Method, device and equipment for constructing network security knowledge graph and storage medium

Abstract

The application provides a network security knowledge graph construction method and device, equipment and a storage medium. The method comprises: acquiring a plurality of source data in a preset time period, the source data comprising entities, relationships and labels; performing entity knowledge fusion on the entities based on the subordination relationship between the entities and the unique identifiers corresponding to each entity, to obtain fused entities; performing relationship knowledge fusion on the relationships according to the fused entities, to obtain an entity relationship graph; and associating the labels with the fused entities and relationships based on the mapping relationship between the unique identifiers of the entities associated with the labels and the fused identifiers of the entities, to generate a network security knowledge graph. The application defines entities, relationships and labels, performs knowledge fusion on the entities and relationships, and associates the labels with the fused entities and relationships to generate a network security knowledge graph, thereby improving the accuracy of network security knowledge graph construction.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to a method, apparatus, device, and storage medium for constructing a network security knowledge graph. Background Technology

[0002] Knowledge graphs are a series of diverse graphics that display the development process and structural relationships of knowledge. They use visualization techniques to describe knowledge resources and their carriers, and to mine, analyze, construct, draw, and display knowledge and the relationships between them. Knowledge graphs combine theories and methods from applied mathematics, computer graphics, information visualization, and information science with methods such as bibliometric citation analysis and co-occurrence analysis. By using visualized graphs to vividly display the core structure, development history, cutting-edge fields, and overall knowledge architecture of a discipline, knowledge graphs achieve the goal of multidisciplinary integration, providing practical and valuable references for disciplinary research.

[0003] Cybersecurity knowledge graphs are used to describe concepts, entities, events, and their relationships in objective cyberspace, and represent the application of knowledge graphs in the cybersecurity field. Current technologies for constructing cybersecurity knowledge graphs are mostly based on alert data. However, some alert data cannot be segmented into triplet information (source, destination, relationship), thus preventing these alert data from being mapped into the cybersecurity knowledge graph and resulting in inaccurate construction of the cybersecurity knowledge graph. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, device, and storage medium for constructing a network security knowledge graph, so as to improve the accuracy of network security knowledge graph construction.

[0005] In a first aspect, embodiments of this application provide a method for constructing a network security knowledge graph, including:

[0006] Retrieves multiple data entries within a preset time period. The data includes entities, relationships, and tags. The data is obtained by extracting security data generated by security devices. Relationships include the hierarchical relationships between entities.

[0007] Based on the hierarchical relationships between entities and the unique identifiers corresponding to each entity, entity knowledge fusion is performed on the entities to obtain fused entities; the fused entities include fused identifiers;

[0008] Based on the merged entities, relational knowledge is fused to obtain an entity relational graph;

[0009] Based on the entity relationship graph, the network security knowledge graph is generated by associating tags with entities and relationships after knowledge fusion according to the mapping relationship between the unique identifier of the entity associated with the tag and the entity's fusion identifier.

[0010] This application's embodiments define entities, relationships, and tags, perform knowledge fusion on entities and relationships, and associate tags with the fused entities and relationships to generate a network security knowledge graph. This solves the problem that the information displayed in security alerts is one-sided and difficult to map to the knowledge graph, thus improving the accuracy of network security knowledge graph construction.

[0011] In any embodiment, the entity, the relationship, and the label are defined with types; the domain of the entity type includes at least one of the system domain, the network domain, and the security domain.

[0012] In any embodiment, the system entities include hosts, processes, files, emails, mailboxes, registry entries, registry values, and accounts; the network entities include domain names, IP addresses, ports, and command pipes; and the security entities include vulnerabilities.

[0013] This application embodiment facilitates data extraction from data generated by security devices by predefining entity types.

[0014] In any embodiment, the type of relationship also includes behavioral relationships; behavioral relationships include multiple types of loading drivers, influencing, process access, process injection, creating, updating, deleting, calling, listening, setting, network connection, renaming, receiving emails, sending emails, remote login, querying domain names, owning domain names, and email attachments.

[0015] This application embodiment facilitates the extraction of corresponding relationships from data generated by security devices by predefining the types of relationships.

[0016] In any embodiment, the tags include multiple types such as suspicious, DNS server, FPT server, web server, and malicious.

[0017] This application embodiment achieves the mapping of alarm data to knowledge graph by defining the type of predefined tags, thus solving the problem that alarm information may not be able to be split into triples.

[0018] In any embodiment, entity knowledge fusion is performed on the entities based on the hierarchical relationships between entities and the unique identifiers corresponding to each entity to obtain fused entities, including:

[0019] The order of entity knowledge fusion is determined based on the hierarchical relationships between entities;

[0020] Based on the fusion order, knowledge fusion is performed on entities sequentially according to their unique identifiers to obtain the fused entities.

[0021] In this embodiment of the application, since there is a subordinate relationship between some entities, some entities need to rely on the data after the fusion of their subordinate entities when performing entity knowledge fusion. Therefore, entity knowledge fusion can be performed based on a certain fusion order, which improves the success rate of fusion.

[0022] In any embodiment, the entity type is host; knowledge fusion is performed on the entities sequentially based on their respective unique identifiers, including:

[0023] Group the data of host entities with the same hostname into one group;

[0024] For the same set of data, each field in the data is merged to obtain merged data, and a merged identifier corresponding to the host entity is generated based on the merged data.

[0025] This application embodiment reduces redundancy of entities in the knowledge graph by first performing knowledge fusion on the host, and on the other hand, enables the fused host to have more comprehensive attribute information.

[0026] In any embodiment, the entity type is an IP address; knowledge fusion is performed on the entities sequentially based on their unique identifiers, including:

[0027] Based on the dynamic host configuration DHCP record table, obtain the association table of IP address and MAC address;

[0028] The host corresponding to the IP address is matched with the host corresponding to the MAC address. If the match is successful, the host is merged using the MAC address to obtain the merge identifier corresponding to the host.

[0029] Replace the unique identifier of the host corresponding to the IP address with the converged identifier, and generate a unique identifier after IP convergence based on the unique identifier of the IP address and the host.

[0030] In this embodiment of the application, after the entity knowledge fusion is completed, the IP address knowledge fusion can also be performed. On the one hand, this reduces the redundancy of entities in the knowledge graph, and on the other hand, it makes the fused IP address have more comprehensive attribute information.

[0031] In any embodiment, the entity type is port; knowledge fusion is performed on the entities sequentially based on their unique identifiers, including:

[0032] Query the unique identifier of the IP address corresponding to the port after IP convergence, and replace the unique identifier of the IP address corresponding to the port with the unique identifier of the IP convergence.

