Vulnerability information recommendation method based on knowledge graph

Abstract

The invention relates to a vulnerability information recommendation method based on a knowledge graph, and belongs to the field of network security. The method comprises the following steps: collecting and integrating vulnerability information, PoC information, repair information, software information and the like; constructing a comprehensive knowledge graph based on the vulnerability data; vulnerability information associated with vulnerabilities is efficiently checked by utilizing the vulnerability knowledge graph; poC information and repair information associated with vulnerabilities are efficiently checked by utilizing a vulnerability knowledge graph; and performing associated query of language types and software names of the vulnerabilities by utilizing the vulnerability knowledge graph. According to the method disclosed by the invention, various scattered vulnerability knowledge in the network can be integrated into the structured knowledge graph, so that a user can conveniently carry out more comprehensive vulnerability analysis, intelligence, PoC information, repair information and the like associated with the vulnerability can be more efficiently queried, and the vulnerability can be more quickly and accurately found and a solution of the vulnerability can be obtained.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically relates to a vulnerability intelligence recommendation method based on knowledge graph. Background Art

[0002] In order to perceive and recognize cyberspace threats from all aspects and angles, the expression of structured threat information adopts 12 components to describe cyber threat information from aspects such as attack mode, attack activity, and action, and establishes knowledge bases such as ATT&CK framework, CAPEC attack mode, and CWE. In addition, there are a large number of open vulnerability libraries on the Internet, such as the US National Vulnerability Database (NVD) and the National Vulnerability Sharing Platform (CNVD). However, most of the existing cyber threat knowledge exists in isolation, lacking a knowledge graph that can fully cover cyber threat information; at the same time, the existing knowledge also has the problems of slow update and incomplete entity relationships. In addition, there is a lack of effective cyber threat knowledge reasoning methods that can provide scientific cyber threat defense decision-making knowledge for countries and enterprises.

[0004] The knowledge graph was proposed by Google in 2012. It is a multi-sided relationship graph based on nodes and edges, which is used to represent the relationships and attributes between entities. Each node represents an entity, such as a person, place, event, or concept, while the edge represents the relationship between entities. These relationships can be hierarchical relationships, association relationships, attribute relationships, etc. The advantage of the knowledge graph is that it can integrate scattered multi-source heterogeneous data to form a unified knowledge network. By linking entities and relationships in different data sources, the knowledge graph can provide more comprehensive and accurate knowledge representation and query capabilities. It can help us better understand the correlation and contextual information between entities, thereby supporting data analysis, knowledge mining, and intelligent reasoning. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] The technical problem to be solved by the present invention is how to provide a vulnerability intelligence recommendation method based on knowledge graph to solve the problems of low utilization value of existing vulnerability data, insufficient vulnerability semantics, and lack of analysis methods.

[0007] (II) Technical solution

[0008] In order to solve the above technical problems, the present invention proposes a vulnerability intelligence recommendation method based on knowledge graph, which includes the following steps:

[0009] S1. Collect and integrate vulnerability data, including vulnerability information, PoC information, repair information and software information;

[0010] S2. Build a comprehensive knowledge graph based on vulnerability data. The specific steps are as follows:

[0011] S21, data preprocessing: cleaning and preprocessing the collected vulnerability data;

[0012] S22, Entity Recognition: Identify entities in the knowledge graph and their attribute information from the vulnerability data, and assign a unique identifier to each entity; the entity recognition is implemented using the Transformer+CRF named entity recognition model;

[0013] S23, Relationship extraction: Identify the relationships between different entities, thereby building a relationship network between entities and ultimately generating knowledge graph data; the relationship extraction is implemented through a designed relationship extraction model;

[0014] S24, data storage: Based on the obtained entities and relationships, a structured form of vulnerabilities is formed, and the generated knowledge graph data is imported into a graph database for storage, wherein the graph database adopts a Neo4j graph database;

[0015] S3. Use the vulnerability knowledge graph to efficiently view vulnerability intelligence associated with vulnerabilities and display them visually;

[0016] S4. Use the vulnerability knowledge graph to efficiently view the PoC information and repair information associated with the vulnerability, and display it visually;

[0017] S5. Use the vulnerability knowledge graph to perform correlation queries on the language type of the vulnerability and the software name, and display the results through graph visualization.

