Network security knowledge graph key link analysis method

Abstract

The invention relates to a key link analysis method for a network security knowledge graph, and belongs to the field of network security knowledge graph calculation and analysis. According to the method, topological data of network space security knowledge graph nodes and relations are processed in a standardized mode, terrain tags of the network space security knowledge graph nodes are calculated through rules, association analysis is conducted on the nodes with important terrain tags, and the network space security knowledge graph nodes are obtained according to the analysis result. According to the method, vulnerable points, protection points, inevitable points and evasion points in a network are screened out, the nodes serve as input, path analysis is carried out based on graph analysis calculation, key links of the network space security knowledge graph are found and stored, and key link analysis results are arranged in a document report form to be presented. According to the method for analyzing the key links of the network security knowledge graph, the difficulty of analyzing the key links of the network security knowledge graph in the network security field is reduced, and meanwhile, the monitorability and security of a network space are also improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security knowledge graph computing and analysis, and specifically relates to a network security knowledge graph key link analysis method. Background Art

[0002] Cybersecurity refers to the protection of computer systems, network equipment and data from unauthorized access, attack, destruction or leakage through a series of technologies, policies and measures. With the popularization of the Internet and the acceleration of the process of informatization, cybersecurity issues have become increasingly prominent, requiring a comprehensive response to various potential threats and risks.

[0003] In today's information society, as the means of network attacks become increasingly numerous and complex, traditional network security protection methods have become difficult to cope with. In order to solve this problem, network security knowledge graphs have emerged. Network security knowledge graphs are a new type of network security protection method. By constructing the topological structure and association relationships of network nodes, it can better understand and prevent network attacks.

[0004] However, the analysis results of the cybersecurity knowledge graph usually contain a large amount of data, which is very difficult for non-professionals to understand and analyze. In addition, since the analysis of the cybersecurity knowledge graph usually involves the analysis of multiple nodes and relationship data, the analysis process is very difficult and complicated, and there is a lack of simple key link analysis methods. Therefore, how to analyze the links of the cybersecurity knowledge graph data to obtain the key links and present them has become an urgent problem to be solved. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] The technical problem to be solved by the present invention is how to provide a method for analyzing key links in a network security knowledge graph to solve the problem of analyzing the links in network security knowledge graph data to obtain key links and present them.

[0007] (II) Technical solution

[0008] In order to solve the above technical problems, the present invention proposes a network security knowledge graph key link analysis method, which includes the following steps:

[0009] Step S101, standardizing the node relationship topology data of the cyberspace knowledge graph;

[0010] Step S102, calculating the node terrain labels of the cyberspace knowledge graph based on rules;

[0011] Step S103: Analyze the association of nodes in the network space knowledge graph based on terrain labels;

[0012] Step S104: Determine vulnerable nodes in the cyberspace knowledge graph according to the association analysis results, i.e., key nodes that are vulnerable to attack or influence;

[0013] Step S105, screening out vulnerable points, protection points, must-pass points, and avoidance points: further classifying network nodes into vulnerable points, protection points, must-pass points, and avoidance points;

[0014] Step S106, topological path analysis of cyberspace knowledge graph based on graph analysis algorithm: using graph analysis algorithm to deeply analyze the topological path of cyberspace knowledge graph, and explore the communication flow and attack path between key nodes;

[0015] Step S107, presenting the key link analysis results of the cyberspace knowledge graph: clearly presenting the key link analysis results in the cyberspace knowledge graph through data visualization tools and graphical report generation tools.

[0016] (III) Beneficial effects

[0017] The present invention proposes a method for analyzing key links in a network security knowledge graph. The method of the present invention implements a method for analyzing key links in a network security knowledge graph, reduces the difficulty of analyzing key links in a network security knowledge graph in the network security field, and also improves the monitorability and security of the cyberspace. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of a method for analyzing key links in a cyberspace security knowledge graph according to an embodiment of the present invention;

[0019] Figure 2 A standardized node and relationship data structure diagram according to an embodiment of the present invention;

[0020] Figure 3 This is an example diagram of association analysis and key link analysis diagram data according to an embodiment of the present invention;

[0021] Figure 4 An example diagram of the overall process of key link analysis according to an embodiment of the present invention;

[0022] Figure 5 An example diagram presenting the results of key link analysis of the cyberspace security knowledge graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0024] In order to solve this problem, the present invention discloses a method for analyzing key links of a network security knowledge graph. First, the topological data of the nodes and relationships of the network space security knowledge graph are standardized (step S101) to ensure that the necessary basic data is provided for subsequent link analysis. Subsequently, a set of rules are formulated according to business needs, and the terrain labels of the nodes of the network space security knowledge graph are calculated using these rules (step S102), so as to accurately identify the network space nodes that need to be associated with the analysis. Next, an association analysis is performed on the nodes with important terrain labels (step S103), and it is evaluated whether there are a large number of vulnerabilities, viruses and other threats with high threat indexes, and their vulnerability is determined accordingly. According to the analysis results, the vulnerable points in the network are screened out (step S104) and the network nodes that need to be protected, the nodes that must be passed through the key links, and the nodes that need to be avoided are determined according to the business requirements (step S105). Subsequently, these nodes are used as input, and path analysis is performed based on graph analysis calculation (step S106) to discover and store the key links of the network space security knowledge graph. Finally, the key link analysis results are organized into a document report for presentation (step S107).