[0033] The port data is grouped according to the unique identifier of the IP after convergence and the port number corresponding to the port, and then the port data is merged according to the group to obtain the merged port data.

[0034] After the IP address fusion is completed, the port knowledge fusion can be performed in this embodiment of the application, so that the unique identifier and port number of the same IP address are merged into one port.

[0035] In any embodiment, the entity type includes at least one of file, registry key, process, account, and named pipe; knowledge fusion is performed on the entities sequentially based on their respective unique identifiers, including:

[0036] Obtain the merged unique identifier of the host corresponding to the entity;

[0037] Replace the unique identifier of the host corresponding to the entity with the merged unique identifier;

[0038] Entity data is grouped based on the merged unique identifier, and knowledge fusion is performed based on the grouping.

[0039] After completing the knowledge fusion of entities, the embodiments of this application can perform knowledge fusion using at least one of files, registry entries, processes, accounts, and named pipes, thereby reducing the redundancy of entities in the generated entity relationship graph.

[0040] In any embodiment, the entity type is mailbox or email; knowledge fusion is performed on the entities sequentially based on their respective unique identifiers, including:

[0041] Entity data is grouped using preset fields corresponding to the entities, and knowledge fusion is performed based on the grouping.

[0042] In this embodiment, mailboxes and emails are not subordinate to the host. Therefore, the order of knowledge fusion for them can be before or after host knowledge fusion, or it can be performed in parallel with the host, thereby reducing the redundancy of entities in the generated entity relationship graph.

[0043] In any embodiment, relational knowledge fusion is performed on the relations based on the fused entities, including:

[0044] Replace the unique identifier of the source entity corresponding to the relationship with the unique identifier of the merged source entity, and replace the unique identifier of the destination entity corresponding to the relationship with the unique identifier of the merged destination entity;

[0045] Divide the preset time period into multiple time intervals;

[0046] Relationships that belong to the same time interval and have the same attributes are merged into one relationship, and the frequency of the relationship is counted as an attribute of the merged relationship.

[0047] This application embodiment fuses relationships based on both time and the attribute values ​​of the changed relationships, thereby reducing the number of edges and thus reducing useless data.

[0048] In any embodiment, the method further includes:

[0049] The pre-defined rule expressions are matched with the entity relationship graph to determine the target entities and / or target relationships that are successfully matched.

[0050] Label the target entity and / or target relationship with the corresponding rule expression.

[0051] This application embodiment enriches the tags of entities and relationships, making the tags of entities and relationships more abundant and accurate.

[0052] Secondly, embodiments of this application provide an event tracing method, including:

[0053] Obtain event information to be traced and analyzed, the event information including the corresponding entity;

[0054] Based on the entities, the events are traced and analyzed from the network security knowledge graph; wherein the network security knowledge graph is constructed using the network security knowledge graph construction method described in the first aspect.

[0055] This application embodiment analyzes and traces security events based on a pre-built network security knowledge graph, thereby quickly determining the path and source of security events.

[0056] Thirdly, embodiments of this application provide an apparatus for constructing a network security knowledge graph, comprising:

[0057] The data acquisition module is used to acquire multiple pieces of source data within a preset time period. The source data includes entities, relationships, and tags. The source data is obtained by data extraction from data generated by security devices. The types of entities, relationships, and tags are predefined.

[0058] The entity knowledge fusion module is used to perform entity knowledge fusion on the entities based on the subordinate relationship between entities and the unique identifier corresponding to each entity, to obtain the fused entity; the fused entity includes a fusion identifier.

[0059] The relational knowledge fusion module is used to perform relational knowledge fusion on the relations based on the fused entities to obtain an entity relational graph;

[0060] The tag association module is used to associate the tags with entities and relationships after knowledge fusion based on the entity relationship graph and according to the mapping relationship between the unique identifier of the entity associated with the tag and the fusion identifier of the entity, thereby generating a network security knowledge graph.

[0061] Fourthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a bus, wherein,

[0062] The processor and the memory communicate with each other via the bus;

[0063] The memory stores program instructions that can be executed by the processor, and the processor can execute the method of the first aspect or the second aspect by calling the program instructions.

[0064] Fifthly, embodiments of this application provide a non-transitory computer-readable storage medium, comprising:

[0065] The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the method of the first aspect or the second aspect.

[0066] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing embodiments of this application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0067] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 A schematic diagram illustrating a method for constructing a network security knowledge graph, provided in an embodiment of this application;

[0069] Figure 2 This application provides a schematic diagram of a network security knowledge graph.

[0070] Figure 3 A schematic diagram illustrating the entity knowledge fusion sequence provided in this application embodiment;

[0071] Figure 4 A knowledge fusion logic diagram of relationships provided for embodiments of this application;

[0072] Figure 5 This is a schematic diagram of an event tracing method provided in an embodiment of this application;

[0073] Figure 6 A schematic diagram of a device for constructing a network security knowledge graph provided in an embodiment of this application;

[0074] Figure 7 This is a schematic diagram of an event tracing device provided in an embodiment of this application;

[0075] Figure 8 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0076] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0077] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0078] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0079] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0080] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0081] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0082] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0083] Compared to traditional cybersecurity, emerging security risks are highly concealed, and their attack intensity, density, and destructiveness are gradually increasing, making the cybersecurity situation increasingly severe. Traditional security threats such as Trojans, botnets, and phishing attacks are on the rise, becoming increasingly organized and targeted. Advanced Persistent Threats (APTs) continue to launch persistent attacks on internal security. The number of vulnerabilities reported is rapidly increasing, and the number of vulnerabilities reported in enterprise asset reports is also numerous, often overwhelming operations personnel with vulnerability remediation tasks. There is no effective presentation of access relationships and alert relationships between internal assets, making it difficult to intuitively show the correlation between assets over a period of time; a visual representation is needed. Furthermore, because security logs from various sources are not integrated, the same asset is identified inconsistently in different security logs, making it difficult to correlate security events.

[0084] To address the aforementioned issues, this application provides a method for constructing a network security knowledge graph. This method constructs a network security knowledge graph by monitoring the behavioral relationships between security entities within the network and the attributes of the entities themselves. This solves the problem that some alarm data cannot be split into triples, thus preventing mapping to the knowledge graph and providing a clear view of the behavioral relationships between internal enterprise assets.