[0018] (III) Beneficial effects

[0019] The present invention proposes a vulnerability intelligence recommendation method based on knowledge graph. The beneficial effects of the present invention are as follows: by constructing a vulnerability knowledge graph of vulnerability data, key information is extracted from fragmented and massive vulnerability data, the utilization value of vulnerability data is improved, and vulnerability semantic information is enriched. In addition, a graph database is used to store graph data and query results to analyze the relationship between vulnerability entities, which improves the analysis efficiency and can dig out hidden knowledge, making up for the shortcomings of analysis methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the main process of the present invention;

[0021] Figure 2 Build a flow chart for the vulnerability knowledge graph;

[0022] Figure 3 This is the structure diagram of the named entity recognition model based on Transformer+CRF;

[0023] Figure 4 Display effect diagrams for vulnerability intelligence, PoC information, and repair information associated with vulnerabilities;

[0024] Figure 5 For PoC information display;

[0025] Figure 6 A knowledge graph showing the association between vulnerability information and software. DETAILED DESCRIPTION

[0026] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0027] In view of the problems that the existing vulnerability data has low utilization value, the vulnerability semantics is not rich enough, and the analysis methods are insufficient, which leads to the inability to efficiently utilize and mine vulnerability intelligence, the present invention solves the problem through the following technical solutions:

[0028] The present invention discloses a vulnerability intelligence recommendation method based on a knowledge graph, which can support the viewing of vulnerabilities and vulnerability intelligence, the viewing of PoC information and repair information associated with vulnerabilities, the viewing of language types associated with vulnerabilities, and the filtering and querying of vulnerability intelligence by software names. The method comprises: (10) collecting and integrating vulnerability information, PoC information, repair information and software information, etc. (20) building a comprehensive knowledge graph based on vulnerability data. (30) efficiently viewing vulnerability intelligence associated with vulnerabilities using the vulnerability knowledge graph. (40) efficiently viewing PoC information and repair information associated with vulnerabilities using the vulnerability knowledge graph. (50) performing an associated query of the language type of vulnerabilities and software names using the vulnerability knowledge graph. The method can integrate various scattered vulnerability knowledge in the network into a structured knowledge graph, so that users can conduct more comprehensive vulnerability analysis, and can more efficiently query vulnerability-related intelligence, PoC information, repair information, etc., so as to achieve faster and more accurate discovery of vulnerabilities and obtaining solutions to vulnerabilities.

[0029] The present invention provides a vulnerability intelligence recommendation method based on knowledge graph, comprising the following steps:

[0030] S1. Collect and integrate vulnerability data, including vulnerability information, PoC information, repair information, and software information.

[0031] Vulnerability information is mainly CVE vulnerability knowledge base information, and PoC information is mainly a kind of test information that is widely used in customer-specific application verification.

[0032] S2. Build a comprehensive knowledge graph based on vulnerability data.

[0033] The specific steps are as follows:

[0034] S21. Data preprocessing: Clean and preprocess the collected vulnerability data, including removing duplicate data, normalizing data formats from different sources, filling in missing information, etc., to ensure the accuracy and consistency of the data. The data format is designed to unify the format of all vulnerability data.

[0035] S22, Entity Recognition: Identify entities in the knowledge graph from the vulnerability data, such as vulnerabilities, software, etc., as well as the attribute information of the entities, and assign a unique identifier to each entity. The entity recognition is mainly implemented through the Transformer+CRF named entity recognition model.

[0036] S23, Relationship extraction: Identify the relationships between different entities, such as the relationship between vulnerabilities and software, the relationship between vulnerabilities and PoC information, etc., so as to build a relationship network between entities and finally generate knowledge graph data. The relationship extraction is implemented by a designed relationship extraction model.

[0037] S24, data storage: Based on the obtained entities and relationships, a structured form of vulnerabilities is formed, and the generated knowledge graph data is imported into a graph database for storage. The graph database of the present invention adopts a Neo4j graph database.

[0038] S3. Use the vulnerability knowledge graph to efficiently view vulnerability intelligence associated with vulnerabilities.

[0039] Use the graph database to efficiently query the vulnerability entities and their attributes in the graph and display them visually.

[0040] S4. Use the vulnerability knowledge graph to efficiently view the PoC information and repair information associated with the vulnerability.

[0041] By using the graph database, the PoC information and repair information associated with the vulnerability entity can be efficiently queried and displayed visually.

[0042] S5. Use the vulnerability knowledge graph to perform correlation query between the language type of the vulnerability and the software name.

[0043] The language types of the vulnerabilities mainly include C / C++, Ruby, Go, Java, Nodejs, .Net, PHP, Python, Shell and database. The software information is mainly filtered and queried at three levels through manufacturer, product name and version number, and the results are displayed through graph visualization.