[0025] The method of the present invention realizes a method for analyzing key links of a network security knowledge graph, reduces the difficulty of analyzing key links of a network security knowledge graph in the network security field, and also improves the monitorability and security of the cyberspace.

[0026] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0027] The invention mainly relates to a method for analyzing key links in a network security knowledge graph. The method mainly includes the following steps:

[0028] Step S101, standardization of node relationship topology data in cyberspace knowledge graph: In cyberspace security analysis, the first step is to standardize node relationship topology data, which is achieved through data cleaning and formatting tools to ensure the consistency and comparability of network data and provide a reliable basis for subsequent analysis. These standardized data can help identify and analyze nodes and their relationships in the network, thereby solving data heterogeneity and inconsistency problems.

[0029] Step S102, rule-based network space knowledge graph node terrain label calculation: The terrain labels of network space nodes are calculated based on predefined rules or algorithms. The purpose of this step is to evaluate and classify the importance and characteristics of nodes and help determine the key nodes in the network structure. The calculation of terrain labels can be done with the help of geographic information system technology or machine learning algorithms to ensure accuracy and efficiency.

[0030] Step S103, association analysis of nodes in the cyberspace knowledge graph based on terrain labels: By performing association analysis on nodes with certain terrain labels, further explore the potential associations and influences between nodes in the network topology. This requires the use of graph analysis and association rule mining algorithms to help discover potential attack paths in the network so as to identify and respond to possible security threats in advance, thereby providing data discrimination basis for the next step.

[0031] Step S104: Determine vulnerable nodes in the network space knowledge graph based on the results of association analysis: Determine vulnerable nodes in the network knowledge graph based on the results of association analysis, that is, key nodes that are vulnerable to attack or influence. This process relies on vulnerability assessment models and centrality indicators in graph theory to ensure that the nodes with the greatest impact on network security are identified so that corresponding protection strategies and security measures can be formulated.

[0032] Step S105, screening out vulnerable points, protection points, necessary points, and avoidance points: further classify network nodes into vulnerable points, protection points, necessary points, and avoidance points, so as to formulate security and optimization strategies in a targeted manner. This classification depends on the rule engine and business requirements.

[0033] Step S106, network space knowledge graph topology path analysis based on graph analysis algorithm: Use graph analysis algorithm to deeply analyze the topology path of network space knowledge graph, explore the communication flow and attack path between key nodes. This method can help optimize the network structure and provide effective security strategies to ensure that the network can respond quickly and resume normal operation when facing threats.

[0034] Step S107, presenting the key link analysis results of the cyberspace knowledge graph: Through data visualization tools and graphical report generation tools, the key link analysis results in the cyberspace knowledge graph are clearly presented to help decision makers understand the complexity and security risks of the network structure and formulate appropriate action plans and strategies to meet future challenges.

[0035] Through the above steps, the analysis of key links in the network security knowledge graph is realized, the work efficiency is improved, the difficulty of network security knowledge graph analysis is reduced, and the key links in the network security knowledge graph can be analyzed and presented more intuitively and intelligently.

[0036] In addition, the network security knowledge graph key link analysis method according to the above embodiment of the present invention may also have the following additional technical features:

[0037] Furthermore, the step S101 may also include data mining, big data analysis and other technologies to extract key data from a large amount of data, and may also expand and optimize the data standardization model.

[0038] Furthermore, the step S102 uses a rule engine to define and apply terrain label calculation rules according to business requirements, so as to adapt to different cyberspace knowledge graph environments.

[0039] Furthermore, the step S103 may also perform time series analysis to understand the dynamic changes in the association of network nodes.

[0040] Furthermore, the step S104 may also perform risk assessment and vulnerability analysis to identify nodes in the network that are vulnerable to attack or have a significant impact.

[0041] Furthermore, the step S105 may also use optimization algorithms such as genetic algorithms and decision support systems to find the combination of vulnerability points, protection points, must-pass points and avoidance points that best meets the business requirements.

[0042] Furthermore, the step S106 may also establish a network performance evaluation model to predict and evaluate the impact of different paths on network performance.

[0043] Furthermore, the step S107 may also support generation of customized analysis reports according to different requirements through an interactive report generation system.

[0044] Embodiment 1:

[0045] The following describes a method for analyzing key links in a network security knowledge graph according to an embodiment of the present invention with reference to the accompanying drawings.

[0046] Figure 1 It is a flowchart of a method for analyzing key links in a network security knowledge graph according to an embodiment of the present invention.

[0047] Step S101: Standardize the node relationship topology data of the cyberspace security knowledge graph.