[0085] It is understood that the network security knowledge graph construction method provided in this application embodiment can be applied to electronic devices, including terminals and servers; wherein the terminal can specifically be a smartphone, tablet computer, computer, personal digital assistant (PDA), etc.; the server can specifically be an application server or a web server.

[0086] Figure 1This is a schematic diagram of a method for constructing a network security knowledge graph provided in an embodiment of this application, such as... Figure 1 As shown, the method includes:

[0087] Step 101: Obtain multiple source data within a preset time period. The source data includes entities, relationships, and tags. The source data is obtained by extracting security data generated by security devices. Relationships include the hierarchical relationships between entities.

[0088] Specifically, the data from security devices can include security logs generated on the devices. Each security device can send the generated security data to a designated location via syslog, achieving the purpose of data collection from multiple security devices. Before storing the data in the designated location, this embodiment uses ETL tools to customize data processing logic scripts for different data sources, extracting different entities, relationships, and tags from the source data and storing them in a knowledge access library. For example, a Python-based data extraction script written using Airflow can be used to extract data; a single line of data may be split into multiple entities and relationships, and then written to the designated location. It should be noted that different data sources have different data formats, therefore the data extraction scripts will also differ. This embodiment does not limit the specific data extraction script, as long as it can extract entities, relationships, and tags from the data.

[0089] In entity extraction, the common logic is the generation of unique identifiers. In this embodiment, a unique identifier is generated for each extracted entity according to its identifiable attributes, and the source and destination of the relationship are both represented by the unique identifier of the entity.

[0090] The preset time period can be set according to actual needs, such as 1 day, 2 days, 1 week, etc.

[0091] The types of entities, relationships, and labels are predefined. The specific types of entities, relationships, and labels are explained below:

[0092] The types of each entity and their corresponding attributes are as follows:

[0093] The entity type belongs to at least one of the following domains: systems, networking, and security. The systems domain includes at least one of the following entities:

[0094] Host: host_name—The host name in the local area network, a unique identifier for the host; os_name—The name of the operating system on the host; os_version—The version number of the operating system on the host; host_uuid—A unique UUID that identifies the host, an identifier generated after knowledge fusion, identifying a unique host; mac—MAC address.

[0095] Process: host_uuid—unique identifier of the host; process_user—username that started the process; process_cmd—command line arguments executed at startup; process_name—process name; process_path: indicates the storage location of the executable file associated with the process on the disk; process_id: process number, a unique identifier of the process at the current time in the system; process_creation_time: process creation time; process_terminate_time: process termination time; process_uuid: a unique identifier after process merging. If this content is not found in the data source log, it is generated based on host_uuid + process_path + process_cmd.

[0096] File: host_uuid—unique identifier for the host; file_path—absolute path of the file; file_md5—MD5 hash of the file; file_create_time—file creation time; file_is_executable—whether the file is executable, such as a Windows .exe file, the content is a boolean; signature—name of the digital signer; file_uuid: unique identifier for the file, generated by host_uuid + file_path.

[0097] Email: mail_uuid—Unique identifier for the email, generated by email subject + sending time + sender; mail_subject—Email subject; mail_from—Sender address; mail_body—Email content; mail_attachment—Email attachment name; mail_send_time—Email sending time.

[0098] Email address: mailbox_address — email address; mailbox_uuid — email address generation.

[0099] Registry key: host_uuid—unique identifier of the host; reg_key_uuid—unique identifier of the registry key; reg_key_path—path of the registry key; reg_key_create_time—creation time of the registry key; reg_key_delete_time—deletion time of the registry key.

[0100] Registry values: host_uuid—unique identifier for the host; reg_key_uuid—unique identifier for the registry key; reg_value_uuid—unique identifier for the registry value, generated by reg_key_uuid + value_name; value_name—registry value name; value—registry value data content; reg_value_create_time—registry value creation time; reg_value_delete_time—registry value deletion time.

[0101] Account: account_uuid—A unique identifier for an account on the host, generated by host_uuid + account_name; account_name—Account name; host_uuid—A unique identifier for the host.

[0102] The network domain includes at least one of the following entities:

[0103] Domain name: domain—domain name; domain_uuid—unique identifier generated based on the domain.

[0104] IP address: ipv4 — IPv4 address; ipv6 — IPv6 address; host_uuid — the unique identifier of the host pointed to by the IP address; ip_uuid — a unique identifier generated by combining ipv4, ipv6, and host_uuid.

[0105] Port: ip_uuid — the IP address to which the port belongs. When a host starts listening on a port, it will specify the IP range to which it belongs; port_num — the port number; port_uuid — the unique identifier of the port.

[0106] Command pipes: host_uuid—a unique identifier of the host to which the command pipe belongs; pipe_name—the name of the pipe; pipe_uuid—a unique identifier of the named pipe, composed of host_uuid and pipe_name.

[0107] The security domain includes vulnerable entities:

[0108] Vulnerability: host_uuid—This refers to the unique identifier of the host where the vulnerability exists; vuln_name—Vulnerability name; cve—CVE number; confidence_impact—Confidentiality impact; integrity_impact—Integrity impact; availability_impact—Availability impact; authentication—User authentication; pri_req—Permission requirements; user_interaction—User interaction; attack_vector—Attack vector; attack_complexity—Attack complexity, this indicator reflects the complexity of an attacker exploiting this vulnerability; vuln_severity—Vulnerability severity level.

[0109] It should be noted that in practical applications, all or some of the above entities can be selected as the objects of data extraction, and other types of entities can be added according to the actual situation. Furthermore, the attribute information corresponding to each entity can be adjusted according to the actual situation.

[0110] The types and attributes of relations (edges) are defined below:

[0111] Relationships can be divided into two main categories: subordinate relationships, which do not have attributes; and behavioral relationships, which are more varied and represent a specific computer behavior.

[0112] The subordinate relationships are as follows:

[0113] Belongs to: Belongs to relationships, involving the following entities: (process) - [belongs to] -> (host); (registry key) - [belongs to] -> (host); (file) - [belongs to] -> (host); (command pipe) - [belongs to] -> (host); (IP) - [belongs to] -> (host); (port) - [belongs to] -> (IP); (registry value) - [belongs to] -> (registry key); (account) - [belongs to] -> (host), etc.

[0114] Parent process: Points to the parent process of the source process (process) - [parent process] -> (process).