[0044] Embodiment 1:

[0045] The design of the present invention proposes a vulnerability intelligence recommendation method based on knowledge graph, such as Figure 1 As shown, the method of the present invention comprises the following steps:

[0046] (10) Collect and integrate vulnerability data, including vulnerability information, PoC information, repair information, and software information.

[0047] Vulnerability information: Vulnerability information is mainly obtained from the CVE knowledge base. CVE (Common Vulnerabilities and Exposures) stands for Common Vulnerabilities and Exposures, which is a list of publicly disclosed network security vulnerabilities. IT personnel and security researchers consult CVE to obtain detailed information on vulnerabilities, and then determine the priority of vulnerability resolution based on vulnerability scores. In CVE, each vulnerability is numbered in the form of CVE-1999-0067, CVE-2014-10001, CVE-2014-100001. The CVE number is a unique identifier for identifying vulnerabilities.

[0048] PoC information: PoC (Proof of Concept) is a test widely used for customer-specific application verification, which is a simple implementation or demonstration to prove the existence and exploitability of a specific idea, technology or vulnerability. In the field of computer security, PoC is often used to verify whether the discovered vulnerability actually exists and to show how the vulnerability can be exploited.

[0049] Fix Information: Fix information generally refers to the fix measures released for known security vulnerabilities in software, systems or networks, including hotfixes, patches, updates or other security measures to resolve vulnerabilities and strengthen affected systems.

[0050] Software information: Software information usually refers to various relevant data and details about a specific software. This software information is very important for users to select, install, maintain and upgrade software. Developers or manufacturers usually provide users with complete software information to help users understand software products and better use and maintain them.

[0051] (20) Build a comprehensive knowledge graph based on vulnerability data.

[0052] Further, such as Figure 2 As shown, the specific method of (20) is:

[0053] (21) Data preprocessing: Cleaning and preprocessing the collected vulnerability data, including removing duplicate data, standardizing data formats from different sources, filling in missing information, etc., to ensure the accuracy and consistency of the data.

[0054] It is necessary to design a data format to standardize the vulnerability data in various data sources. The specific vulnerability data format is shown in Table 1:

[0055] Table 1 Vulnerability data format

[0056]

[0057]

[0058] (22) Entity recognition: identifying entities in the knowledge graph, such as vulnerabilities, software, etc., as well as the attribute information of the entities, and assigning a unique identifier to each entity;

[0059] During entity recognition, the processing of text is mainly to automatically identify and classify specific types of text fragments in advance. The present invention mainly uses the Transformer+CRF named entity recognition model for entity recognition.

[0060] The CRF (Conditional Random Fields) model uses its customized feature function to handle a large number of features that are usually required in vulnerability entity recognition. For example, the part of speech of a word, noun, verb, etc.; specific words or phrases, such as "vulnerability", "attack", "buffer overflow", etc.; the context of the text and contextual information related to the vulnerability. It can not only show the dependencies between the observed vulnerability entities, but also the complex dependencies between the states before and after the current observation. For example, the context dependency, the state of the current word may depend on the state of the previous word or the next word. When a word is marked as a vulnerability type, the word that follows it may be a property that describes the vulnerability.

[0061] Define the characteristic function set Φ(a1,...,a m ,b1,...,b m )∈R d To build the CRF model, R d represents the real number space, a=(a1,...,a m ) represents the observation sequence, such as the input vulnerability description text, b=(b1,...,b m ) is expressed as a state sequence, such as the corresponding vulnerability type or attribute of the output. In this way, the CRF model can effectively capture and utilize the various features and dependencies involved in the vulnerability entity recognition process, thereby improving the recognition accuracy. The conditional probability of the state sequence under a given observation sequence can be calculated using the following log-linear formula:

[0062]

[0063] Where b' represents all possible state sequences, and w represents the weight of each feature function.

[0064] The training process of the CRF model is to estimate the parameter w. Assume that there are n labeled data These labeled data can be transformed into a regularized log-likelihood function:

[0065]

[0066] in, is a regularization term used to prevent overfitting. The square sum of parameter w is used to prevent parameter w from being too large. λ is a regularization parameter that controls the weight of the regularization term. λ1||w||1 is also a regularization term used to prevent overfitting. The absolute sum of parameter w is used to make parameter w sparse (i.e., many parameter values ​​tend to zero). λ1 is a regularization parameter that controls the weight of the regularization term.