[0048] The standardization process specifically includes the following steps:

[0049] S1011. Data cleaning and preprocessing: Use data cleaning tools and algorithms, such as the Pandas library in Python or specialized data cleaning software, to process raw network data. Remove duplicate data, handle missing values, correct erroneous data, and ensure data integrity and accuracy.

[0050] Input: original network node and relationship data, which can be stored in CSV, JSON and other formats.

[0051] Output: The cleaned and preprocessed dataset is formatted into structured data suitable for further processing and analysis.

[0052] S1012. Data standardization and normalization: Use standardization and normalization techniques to unify data from different sources and formats into a consistent data model, including unified units, standardized data formats, conversion of data types, etc., to facilitate consistency and comparability of subsequent analysis.

[0053] Input: cleaned dataset, including node identification, relationship type, weight, and other information.

[0054] Output: Standardized and normalized network relationship dataset, ensuring the uniformity and comparability of the data.

[0055] S1013. Network graph construction: Use basic algorithms and data structures of graph theory to construct network topology graphs. Convert standardized data into the form of network graphs, such as adjacency matrices, adjacency lists, or graph structures in graph databases.

[0056] Input: Normalized node and relationship datasets.

[0057] Output: A graph representing the topological structure of the cyberspace security knowledge graph, where nodes represent entities in the network and edges represent the relationships between nodes.

[0058] Step S102: Calculation of node terrain labels of cyberspace security knowledge graph based on rules

[0059] The detailed design of terrain label calculation process includes the following steps:

[0060] 1. Algorithm and rule definition:

[0061] Predefined rules: A set of rules designed to calculate node terrain labels, which can be based on the structural characteristics, connection patterns, etc. of the nodes.

[0062] Machine learning algorithms: Use supervised or unsupervised learning methods, such as clustering, classification, or regression, to identify key nodes and compute their terrain labels.

[0063] 2. Algorithm input and output:

[0064] The input data of the algorithm is as follows:

[0065] Cyberspace knowledge graph: a data structure containing nodes and the relationships between them; the attributes and characteristics of each node, such as content description, relationship type, location information, etc.; rules or algorithms for evaluating the importance and characteristics of nodes.

[0066] The algorithm outputs the following data:

[0067] Terrain label: The terrain label of each node can include: data point, vulnerable point, target point, entry point, key point, etc. according to business requirements.

[0068] 3. Algorithm calculation process:

[0069] Extract node and edge data, as well as attribute data of each node and associated relationship from the cyberspace knowledge graph. According to the predefined rule set or algorithm, the predefined rules can be specified according to the current business needs. For example, in one embodiment of this step, when evaluating each node for the terrain labels at different levels of the cyberspace knowledge graph, different rules can be defined at different levels, such as the rules for vulnerabilities at different levels:

[0070] Platform layer: graph nodes with asset vulnerability greater than or equal to 8;

[0071] Logical layer: graph nodes with asset vulnerability greater than or equal to 8, and nodes on the application layer with a threat count greater than or equal to 3;

[0072] Application layer: graph nodes with asset vulnerability greater than or equal to 8, and nodes on the application layer with a threat count greater than or equal to 4.

[0073] The asset vulnerability comes from the attributes of the nodes in the cyberspace knowledge graph, and the nodes at different levels are reflected through the association relationship data between the nodes.

[0074] When evaluating each node for different levels of the cyberspace knowledge graph, the terrain labels are calculated for each node and each rule based on the node's connectivity, node type, the efficiency and importance of the node in the network; the design of the terrain labels is scalable based on business needs. In one embodiment of this step, the terrain labels are divided into: target points, entry points, vulnerable points, key points, and obstacle points. The design of these terrain labels refers to the relevant concepts in the OCOKA model. According to the results of the rules or algorithms, a terrain label is assigned to each node. These labels represent the specific attributes or importance of the node through classification identification.

[0075] Generate node data with terrain labels for further network analysis or visualization.

[0076] Step S103 performs association analysis on nodes with important terrain labels to assess their vulnerability and threat situations. The detailed design is as follows:

[0077] One embodiment of this step uses the following technique:

[0078] 1. Vulnerability scanning technology:

[0079] Use automated vulnerability scanning tools, such as open source tools Nessus, OpenVAS, or commercial tools Qualys, to scan and analyze target nodes in the cyberspace knowledge graph to identify existing or potential vulnerabilities. Vulnerability scanning technology can detect known vulnerabilities in operating systems, applications, network devices, etc., and provide corresponding repair suggestions and risk assessments.

[0080] 2. Threat Intelligence Analysis:

[0081] Integrate threat intelligence sources, such as public threat databases, intelligence services of security vendors, intelligence from hacker communities, etc. Use intelligence analysis techniques, such as data mining, machine learning algorithms (such as clustering, classification), statistical analysis, etc., to identify vulnerabilities, viruses, or attack types with high threat indexes associated with target nodes.