[0115] The behavioral relationships are as follows:

[0116] Load driver: (Host) - [Load Driver] -> (File);

[0117] Impact: (Vulnerability) - [Impact] -> (Host);

[0118] Process access: Actions such as a process opening a target process, accessing and modifying data in the target process's memory, etc. (Process) - [Process access] - (Process);

[0119] Process injection: A method of executing arbitrary code in the address space of an independent active process, running code within the context of another process. (Process) - [Process Injection] -> (Process);

[0120] Create: (Process) - [Create] -> (File), (Process) - [Create] -> (Named Pipe), (Process) - [Create] -> (Registry Key), (Process) - [Create] -> (Registry Value);

[0121] Update: (Process) - [Update] -> (File);

[0122] Deletion: (Process) - [Delete] -> (File), (Process) - [Delete] -> (Registry Value), (Process) - [Delete] -> (Registry Key);

[0123] Invocation: For example, to invoke a DLL dynamic library, (process) - [Invocation] -> (file);

[0124] Listening: (Process) - [Listen] -> (Port);

[0125] Settings: (Process) - [Settings] -> (Registry Values);

[0126] Network connection: Includes attributes such as protocol and occurrence time, (process) - [network connection] -> (port), (IP) - [network connection] -> (port);

[0127] Rename: (File) - [Rename] -> (File);

[0128] Receive emails: (Process) - [Receive Emails] -> (Emails);

[0129] Send email: (Email) - [Send Email] -> (Email);

[0130] Remote login: (IP) - [Remote Login] -> (Account);

[0131] To query a domain name: (Process) - [Query Domain Name] -> (Domain Name), (IP) - [Query Domain Name] -> (Domain Name);

[0132] Owning a domain name: (IP) - [Owning a domain name] -> (domain name);

[0133] Email attachments: (email) - [email attachments] -> (files).

[0134] It should be noted that the above definition of relationship types can be reduced or other relationships added according to the actual situation.

[0135] Security device alerts are generated partly using machine learning, but largely based on security rule matching. This includes traffic containing attack characteristics, processes calling monitored interfaces, file MD5 hashes or domain names matching threat intelligence blacklists, and traffic exceeding set thresholds. Therefore, rule-based alerts often rely on matching only certain features, and not all alerts can be broken down into a triple (source, destination, relation). For example, alerts like "XX IP queried a malicious domain" or "Malicious file Y exists on host X" cannot be broken down into a triple. However, these alerts are based on computer elements—suspicious content found in normal computer entities or behaviors, as outlined earlier. Currently, some solutions try to extract the "attacker" entity and the "attack" behavior from alerts. However, in practice, the direction of the "attack" side is difficult to define, and the "attacker" overlaps with many entity types, such as "IP" and "host." Therefore, this application embodiment realizes the mapping of alarms to the knowledge graph space by pre-defining tags. By labeling entities and relationships with tags such as "suspicious", "malicious", and "tampered", the alarm information is mapped to specific entities in the graph, solving the problem that alarm information may not be able to be split into triples.

[0136] On the other hand, hosts within an enterprise often possess certain business attributes related to their services, such as DNS servers, web servers, database platforms, and office machines. These are specific business attributes defined by the administrator. Since the business attributes of a single host can be diverse, it is difficult to distinguish the business attributes of a particular host in a real production environment. For example, a mail server and a web server might reside on the same host. Therefore, defining ontology types using business attributes is not very feasible. However, in this embodiment, by adding business tags to existing entities, business characteristics can be mapped to the knowledge graph space, allowing multiple business tags to be added to the same host or IP address.

[0137] Furthermore, compared to ontology and relations, tags are more flexible and extensible, allowing for the addition of any tags to the knowledge graph as needed.

[0138] The predefined tags are as follows:

[0139] Suspicious: Based on the alarm information, the corresponding edges and nodes are labeled "suspicious". The label includes attributes such as alarm name, evidence information, and severity level.

[0140] DNS server: Mark DNS server;

[0141] FTP server: Marks the host as having FTP service;

[0142] Web server: Marks the host as having a web service;

[0143] Malicious: Matching threat intelligence information to label IPs, domains, files, etc. as "malicious".

[0144] Step 102: Based on the hierarchical relationship between entities and the unique identifier corresponding to each entity, perform entity knowledge fusion to obtain the fused entity; the fused entity includes the fusion identifier.

[0145] Because knowledge in knowledge graphs requires data cleaning, knowledge extraction, and knowledge fusion, knowledge fusion can bring heterogeneous data together to point to the same entity. Furthermore, behavioral data in security data is dynamically generated and voluminous; without proper knowledge fusion, it would contain a lot of noise and the number of edges in behavioral relationships would be exceptionally large, placing considerable pressure on knowledge reasoning and storage. Therefore, entity knowledge fusion and relational knowledge fusion are necessary for the extracted source data.

[0146] Because some entities have hierarchical relationships, entity knowledge fusion can be performed in a specific order, based on the unique identifiers of the entities, and generating a fusion identifier for each entity after fusion. The purpose of entity fusion is to reduce redundancy in the knowledge graph and to achieve cross-knowledge source information integration. By fusing knowledge from different sources, entity information can be supplemented and completed, making the knowledge graph more comprehensive and providing richer knowledge content.

[0147] Step 103: Based on the merged entities, perform relational knowledge fusion on the relations to obtain an entity relation graph.

[0148] Since both ends of a relationship are entities, after the knowledge fusion of entities is completed, the knowledge fusion of relationships can be performed to merge identical relationships into one relationship, reducing information redundancy.

[0149] After the knowledge fusion of entities and relationships is completed, the fused entities and relationships can be imported into a graph database. The graph database improves the performance of data import by creating unique identifiers for entities as indexes.

[0150] Step 104: Based on the entity relationship graph, according to the mapping relationship between the unique identifier of the entity associated with the tag and the entity's fusion identifier, associate the tag with the entity and relationship after knowledge fusion to generate a network security knowledge graph.

[0151] In the specific implementation process, since tags are applied to both entities and relationships, after the knowledge fusion of entities and relationships is completed, the entities and relationships can be re-tagged. When matching tags, the fused entity corresponding to the tag is found based on the correspondence between the unique identifier of the entity associated with the tag and the fusion identifier, and the tag is added to that entity. It should be noted that since entities and relationships are fused, there may be multiple identical tags for the same entity or relationship. In this case, only one tag needs to be retained.

[0152] Figure 2 This application provides a schematic diagram of a network security knowledge graph, such as... Figure 2 As shown, this knowledge graph includes various entities, possible relationships between entities, and corresponding tags for the entities and relationships. It should be noted that... Figure 2 This is merely to demonstrate which entities, relationships, and tags can be included in a knowledge graph; it is not generated based on instance data. In practical applications, the entity types, relationship types, and tag types in a knowledge graph may be more diverse than... Figure 2 There may be more or fewer entities, and there may be multiple entities of the same type, as well as various relationships between entities.