[0067] The optimal parameters can be solved from Where R d Represents the real number space, and the optimal state sequence

[0068] The network structure of the Transformer model is completely based on the Attention mechanism, using the attention matrix for global comparison, so that it can cover an unlimited attention range. It also has the ability of parallel computing, which greatly improves the computing efficiency. First, the input sequence is linearly transformed to generate three vectors, namely Q (query vector), K (key vector) and V (value vector). Next, these vectors are divided into multiple heads, and each head performs self-attention operations independently. Specifically, each head calculates the dot product between Q and K to measure the correlation between each position, and uses this correlation weight to weight the sum of the V vector. Then, the outputs of all heads are spliced ​​together to form a final output vector, providing rich contextual information for subsequent processing. In the field of vulnerability entity recognition, the Transformer model can be used to automatically identify and classify vulnerability information. The input data is usually descriptive text about the vulnerability, such as vulnerability reports, patch information, or security bulletins. By inputting these text data into the Transformer model, the corresponding Q, K, and V vectors can be generated, which will combine vulnerability-related information to improve the performance of the model. For example, the Q vector can represent the keywords in the vulnerability description, and the K vector and V vector contain relevant contextual information.

[0069] This process can be described by the following three equations:

[0070]

[0071] MultiHead(Q,K,V)=Concat(head1,...,head h )WO

[0072]

[0073] The first formula represents the Attention mechanism, which can calculate the correlation between different parts of the text and identify important pieces of information, such as key terms and technical details in the vulnerability description. The input values ​​are the Q, K, and V vectors generated by linear transformation of the vulnerability description text. The correlation between the query vector and the key vector is measured by calculating the dot product of Q and K, and dividing by the square root of the dimension of the key vector. Prevent the dot product value from being too large. Use the Softmax function to convert the relevance score into a probability distribution to get the attention weight. Finally, use the attention weight to perform a weighted summation on the V vector to get the final Attention output.

[0074] The second formula represents the Multi-HeadAttention mechanism, which captures different subspace features through multiple independent attention heads. Each attention head has its own set of linear transformation parameters. The multi-head mechanism allows the model to analyze text from multiple perspectives and capture information in different subspaces. This is very important for complex vulnerability descriptions because it can identify different types of information, such as vulnerability type, scope of impact, repair method, etc. At the same time, by calculating multiple attention heads in parallel, the model can understand the input data more comprehensively and improve recognition accuracy. For example, one attention head may focus on the technical details in the vulnerability description, while another head may focus on the scope of impact, thereby providing a more comprehensive analysis.

[0075] Each head i Through the third formula, each head has its own linear transformation weight. Applied to Q, K and V vectors respectively. The outputs of all attention heads are concatenated together through the Concat function, and the concatenated results are passed through a linear transformation matrix W O , and get the final multi-head attention output.

[0076] Transformer+CRF named entity recognition model Figure 3 The model shown as a whole consists of three parts: embedding layer, feature extraction layer and label inference layer. The input is the vulnerability description text and the output is the final recognition result.

[0077] The embedding layer consists of two parts: word embedding and coordinate embedding.

[0078] The word embedding representation method can convert words into a numerical form that can be recognized by computers. In this process, an index is first assigned to each different word in the vulnerability description text, and its index is used to replace the words that appear in the vulnerability description text. Next, an embedding matrix E is created, in which the parameter N can be set to represent the length of the vector assigned to each index. Assuming that the length of the vocabulary is M, the embedding matrix is ​​an N×M dimensional matrix. The embedding matrix E is usually generated by random initialization or trained by a fully connected neural network. After obtaining the embedding matrix, the word vector of the vocabulary can be obtained by calculation. For example, for the i-th word, the symbol O i Indicates the corresponding index, through matrix multiplication operation E·O i =e i The embedded word vector e of word i can be obtained i .

[0079] After word embedding, one-dimensional linear convolution can be used to preliminarily extract the features of the input vulnerability text. In this process, a filter is used to slide the window on the data, and multiple convolution operations are performed to gradually extract various features contained in the text data, such as the type and attributes of the vulnerability. This method helps capture local patterns and structural information in the text, so as to better understand and process text data. The calculation formula is as follows:

[0080]

[0081] Among them, L in refers to the size of the input feature map; L out It refers to the result after the convolution operation, pad refers to the size of the padding, which is used to control the size of the output; dilation_rate refers to the dilation rate used to dilate the convolution; convolution_size indicates the length of the convolution window; strides refers to the step size of the convolution.

[0082] Coordinate embedding: Since Transformer uses a multi-head self-attention mechanism, it is impossible to capture the word position characteristics in the text, so it is necessary to manually encode the position. Coordinate embedding mainly encodes the word position, so that the position of the word in the entire sentence and the relative position between words can be represented. The present invention uses sine and cosine functions of different frequencies to encode the position.