[0082] The specific implementation steps of threat intelligence analysis technology are as follows:

[0083] (1) Data mining and clustering: Use K-means clustering to group threat intelligence data into different clusters. Each cluster can represent similar attack patterns or threat behaviors. This helps identify whether there are multiple attack sources or similar techniques used by attackers. Use local anomaly factors to identify abnormal activities that are different from other data points, which may indicate new ongoing attacks or unknown threat patterns.

[0084] (2) Machine learning classification: Train machine learning classifiers (such as decision trees, support vector machines, random forests, etc.) to classify threat intelligence data into different threat types or attack categories. These models can learn threat features from historical data and be used to identify new threats. Feature selection techniques are used to determine which threat intelligence features are most important for identifying high-risk threats. This can help optimize the performance and accuracy of the classification model.

[0085] (3) Statistical analysis: Analyze the correlation between different threat types through statistical methods. For example, identify whether a specific type of vulnerability is associated with a known attack behavior, thereby enhancing the accuracy and pertinence of threat intelligence. Use time series analysis methods to identify the periodicity or change trend of threat activities in order to predict future threat patterns and possible attack behaviors.

[0086] 3. Security event log analysis:

[0087] Analyze security event logs associated with target nodes to discover known attack patterns or anomalous behavior.

[0088] The input and output data of this step are as follows:

[0089] enter:

[0090] A list of nodes with important terrain labels, which is obtained from the output of step S102;

[0091] Vulnerability scan results: vulnerability scan report for each node, including vulnerability type, severity, etc.

[0092] Threat intelligence data: Data sources used to analyze potential threats facing nodes.

[0093] Output: Vulnerability assessment report: vulnerability level and risk assessment of each node, based on vulnerability scan results and threat intelligence analysis; including specific threat types and potential impacts faced by key nodes.

[0094] The implementation process of this step is as follows:

[0095] S1031. Vulnerability scanning and assessment: Perform vulnerability scans on each node with a significant terrain tag. Analyze vulnerability scan reports and assess the severity and potential impact of each vulnerability.

[0096] S1032. Threat Intelligence Analysis: Use threat intelligence data for correlation analysis to identify high-risk threats associated with target nodes. Use machine learning or statistical methods to correlate threat intelligence data with node characteristics to understand the potential impact of threats on nodes.

[0097] S1033. Comprehensive Assessment: Generate a comprehensive vulnerability assessment report based on the results of vulnerability scanning, threat intelligence analysis, and security event log analysis. Determine which nodes have a higher threat index and may need to prioritize strengthening protection measures or fixing vulnerabilities.

[0098] S1034. Automated analysis tools: Use automated tools to process large amounts of nodes and complex security data to improve analysis efficiency and consistency.

[0099] The detailed design of step S104 for determining vulnerable nodes in the cyberspace security knowledge graph according to the association analysis results is as follows:

[0100] S1041. During the comprehensive assessment phase, vulnerability scan reports and threat intelligence and other related analysis results have been collected. Each node is assigned a comprehensive security risk assessment that takes into account the severity of the vulnerability, potential impact, and correlation with threat intelligence.

[0101] S1042. Based on the comprehensive evaluation data, calculate the security risk index of each node. This index reflects the overall security threat level faced by the node. According to the security risk index, the nodes are classified into different security levels. These levels include high risk, medium risk and low risk.

[0102] S1043. Set a standard for identifying vulnerable nodes, and select nodes with a security risk index above medium risk as candidate vulnerable nodes.

[0103] Through these steps, the results of association analysis can be used to identify and process vulnerable nodes in the cyberspace security knowledge graph, providing data information for subsequent key link analysis.

[0104] Step S105 aims to classify network nodes, including vulnerable points, protection points, must-pass points, and avoidance points, by using the rule engine and business requirements. The following is the detailed design of this step:

[0105] One embodiment of this step uses the following technique:

[0106] 1. Rule Engine: Rule definition: Develop a set of rules that are based on security, performance, and business requirements to determine the specific attributes and functions of network nodes. Rule execution: Execute these rules using the rule engine to automatically classify and evaluate network nodes.

[0107] Based on the vulnerability database and security patch status, determine whether the node has known vulnerabilities. Based on the criticality of the node in the business process, determine whether it is a protection point or a must-pass point. Based on the location and function of the node, identify whether it is an avoidance point and needs to prevent too much traffic from passing through.

[0108] 2. Data analysis technology: Data collection: Collect network topology data, configuration information, and security event logs. Data analysis: Use data analysis techniques, such as statistical analysis or machine learning algorithms, to help identify and verify the properties of network nodes, such as vulnerability or criticality.

[0109] Vulnerabilities: Based on the rule engine assessment, nodes with security holes or that may be vulnerable to attacks are identified.

[0110] Protection points: Identify key business nodes or data nodes and ensure their security and availability.

[0111] Must-go points: Identify nodes that are critical to the overall business process and ensure their stable and efficient communication.

