Method, system, electronic device and storage medium for constructing intranet entity behavior graph

Abstract

The present invention provides a method, system, electronic device and storage medium for constructing an intranet entity behavior graph, which belongs to the field of knowledge graphs. The method includes: classifying internal network activity entities and behaviors according to business expert knowledge to construct an ontology; collecting different logs of internal network activities, and extracting triples according to activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph; vectorizing the triples and performing similarity calculations to obtain a similarity matrix and a normal distribution of triple associations, and grouping according to the associations, and linking the grouped triples. Construct an ontology based on business expert knowledge to extract triples, vectorize the triples to perform similarity calculations, group them according to the associations, and link the grouped triples. When there are new triples, only the local graph needs to be updated, which is closer to reality, and the generated entity behavior spectrum has high accuracy, strong practicality, and high efficiency.

Description

Technical Field

[0001] The present invention belongs to the technical field of knowledge graphs, and specifically relates to a method, system, electronic device and storage medium for constructing an intranet entity behavior graph. Background Art

[0002] The knowledge graph is a structured semantic knowledge base used to quickly describe concepts and their related relationships in the physical world. By reducing the data granularity from the document level to the data level, a large amount of knowledge is aggregated to achieve rapid response and reasoning of knowledge. The entity behavior graph is a type of knowledge graph, such as users uploading and downloading files on the network. This invention is a method for constructing entity and behavior relationships in an internal network and describing internal network activities. It is an application of the knowledge graph in a specific vertical business field.

[0003] Currently, there is no complete and effective method for building a graph of entities and behavior relationships within the network for internal network activities. Most of the construction methods are too general and vague to be applied in practice. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a method, system, electronic device and storage medium for constructing an intranet entity behavior graph, which are used to fully or at least partially solve the technical problems existing in the above-mentioned prior art.

[0005] In a first aspect, an embodiment of the present application provides a method for constructing an intranet entity behavior graph, comprising:

[0006] Classify internal network activity entities and behaviors based on business expert knowledge to build an ontology;

[0007] Collect different logs of internal network activities and extract triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph;

[0008] The triplets are vectorized and similarity is calculated to obtain a similarity matrix and a normal distribution of triple associations. The triplets are grouped according to the associations and the grouped triplets are linked.

[0009] Optionally, entity classification includes host, person, application, account and device; behavior classification includes operation, subordination, access and association.

[0010] Optionally, after collecting different logs of internal network activities and extracting triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph, the method for constructing the intranet entity behavior graph further includes supplementing the triple knowledge with asset information, attributes and dimension data:

[0011] Each triple is marked and identified to find supplementary knowledge through the identification, and the timestamp of each extracted triple is determined.

[0012] Optionally, the triples are vectorized and similarity is calculated to obtain a similarity matrix and a normal distribution of triple associations, and grouping is performed based on the associations, including:

[0013] The attribute information contained in the triple is one-hot encoded and concatenated into a triple vector;

[0014] Traverse the triple vector set, calculate the distance between two triplets, form a matrix of the distance relationships between all triplets, and calculate the standard deviation and mean of the distance. If it conforms to the normal distribution law, remove the values ​​in the triple that exceed the distance threshold;

[0015] Add relevance to repeated triplets and group the triplets.

[0016] Optionally, the distance between two triplets is calculated according to the following formula:

[0017] ;

[0018] Where d represents the distance between triple x and triple y, and triple x is expressed as , the triple y is represented as .

[0019] Optionally, the grouped triplets are linked, including:

[0020] For the same node, personnel and hosts are related through registered asset subordination, applications and hosts are related through registered association tables, and accounts and applications are related through asset registration tables.

[0021] According to the relationship between personnel and hosts established through registered asset subordination, the relationship between applications and hosts established through the registered association table, and the relationship between accounts and applications established through the asset registration table, select entities whose occurrence frequency and relevance meet the preset requirements to link each subgraph.

[0022] Optionally, the activity subject feature configuration rules are characterized as: host by IP / MAC, personnel by ID, application by IP / PORT, account by permission table ID, and device by PID / VID.