[0083] PE(pos,2i)=sin(pos / 10000 2i / d )

[0084] PE(pos,2i+1)=cos(pos / 10000 2i / d )

[0085] Among them, PE is a two-dimensional matrix, pos is the position of the word in the sentence, d is the dimension of the word vector, and i represents a certain dimension of the word vector.

[0086] Feature extraction layer: It mainly uses the Transformer model introduced above, which can well understand the relationship between words and reduce the input of computing resources. The embedded word vector and position encoding generated by the embedding layer are used as the input of the feature extraction layer, and the Transformer model is used to extract features, and the predicted score of each feature label is output to predict the classification of the vocabulary.

[0087] Since the feature label context is basically highly correlated, and the Transformer model uses arbitrary positions in the calculation, and does not pay attention to the sequence order and correlation, the output label score is not necessarily correct, and the legitimacy of the predicted label cannot be guaranteed. Therefore, the CRF model introduced above needs to be used to solve this problem.

[0088] Label inference layer: The label scores output from the feature extraction layer are used as the input of the CRF layer. The log-linear formula of the CRF model introduced above is used to calculate the probability of each label score, and finally the global optimal label sequence is calculated. The CRF layer can automatically learn constraint rules to ensure the rationality of label syntax, and in this way achieve effective inference and prediction of label sequences.

[0089] (23) Relationship extraction: identifying the relationships between different entities, such as the relationship between vulnerabilities and software, the relationship between vulnerabilities and PoC information, etc., so as to build a relationship network between entities;

[0090] The present invention mainly extracts relations through a relation extractor. During the training process of the relation extractor, the initial input positive instance set S + It is divided by a data filter combined with multiple rules. For the training of the relation extractor, a suitable relation extractor architecture is first selected. The present invention selects a CNN model, defines and initializes a relation extractor model RE, and uses an initial positive instance set S +Train a stable relation extractor RE. The model calculates whether the change error between the average loss value of the current iteration and the average loss value of the previous iteration is less than the termination error ε1. If it is less than ε1, the parameters of the model are solidified and the model training reaches a stable state. The goal of training is to enable the model to accurately predict the type of relationship between entity pairs. Through the trained relation extractor, combined with the entity information obtained above, entities can be accurately mined in the text. For example, for the text "there is vulnerability B in software A", because entity recognition has been performed before, the two entities of software A and vulnerability B can be quickly identified. Then, after relation extraction, the relationship between the two entities is determined, that is, the existence relationship between "software A" and "vulnerability B". In this way, a relationship network between entities is continuously constructed to form a knowledge graph.

[0091] Table 2 Relation extraction model training algorithm

[0092]

[0093]

[0094] (24) Data storage: Based on the obtained entities and relationships, a structured form of vulnerabilities is formed, and the generated knowledge graph data is imported into a graph database for storage. The present invention uses a Neo4j database to store knowledge graph data, which facilitates efficient search and visualization of nodes and edges.

[0095] (30) Use the vulnerability knowledge graph to efficiently view vulnerability intelligence associated with vulnerabilities;

[0096] After the vulnerability knowledge graph is stored in the graph database Neo4j, it can be efficiently queried through the graph database query statement. The query statement is similar to MATCH(n)WHERE n.property=value RETURN n. This statement can search for the corresponding node based on the node's properties. Replace "property" with the node's property name and "value" with the property value. This will return all nodes with the specified property value. Encapsulate the query statement into the corresponding method, and by entering the specific CVE number, you can search for the specified vulnerability and display it in a table.

[0097] (40) Use the vulnerability knowledge graph to efficiently view the PoC information and repair information associated with the vulnerability;

[0098] The graph database can not only query the specified vulnerability node, but also efficiently find the PoC information and repair information associated with the vulnerability through related query statements. The query statement is similar to MATCH(a{property:value})-[:REL_TYPE]->(b)RETURN b, where property is replaced with the property name of node a, value is replaced with the value of the property, and REL_TYPE is replaced with the specific relationship type between node a and node b, such as the association between PoC information and vulnerability. This will return all nodes b that start from a through the REL_TYPE type relationship.

[0099] like Figure 4 As shown in Figure 1, when querying the details of the vulnerability node attributes, the PoC information and repair information associated with the vulnerability can also be queried and displayed in a visual way. Figure 5 As shown, the PoC information file can be downloaded and viewed.

[0100] (50) Use the vulnerability knowledge graph to perform correlation query between the language type of the vulnerability and the software name.