[0112] Avoidance points: Identify nodes that are not suitable for carrying high traffic or sensitive data, and avoid passing important traffic through these nodes.

[0113] The input and output data of this step are as follows:

[0114] Input: Network topology data: including nodes, connections and their attributes; security vulnerability data: such as CVE database or patch information released by manufacturers.

[0115] Output: Vulnerability list: List the security holes or vulnerable nodes in the network; Protection point list: Identify the key nodes that need special protection and monitoring; Must-pass point list: Identify the key nodes that are indispensable in the business process; Avoidance point list: Identify the nodes that need to be avoided or optimized to avoid affecting the overall network performance or security.

[0116] The specific implementation process of this step is as follows:

[0117] S1051. Data preparation and cleaning:

[0118] Collect and prepare network topology data, security vulnerability information, and business process data.

[0119] S1052. Rule engine configuration:

[0120] Design and configure the rule engine to ensure that nodes can be accurately classified according to the defined rules.

[0121] S1053, Node classification and evaluation:

[0122] The rule engine is executed to classify and evaluate each node, generating a list of vulnerable points, protection points, must-pass points, and avoidance points.

[0123] Step S106: The network space knowledge graph topology path analysis based on the graph analysis algorithm aims to deeply understand the communication flow and potential attack paths between key nodes in the network structure in order to optimize network security strategies and response capabilities. The following is a detailed design:

[0124] This step is mainly implemented using the following technologies:

[0125] 1. Graph model: Use a graph structure to represent the cyberspace knowledge graph, where nodes represent network devices or systems and edges represent connections or communication paths between them.

[0126] 2. Shortest path algorithm: such as Dijkstra algorithm or Floyd-Warshall algorithm, which is used to calculate the shortest path between nodes in order to quickly discover the communication path between key nodes.

[0127] 3. Network flow algorithm: Maximum flow minimum cut algorithm, used to analyze communication traffic and potential bottleneck nodes.

[0128] 4. Path analysis algorithm: Depth-first search (DFS) or breadth-first search (BFS), which is used to find all possible paths from one node to another, including attack paths.

[0129] 5. Graph visualization: Use tools such as Gephi or NetworkX to visualize complex network structures so as to intuitively understand the network topology and path analysis results.

[0130] The input and output data of this step are as follows:

[0131] Input: Cyberspace knowledge graph data, including information about nodes (devices, systems) and edges (connections, communication paths); a list of key nodes that require path analysis.

[0132] Output: Shortest path analysis results: including the shortest path and path length between key node pairs; Attack path analysis results: describing possible attack paths, vulnerabilities or weaknesses that attackers can exploit; Visualization results: visualization of network topology and path diagrams, showing detailed information about the network structure and its security.

[0133] The specific implementation process of this step is as follows:

[0134] S1061. Data preprocessing:

[0135] Convert cyberspace knowledge graph data into a data structure suitable for graph analysis.

[0136] S1062, Path Calculation and Analysis:

[0137] Use the shortest path algorithm to calculate the paths between key node pairs. Use the path analysis algorithm to explore potential attack paths and communication paths.

[0138] S1063. Result analysis and visualization:

[0139] Analyze path analysis results, evaluate security threats and network optimization opportunities, and visualize the results so decision makers can understand and take necessary actions.

[0140] Step S107: Presentation of key link analysis results of the cyberspace security knowledge graph

[0141] The following are the detailed design steps for presenting the key link analysis results of the cyberspace security knowledge graph:

[0142] 1. Determine the data format of the key link analysis results. The present invention uses JSON for data definition and storage. The data format includes necessary fields, such as the key link unique ID, analysis ID, timestamp, source, type, etc.

[0143] Use the MongoDB database to store the key link analysis result data of the network security knowledge graph, and use the python-json tool to support data processing, writing, and exporting.

[0144] 2. Form a set of basic interfaces for network security knowledge graph analysis result report items to provide basic services for report generation.

[0145] Determine the report generation requirements: First, it is necessary to clarify the requirements for the report, including the content, format, and visual display of the report. These requirements will directly affect the design and implementation of the basic interface; formulate the interface input and output format: define the input and output format of the interface, while ensuring the scalability and compatibility of the data format to facilitate the subsequent report generation processing; based on the designed interface specifications, carry out interface development work, including data storage, query, processing, and output functions, to ensure that the interface can efficiently provide the basic data services required for report generation; integrate the report generation interface into the network security knowledge graph system, deploy and configure it, and ensure that the interface can work with other system components to provide basic services for the presentation of analysis results.

[0146] 3. Use Jinja syntax to write a network security knowledge graph analysis report template document and store it in the corresponding path.

[0147] Create a new document as a template. This document can be a blank document or a document that already contains some basic formats. Use "{{variable}}" to represent a variable, and then when the report is generated, the variable will be replaced with the actual value. You can also use structures such as "{% foritemin list %}...{% endfor %}" to implement loops and conditional judgments. After writing, save the template to the corresponding path. This path can be a local folder or a storage space in the cloud. But you need to make sure that this path is accessible when generating a report, and finally test whether the template can work properly. We can use some test data to fill in the template and then see if the generated report meets expectations.