[0153] This application's embodiments define entities, relationships, and tags, perform knowledge fusion on entities and relationships, and associate tags with the fused entities and relationships to generate a network security knowledge graph. This solves the problem that the information displayed in security alerts is one-sided and difficult to map to the knowledge graph, thus improving the accuracy of network security knowledge graph construction.

[0154] Based on the above embodiments, entity knowledge fusion is performed on the entities according to the subordinate relationships between entities and the unique identifiers corresponding to each entity to obtain fused entities, including:

[0155] The order of entity knowledge fusion is determined based on the hierarchical relationships between entities;

[0156] Based on the fusion order, knowledge fusion is performed on entities sequentially according to their unique identifiers to obtain the fused entities.

[0157] In the specific implementation process, since some entities have subordinate relationships, the order of entity knowledge fusion can be determined according to these relationships. Entities subordinate to the host include: processes, registry entries, files, command pipes, IP addresses, and accounts. Therefore, host knowledge fusion can be performed first, followed by the knowledge fusion of entities subordinate to the host. Additionally, ports are subordinate to IP addresses, so after completing IP address knowledge fusion, port knowledge fusion can be performed. Registry values ​​are subordinate to registry entries, so registry value knowledge fusion can be performed after completing registry entry knowledge fusion. The order of knowledge fusion for processes, registry entries, files, command pipes, IP addresses, and accounts can be arbitrary; for example, they can be fused in parallel or according to a pre-set order. Email accounts and emails have no subordinate relationship; therefore, the order of knowledge fusion for email accounts and emails can be set according to actual needs, for example, before or after host knowledge fusion, or in parallel with host knowledge fusion. It can also be performed before or after the fusion of other entities; this embodiment does not specifically limit this. Figure 3 This is a schematic diagram of the entity knowledge fusion sequence provided in the embodiments of this application, such as... Figure 3 As shown.

[0158] The knowledge fusion process for each type of entity is explained below;

[0159] Host knowledge fusion: Fusion is performed based on host names within the local area network. Data of host entities with the same host name (i.e., entity data) are placed in the same group. After grouping, the data in each group is fused. During fusion, each field is merged, and the combined fields are used as the fused data for that group. A fusion identifier for the host is then generated based on this fused data. For example, if data A and B belong to the same group, and a field in A is empty while B has a value in that field, then the data for that field in B is taken as the target field data. If neither A nor B has a field that is empty, then the data for that field that is most recent in time is taken as the target field data. All the target field data corresponding to all fields are combined into a new data set, which is used as the fused data, and a new UUID is generated, which is the fusion identifier for the host. Two new rows are added to the entity fusion mapping table, recording that A is mapped to the new UUID and B is mapped to the new UUID.

[0160] IP Address Knowledge Fusion: First, based on the dynamic host configuration DHCP record table, a table of associations between IP addresses and MAC addresses within a specific time period is obtained. This indicates that during a certain time period, this IP address was used by a machine with this MAC address. Then, the host's MAC address is matched. During matching, the host information corresponding to the IP address is compared with the host information corresponding to the MAC address. If the host information matches, a match is found. The host UUID of the IP address is then enriched into a UUID fused with the corresponding MAC address. Specifically, this can be done by fusing the MAC address into the attributes corresponding to the IP address, and then generating the host's UUID based on the fused data. Therefore, the same IPv4 address might appear as two different IP entities in the graph, belonging to different host entities. After generating the new host UUID corresponding to the IP address, it is recorded in the fusion mapping record table. Since the IP_UUID corresponding to the IP address is generated based on IPv4, IPv6, and the host's UUID, a fused IP_UUID corresponding to the IP address can also be generated.

[0161] Port knowledge fusion: First, obtain the IP_UUID attribute value of the port. Based on this IP_UUID attribute value, query the fusion mapping record table for the fused IP_UUID and change the port's IP_UUID to the fused IP_UUID. Then, group the ports according to the fused IP_UUID and port number. For each group, fuse the various attributes of the port data in that group. If multiple data entries have a corresponding value for a certain attribute, the data entry closest to the current time is taken by default. If only one data entry has a value and the other data entries have no value for that attribute, the data entry with the value is taken.

[0162] File knowledge fusion: Based on the fusion mapping record table, the file's host_uuid is changed to the fused host_uuid. Then, the files are grouped according to their host_uuid and file path, and fusion is performed within the same group. It should be noted that the fusion method for data within a group can be found in the section on port knowledge fusion, and will not be repeated here.

[0163] Registry key knowledge fusion: Based on the fusion mapping record table, the host_uuid of the registry key is changed to the fused host_uuid. Then, the keys are grouped according to their host_uuid and registry key paths, and fusion is performed within the same group. It should be noted that the method for fusion of data within a group can be found in the section on port knowledge fusion, and will not be repeated here.

[0164] Registry value knowledge fusion: Based on the fusion mapping record table, the reg_key_uuid in the registry value is changed to the fused reg_key_uuid. Then, the values ​​are grouped according to reg_key_uuid and registry value name, and fusion is performed within the same group. It should be noted that the fusion method for data within a group can be found in the section on port knowledge fusion, and will not be repeated here.

[0165] Process knowledge fusion: Based on the fusion mapping record table, the host_uuid corresponding to the process is changed to the fused host_uuid. Then, the processes are grouped according to host_uuid + process_path + process_cmd, and fusion is performed within the same group. It should be noted that the fusion method for data within a group can be found in the port knowledge fusion section, which will not be repeated here.

[0166] Account knowledge fusion: Based on the fusion mapping record table, the host_uuid corresponding to the account is changed to the fused host_uuid. Then, the data is grouped according to host_uuid + account_name, and fusion is performed within the same group. It should be noted that the fusion method for data within a group can be found in the section on port knowledge fusion, which will not be repeated here.

[0167] Named pipe knowledge fusion: Based on the fusion mapping record table, the host_uuid corresponding to the named pipe is changed to the fused host_uuid. Then, the pipes are grouped according to host_uuid + pipe_name, and fusion is performed within the same group. It should be noted that the method for fusion of data within a group can be found in the section on port knowledge fusion, and will not be repeated here.

[0168] Email knowledge fusion: Data is grouped based on the `mailbox_uuid` attribute value in the knowledge access library, and fusion is performed within the same group. It should be noted that the fusion method for data within a group can be found in the section on port knowledge fusion, and will not be repeated here.