[0023] In a second aspect, the embodiment of the present application further provides a system for constructing an intranet entity behavior graph, including:

[0024] Building blocks, used to classify internal network activity entities and behaviors based on business expert knowledge to build an ontology;

[0025] The collection unit is used to collect different logs of internal network activities and extract triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph;

[0026] The linking unit is used to vectorize the triples and calculate the similarity, obtain the similarity matrix and the normal distribution of the triple association, group them according to the association, and link the grouped triples.

[0027] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method for constructing the intranet entity behavior map described above are implemented.

[0028] In a fourth aspect, an embodiment of the present application further provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for constructing the intranet entity behavior map described above are implemented.

[0029] It can be seen from the above technical solutions that the present invention has the following advantages:

[0030] In the method, system, electronic device and storage medium for constructing the intranet entity behavior graph provided by the present application, a standard behavior tree is abstracted based on the knowledge of business experts to construct an ontology. The heterogeneous data is cleaned into a standard behavior tree based on keyword rules, triples are extracted, the triples are vectorized for similarity calculation, grouped according to the relevance, and the grouped triples are linked. When there is a new triple, only the local graph needs to be updated, which is closer to reality. The generated entity behavior spectrum has high accuracy, strong practicality and high efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0032] Figure 1 A flowchart of a method for constructing an intranet entity behavior graph provided by an embodiment of the present invention;

[0033] Figure 2 A flow chart of grouping triples provided in an embodiment of the present invention;

[0034] Figure 3 A detailed flow chart of a method for constructing an intranet entity behavior graph provided by an embodiment of the present invention;

[0035] Figure 4 An example diagram of a knowledge graph provided by an embodiment of the present invention;

[0036] Figure 5 A schematic diagram of the structure of a system for constructing an intranet entity behavior graph provided by an embodiment of the present invention;

[0037] Figure 6 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In the detailed description below, various embodiments of the present disclosure will be described more fully. The present disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of the present disclosure to the specific embodiments disclosed herein, but rather the present disclosure should be understood to cover all adjustments, equivalents and / or alternatives that fall within the spirit and scope of the various embodiments of the present disclosure.

[0039] Hereinafter, the terms "include" or "may include" that may be used in various embodiments of the present disclosure indicate the presence of the disclosed functions or operations, and do not limit the addition of one or more functions or operations. In addition, as used in various embodiments of the present disclosure, the terms "include", "have" and their cognates are intended only to indicate specific features, numbers, steps, operations, or combinations of the foregoing items, and should not be understood as first excluding the presence of one or more other features, numbers, steps, operations, or combinations of the foregoing items or the possibility of adding one or more features, numbers, steps, operations, or combinations of the foregoing items.

[0040] In various embodiments of the present disclosure, the expression "or" or "at least one of A or / and B" includes any combination or all combinations of the words listed at the same time. For example, the expression "A or B" or "at least one of A or / and B" may include A, may include B, or may include both A and B.

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] See also Figure 1 The figure is a flowchart of a method for constructing an intranet entity behavior graph in a specific embodiment, including the following execution steps:

[0043] Step 100: Classify internal network activity entities and behaviors based on business expert knowledge to construct an ontology.

[0044] Specifically, entity classification includes host, personnel, application, account and device; behavior classification includes operation, subordination, access and association.

[0045] Step 101: Collect different logs of internal network activities, and extract triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph.

[0046] Exemplarily, the activity subject feature configuration rules are characterized as: host by IP / MAC, personnel by ID, application by IP / PORT, account by permission table ID, and device by PID / VID.

[0047] Step 102: vectorize the triples and perform similarity calculation to obtain a similarity matrix and a normal distribution of triple associations, group them according to the associations, and link the grouped triples.

[0048] In this embodiment, a standard behavior tree is abstracted based on the business expert knowledge to construct the ontology. The heterogeneous data is cleaned into the standard behavior tree according to the keyword rules, the triples are extracted, the triples are vectorized for similarity calculation, grouped according to the correlation, and the grouped triples are linked. When there is a new triple, only the local graph needs to be updated, which is closer to reality. The generated entity behavior spectrum has high accuracy, strong practicality and high efficiency.