[0148] 4. Upload the key link analysis results of the cyberspace security knowledge graph, process them and save them to the database.

[0149] The front end sends the analysis results to the back end through an HTTP request. The request content includes analysis_id (analysis ID), type (type), is_needed (whether required) and payload (payload, i.e. analysis results).

[0150] After receiving the request through the create method, the backend extracts the parameters from the request and organizes them into a dictionary dict. If the type is ItemType.terrain_rule_info and there is already a record with the same analysis ID and type in the database, the backend will update the record; otherwise, the backend will create a new record. Whether updating or creating, the backend will call the ReportItem.Update or ReportItem.Create method, which will save the data to the database. The backend will return a result, which is the record saved to the database.

[0151] 5. Create temporary files, read report template documents, and write analysis result data.

[0152] The specific implementation method of this step is as follows:

[0153] S1071. First, select the analysis results that need to be written into the report. Create a temporary file to store the analysis results. In Python, you can use the tempfile library to create a temporary file:

[0154] importtempfile

[0155] temp_file=tempfile.NamedTemporaryFile(delete=False)

[0156] S1072. Use an appropriate library to read your report template document. Since the template is a Word document, this method uses the python-docx library.

[0157] from docx import Document

[0158] doc=Document('template.docx')

[0159] S1073. Write the analysis results to a temporary file. Use the write method in Python to write data:

[0160] with open(temp_file.name,'w')as f:

[0161] f.write(analysis_result)

[0162] S1073. Use the Python built-in library to insert the contents of a temporary file into the report template:

[0163] paragraph=doc.add_paragraph()

[0164] with open(temp_file.name,'r')as f:

[0165] paragraph.add_run(f.read())

[0166] S1074. Save the final report: Finally, you need to save your report to a new file.

[0167] doc.save('final_report.docx')

[0168] S1075. After receiving the request, the server generates a report and returns a JSON object containing the report URL. The front end parses the object and downloads the report.

[0169] Embodiment 2:

[0170] A rule-based cyberspace security topology standard data label calculation method, comprising:

[0171] Step S101: Standardizing the node relationship topology data of the cyberspace security knowledge graph, where:

[0172] The node relationship refers to the connection or association between nodes in the knowledge graph, such as the connection between network devices, the relationship between network protocols, etc. These relationships can be used to analyze network structure and identify potential security threats and vulnerabilities.

[0173] Standardization refers to the normalization of these node relationships and related data to make them conform to specific standards and formats. In the cyberspace security knowledge graph, standardization includes ensuring that the relationship between nodes is clearly described and in a unified data format to facilitate subsequent data analysis, mining, and security defense operations.

[0174] Step S102: Calculate the node terrain labels of the cyberspace security knowledge graph based on rules, where:

[0175] The rules refer to pre-set conditions, criteria or algorithms used to classify or label nodes in the cyberspace security knowledge graph. These rules can be based on security policies, threat intelligence, types of security events, node attributes, etc. For example, a rule can be: if a node has been subjected to multiple DDoS attacks in the past 30 days, it will be marked as a "vulnerable node".

[0176] The node terrain labels are the result of rule-based calculations and are used to describe and label nodes in the knowledge graph. These labels can help security analysts quickly understand the status, risk level, or other important features of the node.

[0177] Furthermore, the method of screening vulnerable nodes based on terrain labels and node association analysis includes:

[0178] Step S103: Node association analysis of cyberspace security knowledge graph based on terrain labels, where:

[0179] The node association analysis refers to analyzing the relationship, connection or dependency between nodes using the terrain label information of the nodes.

[0180] Step S104: Determine the vulnerable nodes of the cyberspace security knowledge graph according to the association analysis results, where:

[0181] The vulnerable nodes refer to those nodes in a system or network that are relatively easy to be attacked, threatened or damaged. These nodes are usually more vulnerable to attack due to their specific security configuration, vulnerabilities or design flaws.

[0182] Furthermore, the path analysis and result presentation method of the key links of the cyberspace security knowledge graph include:

[0183] Step S105: Screen out vulnerable points, protection points, must-go points, and avoidance points.

[0184] The vulnerability refers to nodes in the network that have security holes, improper configuration or other potential risks and are vulnerable to attacks or threats. These nodes may become targets for attackers due to software vulnerabilities, unauthorized access, lack of updates, etc.

[0185] The protection points are nodes that require special protection or enhanced security measures in network security design. These nodes may be critical infrastructure, important data storage areas, high-value assets, etc. The existence of protection points requires additional security measures to ensure that they will not become targets of intrusion or sabotage by attackers.

[0186] The necessary points refer to nodes or paths that must be passed through in the network. Their stability and security are crucial to the operation of the entire network. Attacking or destroying these necessary points may cause failure or service interruption of the entire network. Therefore, the necessary points are usually also important nodes that require special attention and protection.