[0169] Email knowledge fusion: Data is grouped based on the `mail_uuid` attribute in the knowledge access library, and fusion is performed within the same group. It should be noted that the fusion method for data within a group can be found in the section on port-based knowledge fusion, and will not be repeated here.

[0170] This application's embodiments, through entity knowledge fusion, can reduce redundancy in knowledge graphs and achieve cross-knowledge source information integration. By fusing knowledge from different sources, entity information can be supplemented and completed, making the knowledge graph more comprehensive and providing richer knowledge content.

[0171] Based on the above embodiments, relational knowledge fusion is performed on the relations according to the fused entities, including:

[0172] Replace the unique identifier of the source entity corresponding to the relationship with the unique identifier of the merged source entity, and replace the unique identifier of the destination entity corresponding to the relationship with the unique identifier of the merged destination entity;

[0173] Divide the preset time period into multiple time intervals;

[0174] Relationships that belong to the same time interval and have the same attributes are merged into one relationship, and the frequency of the relationship is counted as an attribute of the merged relationship.

[0175] In the specific implementation process Figure 4 The knowledge fusion logic diagram of relationships provided in the embodiments of this application, such as Figure 4 As shown. After entity fusion is completed, based on the entity fusion records, the unique identifiers of the source and destination nodes of the relationship are mapped to the fused entity fusion identifier. Then, fusion is performed based on the attributes of the parts of the relationship that have the identifier. Specifically, behavioral edges can be aggregated according to time ranges, where the time range can be set according to actual needs. For example, it can be divided into 24-hour intervals to obtain 24 time intervals. Relationships with the same attributes within the same time interval are merged into a single relationship, and the number of behaviors is counted as an attribute of the newly added fused relationship. It should be noted that the source and destination nodes of relationships that can be fused are the same.

[0176] This application embodiment fuses relationships based on both time and the attribute values ​​of the changed relationships, thereby reducing the number of edges and thus reducing useless data.

[0177] Based on the above embodiments, the method further includes:

[0178] The pre-defined rule expressions are matched with the entity relationship graph to determine the target entities and / or target relationships that are successfully matched.

[0179] Label the target entity and / or target relationship with the corresponding rule expression.

[0180] In practical implementation, besides alarm information from security devices serving as a direct source of tags, this application also employs a rule-based tagging method. This method searches the entity relationship graph for entities or relationships that match the rules and assigns them corresponding business tags. For example, if the rule is set as follows: the network connection protocol is DNS and the destination port is 53, then the IP address to which the destination port belongs, and the host to which the IP address belongs, will be tagged as a DNS server. This leverages the efficient path matching capabilities of the graph database to tag hosts and IPs that meet the conditions as DNS servers.

[0181] This application embodiment enriches the tags of entities and relationships, making the tags of entities and relationships more abundant and accurate.

[0182] Figure 5 This is a schematic diagram of an event tracing method provided in an embodiment of this application, such as... Figure 5 As shown, this solution is implemented based on the network security knowledge graph constructed in the above embodiments, and the method includes:

[0183] Step 501: Obtain the event information to be traced and analyzed. The event information includes the corresponding entity.

[0184] Step 502: Based on entities, perform source tracing analysis of events from the cybersecurity knowledge graph.

[0185] In the specific implementation process, when a security device detects a security event, it obtains the event information corresponding to the security event. This event information includes the corresponding entity. Based on this entity, other entities and relationships related to this entity can be identified from the network security detection graph, thereby determining the attack path and the source of the attack.

[0186] In addition, the network security knowledge graphs constructed in the above embodiments can also be applied in other scenarios, such as finding hosts belonging to the same organization based on the network security graph.

[0187] Figure 6 This is a schematic diagram of a network security knowledge graph construction device provided in an embodiment of this application. The device can be a module, program segment, or code on an electronic device. It should be understood that this device is similar to the one described above. Figure 1 The method implementation corresponds to this and can be executed. Figure 1 The specific functions of the device involved in the various steps of the method embodiment can be found in the description above; to avoid repetition, detailed descriptions are omitted here. The device includes: a data acquisition module 601, an entity knowledge fusion module 602, a relationship knowledge fusion module 603, and a tag association module 604, wherein:

[0188] The data acquisition module 601 is used to acquire multiple pieces of source data within a preset time period. The source data includes entities, relationships, and tags. The source data is obtained by extracting data generated by security devices. The types of entities, relationships, and tags are predefined.

[0189] The entity knowledge fusion module 602 is used to perform entity knowledge fusion on the entities based on the subordinate relationship between entities and the unique identifier corresponding to each entity, to obtain the fused entity; the fused entity includes a fusion identifier.

[0190] The relational knowledge fusion module 603 is used to perform relational knowledge fusion on the relations based on the fused entities to obtain an entity relational graph;

[0191] The tag association module 604 is used to associate the tag with the entities and relationships after knowledge fusion based on the entity relationship graph and according to the mapping relationship between the unique identifier of the entity associated with the tag and the fusion identifier of the entity, thereby generating a network security knowledge graph.

[0192] Based on the above embodiments, the domain to which the entity type belongs includes at least one of the system domain, network domain, and security domain.

[0193] Based on the above embodiments, the system domain includes hosts, processes, files, emails, mailboxes, registry entries, registry values, and accounts; the network domain includes domain names, IP addresses, ports, and command pipes; and the security domain includes vulnerabilities.

[0194] Based on the above embodiments, the types of relationships include subordinate relationships and behavioral relationships; the behavioral relationships include multiple types of loading drivers, influencing, process access, process injection, creation, updating, deletion, calling, listening, setting, network connection, renaming, receiving emails, sending emails, remote login, querying domain names, owning domain names, and email attachments.

[0195] Based on the above embodiments, the tags include multiple types such as suspicious, DNS server, FPT server, WEB server, and malicious.

[0196] Based on the above embodiments, the entity knowledge fusion module 602 is specifically used for:

[0197] The fusion order of entity knowledge fusion is determined based on the subordinate relationships between the entities;

[0198] Based on the fusion order, the entities are sequentially fused according to their unique identifiers to obtain the fused entities.

[0199] Based on the above embodiments, the entity knowledge fusion module 602 is specifically used for:

[0200] Group the data of host entities with the same hostname into one group;

[0201] For the same set of data, each field in the data is merged to obtain merged data, and a merged identifier corresponding to the host entity is generated based on the merged data.

