risk score threshold; The network knowledge graph construction module is specifically used for: Construct an initial knowledge graph according to the target network data, and use any two nodes in the initial knowledge graph as a first auxiliary node and a second auxiliary node respectively; Determine a node in the initial knowledge graph that has a connection relationship with the first auxiliary node as a first child node, and a node that has a connection relationship with the second auxiliary node as a second child node; taking the same nodes in the first subnode and the second subnode as common nodes, and determining the node correlation between the first auxiliary node and the second auxiliary node according to the number of nodes in the common nodes; In the case where the node relevance is greater than a relevance threshold, a connection relationship between the first auxiliary node and the second auxiliary node is added to the initial knowledge graph to generate the network knowledge graph.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security vulnerability early warning method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the early warning method for security vulnerabilities described in any one of claims 1 to 7 when executed.

Images