[0187] Avoidance points are nodes or paths with risks that need to be avoided or reduced when designing a network or security strategy. These nodes may not be suitable for direct connection or use due to their specific security risk attributes. The identification of avoidance points helps optimize network security design and risk management strategies, reduce attack surfaces, and improve the overall security of the network.

[0188] Step S106: Topological path analysis of the cyberspace security knowledge graph based on graph analysis algorithm.

[0189] in:

[0190] The graph analysis algorithms are a set of mathematical and computational tools for studying and analyzing graph data structures (networks, knowledge graphs, etc.). These algorithms can be used to explore nodes and edges in graphs, identify subgraphs, community structures, central nodes, paths, etc.

[0191] The topological path analysis is to analyze the paths in the network topology using graph analysis algorithms. In the cyberspace security knowledge graph, topological path analysis can be used to explore the information flow, data transmission path, attack propagation path, etc. in the network. By analyzing the path, critical paths, high-risk paths, possible attack paths, etc. can be identified.

[0192] Step S107: Presentation of key link analysis results of the cyberspace security knowledge graph, where:

[0193] The result is presented in a visual manner, and the result presentation in the present invention is performed in the form of a document analysis report.

[0194] The method of the present invention realizes a method for analyzing key links of a network security knowledge graph, reduces the difficulty of analyzing key links of a network security knowledge graph in the network security field, and also improves the monitorability and security of the cyberspace.

[0195] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network security knowledge graph key link analysis method, characterized in that: The method comprises the following steps: Step S101, standardizing the node relationship topology data of the cyberspace knowledge graph; Step S102, calculating the node terrain labels of the cyberspace knowledge graph based on rules; Step S103: Analyze the association of nodes in the network space knowledge graph based on terrain labels; Step S104: Determine vulnerable nodes in the cyberspace knowledge graph, i.e., key nodes that are vulnerable to attack or influence, according to the association analysis results; Step S105, screening out vulnerable points, protection points, must-pass points, and avoidance points: further classifying network nodes into vulnerable points, protection points, must-pass points, and avoidance points; Step S106, topological path analysis of cyberspace knowledge graph based on graph analysis algorithm: using graph analysis algorithm to deeply analyze the topological path of cyberspace knowledge graph, and explore the communication flow and attack path between key nodes; Step S107, presenting the key link analysis results of the cyberspace knowledge graph: clearly presenting the key link analysis results in the cyberspace knowledge graph through data visualization tools and graphical report generation tools.

2. The network security knowledge graph key link analysis method according to claim 1, characterized in that: The S101 includes: S1011. Data cleaning and preprocessing: Use data cleaning tools and algorithms to process raw network data, remove duplicate data, process missing values, correct erroneous data, ensure data integrity and accuracy, and output structured data; S1012. Data standardization and normalization: Use standardization and normalization techniques to unify data from different sources and formats into a consistent data model, including unifying units, standardizing data formats, and converting data types; S1013. Network graph construction: Use the basic algorithms and data structures of graph theory to construct network topology graphs: Convert standardized data into the form of network graphs, including adjacency matrices, adjacency lists, or graph structures in graph databases.

3. The network security knowledge graph key link analysis method according to claim 2, characterized in that: The S102 includes: designing a set of rules for calculating node terrain labels, where the rules are based on the structural features and connection patterns of the nodes; using supervised learning or unsupervised learning methods to identify key nodes and calculate their terrain labels; specifically including: Extract node and edge data, as well as attribute data of each node and association relationship from the cyberspace knowledge graph; when evaluating each node according to the terrain labels at different levels of the cyberspace knowledge graph, calculate each node and each rule based on the node's connectivity, node type, the effectiveness of the node in the network, and the importance attributes; terrain labels include: target points, entry points, vulnerable points, key points, and obstacle points, and can be expanded according to business needs; assign terrain labels to each node based on the results of rules or algorithms, and these labels represent the specific attributes or importance of the nodes through classification identification.

4. The network security knowledge graph key link analysis method according to claim 3, characterized in that: When evaluating each node based on the terrain labels at different levels of the cyberspace knowledge graph, different rules can be defined at different levels. The rules for vulnerabilities at different levels are: Platform layer: graph nodes with asset vulnerability greater than or equal to 8; Logical layer: graph nodes with asset vulnerability greater than or equal to 8, and nodes on the application layer with a threat count greater than or equal to 3; Application layer: graph nodes with asset vulnerability greater than or equal to 8, and nodes on the application layer with a threat count greater than or equal to 4; The asset vulnerability comes from the attributes of the nodes in the cyberspace knowledge graph, and the nodes at different levels are reflected through the association relationship data between the nodes.