[0202] Based on the above embodiments, the type of the entity is an IP address; the entity knowledge fusion module 602 is specifically used for:

[0203] The association table between the IP address and MAC address is obtained based on the DHCP record table of the dynamic host configuration;

[0204] The host corresponding to the IP address is matched with the host corresponding to the MAC address. If the match is successful, the host is merged using the MAC address to obtain the merging identifier corresponding to the host.

[0205] Replace the unique identifier of the host corresponding to the IP address with the converged identifier, and generate a unique identifier after IP convergence based on the IP address and the unique identifier corresponding to the host.

[0206] Based on the above embodiments, the type of the entity is a port; the entity knowledge fusion module 602 is specifically used for:

[0207] Query the unique identifier of the IP address corresponding to the port after IP fusion, and replace the unique identifier of the IP address corresponding to the port with the unique identifier of the IP fusion.

[0208] The port data is grouped according to the unique identifier of the IP after fusion and the port number corresponding to the port, and the port data is fused according to the group to obtain the fused port data.

[0209] Based on the above embodiments, the entity type includes at least one of file, registry key, process, account, and named pipe; the entity knowledge fusion module 602 is specifically used for:

[0210] Obtain the merged unique identifier of the host corresponding to the entity;

[0211] Replace the unique identifier of the host corresponding to the entity with the merged unique identifier;

[0212] The entity data is grouped based on the fused unique identifier, and knowledge fusion is performed based on the grouping.

[0213] Based on the above embodiments, the type of the entity is email or mail; the entity knowledge fusion module 602 is specifically used for:

[0214] The entity data is grouped using preset fields corresponding to the entity, and knowledge fusion is performed based on the grouping.

[0215] Based on the above embodiments, the relationship knowledge fusion module 603 is specifically used for:

[0216] Replace the unique identifier of the source entity corresponding to the relationship with the unique identifier of the merged source entity, and replace the unique identifier of the destination entity corresponding to the relationship with the unique identifier of the merged destination entity;

[0217] The preset time period is divided to obtain multiple time intervals;

[0218] Relationships that belong to the same time interval and have the same attributes are merged into one relationship, and the frequency of the relationship is counted as an attribute of the merged relationship.

[0219] Based on the above embodiments, the device further includes a tag enrichment module, used for:

[0220] The pre-set rule expressions are matched with the entity relationship graph to determine the target entities and / or target relationships that are successfully matched.

[0221] The tags corresponding to the rule expressions are marked on the target entities and / or the target relationships.

[0222] Figure 7 This is a schematic diagram of an event tracing device provided in an embodiment of this application. The device can be a module, program segment, or code on an electronic device. It should be understood that this device is similar to the one described above. Figure 5 The method implementation corresponds to this and can be executed. Figure 5 The various steps involved in the method embodiment, and the specific functions of the device, can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here. The device includes: an event acquisition module 701 and a tracing module 702, wherein:

[0223] The event acquisition module 701 is used to: acquire event information to be traced and analyzed, wherein the event information includes the corresponding entity;

[0224] The tracing module 702 is used to: perform tracing analysis on events from a network security knowledge graph based on the entity; wherein the network security knowledge graph is constructed using the network security knowledge graph construction method provided in the above embodiments.

[0225] Figure 8 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application, such as... Figure 8 As shown, the electronic device includes: a processor 801, a memory 802, and a bus 803; wherein,

[0226] The processor 801 and the memory 802 communicate with each other through the bus 803;

[0227] The processor 801 is used to call program instructions in the memory 802 to execute the methods provided in the above-described method embodiments, including, for example,: acquiring multiple pieces of source data within a preset time period, the source data including entities, relationships, and tags; the source data is obtained by data extraction from data generated by security devices; the types of entities, relationships, and tags are predefined; performing entity knowledge fusion on the entities based on the subordinate relationships between entities and the unique identifiers corresponding to each entity to obtain fused entities; the fused entities include fusion identifiers; performing relationship knowledge fusion on the relationships based on the fused entities to obtain an entity relationship graph; and, based on the entity relationship graph, associating the tags with the knowledge-fused entities and relationships according to the mapping relationship between the unique identifiers of the entities associated with the tags and the fusion identifiers of the entities, generating a network security knowledge graph.

[0228] The processor 801 can be an integrated circuit chip with signal processing capabilities. The processor 801 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0229] The memory 802 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0230] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by the computer, the computer can execute the methods provided in the above-described method embodiments, such as: acquiring multiple pieces of source data within a preset time period, the source data including entities, relationships, and tags; the source data is obtained by data extraction from data generated by security devices; the types of entities, relationships, and tags are predefined; performing entity knowledge fusion on the entities based on the subordinate relationships between entities and the unique identifiers corresponding to each entity to obtain fused entities; the fused entities include fusion identifiers; performing relationship knowledge fusion on the relationships based on the fused entities to obtain an entity relationship graph; and, based on the entity relationship graph, associating the tags with the knowledge-fused entities and relationships according to the mapping relationship between the unique identifiers of the entities associated with the tags and the fusion identifiers of the entities, generating a network security knowledge graph.

[0231] This embodiment provides a non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the methods provided in the above-described method embodiments. These instructions include, for example,: acquiring multiple pieces of source data within a preset time period, the source data including entities, relationships, and tags; the source data being obtained by data extraction from data generated by a security device; the types of entities, relationships, and tags being predefined; performing entity knowledge fusion on the entities based on their hierarchical relationships and unique identifiers corresponding to each entity to obtain fused entities; the fused entities including a fusion identifier; performing relationship knowledge fusion on the relationships based on the fused entities to obtain an entity relationship graph; and, based on the entity relationship graph, associating the tags with the fused entities and relationships according to the mapping relationship between the unique identifiers of the entities associated with the tags and the fusion identifiers of the entities, generating a network security knowledge graph.