[0101] You can also use the knowledge graph to associate vulnerabilities with programming language types and software names. In the present invention, the programming language types associated with vulnerabilities mainly include C / C++, Ruby, Go, Java, Nodejs, .Net, PHP, Python, Shell, and database. Through the knowledge graph query, you can query the vulnerability nodes associated with the language according to the specific language type, select the specified language by providing a list of vulnerability-associated languages, and you can visualize all vulnerabilities associated with the language through a table, and click on a specific vulnerability to see the vulnerability details;

[0102] The invention can also find out the vulnerability information associated with the specified software through the knowledge graph. Due to the wide variety of software, the process of querying software in the present invention is designed as a three-level filtering query. First, the first-level query first filters the software according to the manufacturer information, the second-level query filters according to the specific product name of the software, and the third-level query filters according to the version number of the software. After the three-level query filtering, the uniqueness of the queried software can be ensured.

[0103] When the specified software is found, the vulnerability information associated with the software can be displayed through the knowledge graph through the graph database query. Figure 6 As shown, clicking a node can display specific vulnerability information, thereby realizing the query of vulnerability and software association information and the visualization display function of the graph.

[0104] Embodiment 2:

[0105] The present invention provides a vulnerability intelligence recommendation method based on knowledge graph, and the steps of the method are as follows:

[0106] (10) Collect and integrate vulnerability information, PoC information, repair information, and software information, etc.

[0107] (20) Build a comprehensive knowledge graph based on vulnerability data.

[0108] (30) Use the vulnerability knowledge graph to efficiently view vulnerability intelligence associated with vulnerabilities.

[0109] (40) Use the vulnerability knowledge graph to efficiently view the PoC information and repair information associated with the vulnerability.

[0110] (50) Use the vulnerability knowledge graph to perform correlation query between the language type of the vulnerability and the software name.

[0111] Furthermore, the vulnerability information in (10) is mainly CVE vulnerability knowledge base information, and PoC information is mainly a test widely used in customer specific application verification.

[0112] Furthermore, the division steps of (20) are specifically as follows:

[0113] (21) Data preprocessing: cleaning and preprocessing the collected vulnerability data, including removing duplicate data, normalizing data formats from different sources, filling in missing information, etc., to ensure the accuracy and consistency of the data. The data format is mainly designed to unify all vulnerability data.

[0114] (22) Entity recognition: identifying entities in the knowledge graph, such as vulnerabilities, software, etc., as well as the attribute information of the entities, and assigning a unique identifier to each entity. The entity recognition is mainly implemented through the Transformer+CRF named entity recognition model.

[0115] (23) Relationship extraction, identifying the relationships between different entities, such as the relationship between vulnerabilities and software, the relationship between vulnerabilities and PoC information, etc., so as to build a relationship network between entities. The relationship extraction is implemented through a designed relationship extraction model.

[0116] (24) Data storage: Based on the obtained entities and relationships, a structured form of vulnerabilities is formed, and the generated knowledge graph data is imported into a graph database for storage. The graph database of the present invention adopts a Neo4j graph database.

[0117] Furthermore, in (30), efficiently viewing vulnerability-related vulnerability intelligence refers to using a graph database to efficiently query vulnerability entities and their attributes in the graph and display them visually.

[0118] Furthermore, in (40), efficiently viewing the PoC information and repair information associated with the vulnerability means efficiently querying the PoC information and repair information associated with the vulnerability entity by using a graph database, and displaying them visually.

[0119] Furthermore, in (50), the language types of the vulnerabilities mainly include C / C++, Ruby, Go, Java, Nodejs, .Net, PHP, Python, Shell and database, and the software information is mainly queried at three levels through manufacturer, product name and version number, and the results are displayed through graph visualization.

[0120] The beneficial effects of the present invention are as follows: by constructing a vulnerability knowledge graph of vulnerability data, key information is extracted from fragmented and massive vulnerability data, the utilization value of vulnerability data is improved, and vulnerability semantic information is enriched. In addition, a graph database is used to store graph data and query results to analyze the relationship between vulnerability entities, which improves analysis efficiency and can mine hidden knowledge, making up for the shortcomings of analysis methods.