5. The network security knowledge graph key link analysis method according to claim 3, characterized in that: The input of S103 is: A list of nodes with important terrain labels, which is obtained from the output of step S102; Vulnerability scan results: vulnerability scan report for each node, including vulnerability type and severity information; Threat intelligence data: data sources used to analyze potential threats facing nodes; Output: Vulnerability assessment report: vulnerability level and risk assessment of each node, based on vulnerability scan results and threat intelligence analysis; Including the specific threat types and potential impacts faced by key nodes; The implementation process of this step includes: S1031, Vulnerability scanning and assessment: Perform vulnerability scans on each node with important terrain tags; analyze vulnerability scan reports and assess the severity and potential impact of each vulnerability; S1032, Threat Intelligence Analysis: Use threat intelligence data to perform correlation analysis to identify high-risk threats associated with target nodes; use machine learning or statistical methods to correlate threat intelligence data with node characteristics to understand the potential impact of threats on nodes; S1033, Comprehensive Assessment: Generate a comprehensive vulnerability assessment report based on the results of vulnerability scanning, threat intelligence analysis, and security event log analysis; determine which nodes have a higher threat index and may need to prioritize strengthening protection measures or fixing vulnerabilities; S1034. Automated analysis tools: Use automated tools to process large amounts of nodes and complex security data to improve analysis efficiency and consistency.

6. The network security knowledge graph key link analysis method according to claim 5, characterized in that: The S104 comprises the following steps: S1041. During the comprehensive assessment phase, vulnerability scan reports and threat intelligence correlation analysis results have been collected; each node has been assigned a comprehensive security risk assessment that takes into account the severity of the vulnerability, potential impact, and correlation with threat intelligence; S1042. Calculate the security risk index of each node based on the comprehensive evaluation data; According to the security risk index, nodes are classified into different security levels, including high risk, medium risk and low risk; S1043. Set a standard for identifying vulnerable nodes, and select nodes with a security risk index above medium risk as candidate vulnerable nodes.

7. The network security knowledge graph key link analysis method according to claim 6, characterized in that: The input of S105 is: network topology data: including nodes, connections and their attributes; security vulnerability data; The output is: Vulnerability list: Lists the security holes or vulnerable nodes in the network; Protection point list: identifies key nodes that require special protection and monitoring; List of must-go points: Identify the key nodes that are indispensable in the business process; Avoidance point list: Identify nodes that need to be avoided or optimized to avoid affecting overall network performance or security; The specific implementation process of this step includes: S1051. Data preparation and cleaning: Collect and prepare network topology data, security vulnerability information, and business process data; S1052. Rule engine configuration: Design and configure the rule engine to ensure that nodes can be accurately classified according to defined rules; S1053, Node classification and evaluation: The rule engine is executed, and data analysis technology is used to classify and evaluate each node to generate a list of vulnerable points, protection points, must-pass points, and avoidance points.

8. The method for analyzing key links in a network security knowledge graph according to claim 7, characterized in that: Rules Engine: Develop a set of rules that are based on security, performance, and business requirements to determine specific attributes and functions of network nodes; use the rules engine to execute these rules to automatically classify and evaluate network nodes; Determine whether the node has known vulnerabilities based on the vulnerability database and security patches; determine whether it is a protection point or a must-pass point based on the criticality of the node in the business process; identify whether it is an avoidance point based on the location and function of the node, and avoid excessive traffic from passing through it; Data analysis techniques: Collect network topology data, configuration information, and security event logs, and use data analysis techniques, including statistical analysis or machine learning algorithms, to help identify and verify the properties of network nodes.

9. The network security knowledge graph key link analysis method according to claim 7, characterized in that: The input of S106 is: cyberspace knowledge graph data, including node and edge information; List of key nodes that need path analysis; Output: Shortest path analysis results: including the shortest path and path length between key node pairs; Attack path analysis results: describing possible attack paths, vulnerabilities or weaknesses that attackers can exploit; Visualization results: Visualization of network topology and path diagrams, showing network structure and security-related detailed information; The specific implementation process of this step includes: S1061. Data preprocessing: Convert cyberspace knowledge graph data into a data structure suitable for graph analysis; S1062, Path Calculation and Analysis: Use the shortest path algorithm to calculate the paths between key node pairs, and use the path analysis algorithm to explore potential attack paths and communication paths; S1063. Result analysis and visualization: Analyze path analysis results, evaluate security threats and network optimization opportunities, and visualize the results.

10. The method for analyzing key links in a network security knowledge graph according to claim 9, characterized in that: The S107 S1071, first select the analysis results to be written into the report; S1072. Use appropriate libraries to read report template documents; S1073, writing the analysis results into a temporary file; S1073. Use the Python built-in library to insert the contents of the temporary file into the report template; Among them, the network security knowledge graph analysis report template document is written through Jinja syntax and stored in the corresponding path; Create a new document as a template, use "{{variable}}" to represent a variable, and then when generating a report, this variable will be replaced with the actual value; use "{% for itemin list %}...{% endfor %}" to implement loops and conditional judgments. After writing, save the template to the corresponding path; S1074. Save the final report: Finally, you need to save your report to a new file; S1075. After receiving the request, the server generates a report and returns a JSON object containing the report URL. The front end parses the object and downloads the report.

Images