[0232] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0233] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0234] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0235] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0236] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for constructing a network security knowledge graph, characterized in that, include: Acquire multiple source data entries within a preset time period, wherein the source data includes entities, relationships, and tags; The source data is obtained by extracting security data generated by security devices; The relationship includes the subordinate relationship between entities; Based on the subordinate relationships between entities and the unique identifiers corresponding to each entity, entity knowledge fusion is performed on the entities to obtain the fused entities; The merged entity includes a merge identifier; Based on the fused entities, relational knowledge fusion is performed on the relations to obtain an entity relation graph; Based on the entity relationship graph, according to the mapping relationship between the unique identifier of the entity associated with the tag and the fusion identifier of the entity, the tag is associated with the entity and relationship after knowledge fusion to generate a network security knowledge graph. The entity knowledge fusion based on the hierarchical relationships between entities and the unique identifiers corresponding to each entity, to obtain the fused entity, includes: The fusion order of entity knowledge fusion is determined based on the subordinate relationships between the entities; Based on the fusion order, the entities are sequentially fused according to their unique identifiers to obtain the fused entities. The type of the entity is a host; the knowledge fusion of the entities according to their unique identifiers includes: Group the data of host entities with the same hostname into one group; For the same set of data, each field in the data is merged to obtain merged data, and a merged identifier corresponding to the host entity is generated based on the merged data. The entity type is an IP address; the knowledge fusion of the entities according to their unique identifiers includes: The association table between the IP address and MAC address is obtained based on the DHCP record table of the dynamic host configuration; The host corresponding to the IP address is matched with the host corresponding to the MAC address. If the match is successful, the host is merged using the MAC address to obtain the merging identifier corresponding to the host. Replace the unique identifier of the host corresponding to the IP address with the converged identifier, and generate a unique identifier after IP convergence based on the IP address and the unique identifier corresponding to the host; The entity type is port; the knowledge fusion of the entities according to their unique identifiers includes: Query the unique identifier of the IP address corresponding to the port after IP fusion, and replace the unique identifier of the IP address corresponding to the port with the unique identifier of the IP fusion. The port data is grouped according to the unique identifier of the IP after fusion and the port number corresponding to the port, and the port data is fused according to the group to obtain the fused port data.

2. The method according to claim 1, characterized in that, The entity, the relationship, and the label are defined with types; the domain to which the entity's type belongs includes at least one of the system domain, network domain, and security domain.

3. The method according to claim 2, characterized in that, The system domain includes hosts, processes, files, emails, mailboxes, registry entries, registry values, and accounts; the network domain includes domain names, IP addresses, ports, and command pipes; and the security domain includes vulnerabilities.

4. The method according to claim 1, characterized in that, The relationships also include behavioral relationships; these behavioral relationships include multiple types of loading drivers, influencing, process access, process injection, creating, updating, deleting, calling, listening, setting, network connection, renaming, receiving emails, sending emails, remote login, querying domain names, owning domain names, and email attachments.

5. The method according to claim 1, characterized in that, The tags include multiple categories such as suspicious, DNS server, FPT server, WEB server, and malicious.

6. The method according to claim 1, characterized in that, The entity type includes at least one of file, registry key, process, account, and named pipe; the knowledge fusion of the entities according to their respective unique identifiers includes: Obtain the merged unique identifier of the host corresponding to the entity; Replace the unique identifier of the host corresponding to the entity with the merged unique identifier; The entity data is grouped based on the fused unique identifier, and knowledge fusion is performed based on the grouping.

7. The method according to claim 1, characterized in that, The entity type is email or mail; the knowledge fusion of the entities according to their unique identifiers includes: The entity data is grouped using preset fields corresponding to the entities, and knowledge fusion is performed based on the grouping.

8. The method according to claim 4, characterized in that, The step of performing relational knowledge fusion on the relations based on the fused entities includes: Replace the unique identifier of the source entity corresponding to the relationship with the unique identifier of the merged source entity, and replace the unique identifier of the destination entity corresponding to the relationship with the unique identifier of the merged destination entity; The preset time period is divided to obtain multiple time intervals; Relationships that belong to the same time interval and have the same attributes are merged into one relationship, and the frequency of the relationship is counted as an attribute of the merged relationship.

9. The method according to any one of claims 1-7, characterized in that, The method further includes: The pre-set rule expressions are matched with the entity relationship graph to determine the target entities and / or target relationships that are successfully matched. The tags corresponding to the rule expressions are marked on the target entities and / or the target relationships.

10. An event tracing method, characterized in that, include: Obtain event information to be traced and analyzed, the event information including the corresponding entity; Based on the entities, the events are traced and analyzed from the network security knowledge graph; wherein the network security knowledge graph is constructed using the network security knowledge graph construction method as described in any one of claims 1-9.

11. A device for constructing a network security knowledge graph, characterized in that, include: The data acquisition module is used to acquire multiple source data within a preset time period, wherein the source data includes entities, relationships, and tags; The source data is obtained by extracting security data generated by security devices; the relationship includes the subordinate relationship between entities. The entity knowledge fusion module is used to perform entity knowledge fusion on the entities based on the subordinate relationship between entities and the unique identifier corresponding to each entity, so as to obtain the fused entity; The merged entity includes a merge identifier; The relational knowledge fusion module is used to perform relational knowledge fusion on the relations based on the fused entities to obtain an entity relational graph; The tag association module is used to associate the tag with the entities and relationships after knowledge fusion based on the entity relationship graph and according to the mapping relationship between the unique identifier of the entity associated with the tag and the fusion identifier of the entity, thereby generating a network security knowledge graph. The entity knowledge fusion module is specifically used for: The fusion order of entity knowledge fusion is determined based on the subordinate relationships between the entities; Based on the fusion order, the entities are sequentially fused according to their unique identifiers to obtain the fused entities. The type of the entity is a host; The step of sequentially performing knowledge fusion on the entities based on their respective unique identifiers includes: Group the data of host entities with the same hostname into one group; For the same set of data, each field in the data is merged to obtain merged data, and a merged identifier corresponding to the host entity is generated based on the merged data. The entity type is an IP address; the knowledge fusion of the entities according to their unique identifiers includes: The association table between the IP address and MAC address is obtained based on the DHCP record table of the dynamic host configuration; The host corresponding to the IP address is matched with the host corresponding to the MAC address. If the match is successful, the host is merged using the MAC address to obtain the merging identifier corresponding to the host. Replace the unique identifier of the host corresponding to the IP address with the converged identifier, and generate a unique identifier after IP convergence based on the IP address and the unique identifier corresponding to the host; The entity type is port; the knowledge fusion of the entities according to their unique identifiers includes: Query the unique identifier of the IP address corresponding to the port after IP fusion, and replace the unique identifier of the IP address corresponding to the port with the unique identifier of the IP fusion. The port data is grouped according to the unique identifier of the IP after fusion and the port number corresponding to the port, and the port data is fused according to the group to obtain the fused port data.

12. An electronic device, characterized in that, include: Processor, memory, and bus, among which, The processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor can execute the method as described in any one of claims 1-10 by calling the program instructions.

13. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions, which, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-10.

14. A computer program product, characterized in that, It includes computer program instructions, which, when read and executed by a processor, perform the method as described in any one of claims 1-10.

Images