[0121] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A vulnerability intelligence recommendation method based on knowledge graph, characterized in that: The method comprises the following steps: S1. Collect and integrate vulnerability data, including vulnerability information, PoC information, repair information and software information; S2. Build a comprehensive knowledge graph based on vulnerability data. The specific steps are as follows: S21, data preprocessing: cleaning and preprocessing the collected vulnerability data; S22, Entity Recognition: Identify entities in the knowledge graph and their attribute information from the vulnerability data, and assign a unique identifier to each entity; the entity recognition is implemented using the Transformer+CRF named entity recognition model; S23, Relationship extraction: Identify the relationships between different entities, thereby building a relationship network between entities and ultimately generating knowledge graph data; the relationship extraction is implemented through a designed relationship extraction model; S24, data storage: Based on the obtained entities and relationships, a structured form of vulnerabilities is formed, and the generated knowledge graph data is imported into a graph database for storage, wherein the graph database adopts a Neo4j graph database; S3. Use the vulnerability knowledge graph to efficiently view vulnerability intelligence associated with vulnerabilities and display them visually; S4. Use the vulnerability knowledge graph to efficiently view the PoC information and repair information associated with the vulnerability, and display it visually; S5. Use the vulnerability knowledge graph to perform correlation queries on the language type of the vulnerability and the software name, and display the results through graph visualization.

2. The vulnerability intelligence recommendation method based on knowledge graph according to claim 1, characterized in that: In S1, vulnerability information refers to CVE vulnerability knowledge base information; PoC information refers to test information, which is a simple implementation or demonstration used to prove the existence and exploitability of a specific idea, technology or vulnerability; repair information refers to repair measures released for known security vulnerabilities in software, systems or networks; software information refers to various relevant data and details about specific software.

3. The vulnerability intelligence recommendation method based on knowledge graph according to claim 1, characterized in that: In S21, the collected vulnerability data is cleaned and preprocessed, including removing duplicate data, normalizing data formats from different sources, and filling in missing information to ensure the accuracy and consistency of the data; The standardized data format includes: CVE number, vulnerability description, disclosure time, attack path, attack complexity, permission requirements, impact scope, user interaction, availability, confidentiality, integrity, exploitation, patch status and score.

4. The vulnerability intelligence recommendation method based on knowledge graph according to any one of claims 1 to 3, characterized in that: In S22, the named entity recognition model of Transformer+CRF consists of three parts: an embedding layer, a feature extraction layer, and a label inference layer. The input is the vulnerability description text, and the output is the final recognition result. The embedding layer includes word embedding and coordinate embedding; The word embedding representation method can convert words into numerical forms that can be recognized by computers. In this process, first, an index is assigned to each different word in the vulnerability description text, and its index is used to replace the words that appear in the vulnerability description text. Next, an embedding matrix E is created, in which the parameter N is set to represent the vector length assigned to each index. Assuming that the length of the vocabulary is M, the embedding matrix is ​​an N×M-dimensional matrix. The embedding matrix E is generated by random initialization or by training a fully connected neural network. After obtaining the embedding matrix, the word vector of the word can be obtained by calculation. For the i-th word, the symbol O i Indicates the corresponding index, through matrix multiplication operation E·O i =e i Get the embedded word vector e of word i i ; After word embedding, one-dimensional linear convolution is used to preliminarily extract the features of the input vulnerability text; In this process, a filter is used to slide a window on the data, and various features contained in the text data are gradually extracted through multiple convolution operations; Coordinate embedding: Coordinate embedding encodes the word position so that it can represent the position of the word in the entire sentence and the relative position between words; sine and cosine functions of different frequencies are used to encode the position; PE(pos,2i)=sin(pos / 10000 2i / d ) PE(pos,2i+1)=cos(pos / 10000 2i / d ) Among them, PE is a two-dimensional matrix, pos is the position of the word in the sentence, d is the dimension of the word vector, and i represents a dimension of the word vector; Feature extraction layer: The embedded word vector and position encoding generated by the embedding layer are used as the input of the feature extraction layer, and the Transformer model is used to extract features. The predicted score of each feature label is output to predict the classification of the vocabulary. Label inference layer: The label scores output from the feature extraction layer are used as the input of the CRF layer. The log-linear formula of the CRF model is used to calculate the probability of each label score appearing, and finally the globally optimal label sequence is calculated.

5. The vulnerability intelligence recommendation method based on knowledge graph according to claim 4, characterized in that: The calculation formula for one-dimensional linear convolution is as follows: Among them, L in refers to the size of the input feature map; L out It refers to the result after the convolution operation, pad refers to the size of the padding, which is used to control the size of the output; dilation_rate refers to the dilation rate used to dilate the convolution; convolution_size indicates the length of the convolution window; strides refers to the step size of the convolution.