[0049] In one embodiment of the present invention, after executing step 101, the following steps are also executed: supplementing the triplet knowledge through asset information, attributes and dimension data: marking and identifying each triplet to find the supplemented knowledge through the identification, and determining the timestamp of each extracted triplet.

[0050] In one embodiment, see Figure 2 As shown, when executing step 102, the following steps may be specifically performed:

[0051] S1: Perform one-hot encoding on the attribute information contained in the triple and concatenate them into a triple vector.

[0052] S2: Traverse the triple vector set, calculate the distance between two triplets, form a matrix of the distance relationships between all triplets, and calculate the standard deviation and mean of the distance. If it conforms to the normal distribution law, remove the values ​​in the triple that exceed the distance threshold.

[0053] Specifically, the distance between two triplets is calculated according to the following formula:

[0054] ;

[0055] Where d represents the distance between triple x and triple y, and triple x is expressed as , the triple y is represented as .

[0056] S3: Add relevance to repeated triplets and group the triplets.

[0057] In some implementations, linking the grouped triples includes:

[0058] For the same node, personnel and hosts are related through registered asset subordination, applications and hosts are related through registered association tables, and accounts and applications are related through asset registration tables.

[0059] According to the relationship between personnel and hosts established through registered asset subordination, the relationship between applications and hosts established through the registered association table, and the relationship between accounts and applications established through the asset registration table, select entities whose occurrence frequency and relevance meet the preset requirements to link each subgraph.

[0060] In one embodiment, Figure 3 This is a detailed flow chart of a method for constructing an intranet entity behavior graph according to an embodiment of the present invention. This embodiment is further optimized and expanded on the basis of the above embodiments.

[0061] The behavior activities of the internal network can be collected through tracking points and probe logs. The main body of the activity is the assets recorded during network construction. It includes the following steps:

[0062] 1. Ontology construction. First, classify the internal network activity entities and behavior definitions based on the knowledge of business experts. The entity classification is shown in the following table 1, and the behavior classification is shown in the following table 2:

[0063] Table 1 Entity classification

[0064]

[0065] Table 2 Behavior classification

[0066]

[0067] 2. Collect and clean different logs of network activities. The cleaning method is based on rules and keyword mapping. The original log content is manually analyzed and then the mapping rules are configured to specific behavior standards. That is, as long as the behavior standards are established, the mapping rules can be configured using common ETL tools to standardize heterogeneous data. Entity behavior extraction is performed during the standardization process. According to the configuration rules of the activity subject characteristics, they are extracted into the corresponding classification entities. The specific method is: host by IP / MAC, personnel by ID, application by IP / PORT, account by permission table ID, and device by PID / VID. Extract triples (subject, behavior, object) from standardized logs to express two nodes and node relationships in the graph. At the same time, entity sets and relationship sets are also proposed. For those without object logs, such as illegal connection to the Internet, the traffic quintuple is classified as access behavior.

[0068] 3. The triplet knowledge is supplemented and enriched through asset information, attributes, and dimension data. That is, each triplet is uniquely represented, and the unique identifier can be used to find the supplementary knowledge. And each extracted triplet has a timestamp to mark the time point of generation. The final structure is <subject, behavior, object, timestamp, unique identifier>.

[0069] 4. The current triple set information is flat, lacking hierarchy and logic, and may also contain a lot of redundant and erroneous information. By referring to the TransE model, we traverse the triple set, calculate the similarity of each triple, obtain the normal distribution of the similarity matrix and triple association, and achieve noise reduction, deduplication, and grouping of the triple set, thus improving the efficiency of triple linking, updating, and querying. The specific algorithm is as follows:

[0070] a. Triple vectorization: An entity has many attributes, such as the host has departments, installation system types, CPU architectures, and other attributes; each attribute can be labeled, such as department attributes, department A is represented as (1,0,0), and department B is represented as (0,1,0) to distinguish businesses. Under a limited set of attributes, the entity vectorization is represented as (1,0,0,0,1,0,0,0,0), depending on the size of the attribute set. Similarly, the relationship vectorization can be represented as (1,0,1). The triple vectorization is represented as (1,0,0,0,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,1,0,1).