6. The vulnerability intelligence recommendation method based on knowledge graph according to claim 4, characterized in that: The network structure of the Transformer model is based on the Attention mechanism. First, the input sequence is linearly transformed to generate three vectors, namely the query vector Q, the key vector K, and the V value vector. Next, these vectors are divided into multiple heads, and each head performs self-attention operations independently. Specifically, each head calculates the dot product between Q and K to measure the correlation between each position, and uses this correlation weight to weight the sum of the V vector. Then, the outputs of all heads are spliced ​​together to form a final output vector, which provides rich context information for subsequent processing. This process is described by the following three formulas: MultiHead(Q,K,V)=Concat(head1,...,head h )W O The first formula represents the Attention mechanism, which is used to calculate the correlation between different parts of the text, identify important information fragments, and determine the key terms and technical details in the vulnerability description. The input values ​​are the Q, K, and V vectors generated by linear transformation of the vulnerability descriptive text. The correlation between the query vector and the key vector is measured by calculating the dot product of Q and K, and dividing by the square root of the dimension of the key vector. Prevent the dot product value from being too large; convert the relevance score into a probability distribution through the Softmax function to obtain the attention weight, and finally use the attention weight to perform weighted summation on the V vector to obtain the final Attention output; The second formula represents the Multi-Head Attention mechanism, which captures different subspace features through multiple independent attention heads. Each attention head has its own set of linear transformation parameters. The multi-head mechanism allows the model to analyze text from multiple angles and capture information in different subspaces. Each head i Through the third formula, each head has its own linear transformation weight. Applied to Q, K and V vectors respectively; the outputs of all attention heads are concatenated together through the Concat function, and the concatenated results are passed through a linear transformation matrix W O , and get the final multi-head attention output.

7. The vulnerability intelligence recommendation method based on knowledge graph according to claim 4, characterized in that: In the CRF (Conditional Random Fields) conditional random field model, the feature function set Φ(a1,...,a m ,b1,...,b m )∈R d To build the CRF model, R d represents the real number space, a=(a1,...,a m ) represents the observation sequence, b=(b1,...,b m ) is expressed as a state sequence. In this way, the CRF model can effectively capture and utilize the various features and dependencies involved in the vulnerability entity recognition process; the conditional probability of the state sequence under a given observation sequence is calculated using the following log-linear formula: Where b' represents all possible state sequences, and w represents the weight of each feature function; The training process of the CRF model is to estimate the parameter w. Assume that there are n labeled data. These labeled data can be transformed into a regularized log-likelihood function: in, is a regularization term used to prevent overfitting. The square sum of parameter w is used to prevent parameter w from being too large. λ is a regularization parameter that controls the weight of the regularization term. λ1||w||1 is also a regularization term used to prevent overfitting. The absolute value sum of parameter w is used to make parameter w sparse. λ1 is a regularization parameter that controls the weight of the regularization term. The optimal parameters can be solved from Where R d Represents the real number space, and the optimal state sequence 8. The vulnerability intelligence recommendation method based on knowledge graph according to claim 4, characterized in that: S23 specifically includes: extracting relations through a relation extractor. During the training process of the relation extractor, the initial input positive instance set S + It is divided by a multi-rule joint data filter. For the training of the relation extractor, the relation extractor architecture CNN model is selected, a relation extractor model RE is defined and initialized, and the initial positive instance set S is used. + Train a stable relation extractor RE; the model calculates whether the change error between the average loss value of the current iteration and the average loss value of the previous iteration is less than the termination error ε1. If it is less than ε1, the model parameters are solidified and the model training reaches a stable state; the training goal is to enable the model to accurately predict the relationship type between entity pairs; through the trained relation extractor, combined with the entity information obtained above, the entities can be accurately mined in the text, and then, after relation extraction, the relationship between the two entities is determined, that is, the existence relationship between "software A" and "vulnerability B", thereby continuously building a relationship network between entities and forming a knowledge graph.

9. The vulnerability intelligence recommendation method based on knowledge graph according to claim 8, characterized in that: The S3 specifically includes: after the vulnerability knowledge graph is stored in the graph database Neo4j, efficient query is performed through the graph database query statement; the query statement is encapsulated into a corresponding method, and the specified vulnerability is searched by entering a specific CVE number, and displayed in a table.

10. The vulnerability intelligence recommendation method based on knowledge graph according to claim 8, characterized in that: The S4 specifically includes: efficiently finding out the PoC information and repair information associated with the vulnerability through relevant query statements; when querying the details of the vulnerability node attributes, the PoC information and repair information associated with the vulnerability are also queried and displayed in a visual manner.

Images