[0071] b. Traverse the triple set and obtain the association matrix of each pair of triples according to the algorithm. The specific algorithm is: ;

[0072] In the formula, d Represents the distance between triple x and triple y, where the triple is one-hot encoded by the attribute information contained in the entity, relationship, and object, and the encoded concatenation becomes a triple vector. The triple x can be expressed as , the triple y can be expressed as , after calculating the distance d between the triples x and y, the relationships between all tuples are formed into a matrix, Among them, m represents the total number of tuples, d pq represents the distance between the p-th tuple and the q-th tuple, where . Combine the obtained distances into a set , calculate the standard deviation and mean of the distance, and determine whether it conforms to the normal distribution law. If it conforms to the law, then remove the sample The range of values ​​is is the distance threshold, and the triplets are grouped according to the relevance. The relevance is added to the repeated triplets, and the data structure becomes <subject, behavior, object, timestamp, unique identifier, relevance>.

[0073] 5. Link and update triplets grouped by relevance. Specific methods: a. Perform entity linking on triplets grouped by relevance separately. The same IP / MAC or IP / port is the same node. Personnel and hosts establish a relationship through registered asset subordination, applications and hosts establish a relationship through a registered association table, and accounts and applications establish a relationship through an asset registration table. b. For each linked subgraph, only entities with high frequency of occurrence and relevance are selected to link each subgraph according to the above rules. Grouping triplets by relevance based on a similarity algorithm greatly improves the efficiency of graph linking, query performance, and reduces the establishment of redundant edges. When a new triple is extracted, the similarity can be calculated with the grouped triples first, and the subgraph with high similarity can be locally updated to avoid updating the entire graph.

[0074] First, collect comprehensive internal network logs and do a good job of filing network assets. Abstract a standard behavior tree based on the knowledge of business experts, build an ontology to define entity classification and behavior types. Clean heterogeneous data into a standard behavior tree based on keyword rules, and extract <subject, behavior, object> triples. Vectorize the triples for similarity calculation and group them according to the correlation. Link the grouped triples. When there is a new triple, only the local graph needs to be updated. Closer to reality, the generated entity behavior spectrum is highly accurate, practical, and efficient.

[0075] In some embodiments, see Figure 4 As shown, an example diagram of a knowledge graph provided by an embodiment of the present invention is shown, and its storage structure is shown in the following Table 3:

[0076] Table 3 Storage structure

[0077]

[0078] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0079] like Figure 5 As shown, the following is an embodiment of the system for constructing an intranet entity behavior graph provided by an embodiment of the present disclosure, which belongs to the same inventive concept as the method for constructing an intranet entity behavior graph in the above-mentioned embodiments. For details not described in detail in the embodiment of the system for constructing an intranet entity behavior graph, please refer to the embodiment of the method for constructing an intranet entity behavior graph mentioned above.

[0080] A construction unit 50, for classifying internal network activity entities and behaviors according to business expert knowledge to construct an ontology;

[0081] A collection unit 51 is used to collect different logs of internal network activities and extract triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph;

[0082] The linking unit 52 is used to vectorize the triples and perform similarity calculation to obtain a similarity matrix and a normal distribution of triple associations, group the triples according to the associations, and link the grouped triples.

[0083] Figure 6 It is a schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0084] The method for constructing the intranet entity behavior map provided in the embodiment of the present application can be applied to electronic devices. Those skilled in the art will appreciate that the electronic device structure involved in the embodiment of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange different components. In an embodiment of the present invention, the electronic device includes but is not limited to a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples, and are not intended to limit the implementation of the embodiments of the present application described and / or required herein.

[0085] The electronic device may include a processor, an external memory interface, an internal memory, a universal serial bus (USB) interface, a charging management module, a power management module, a battery, a wireless communication module, an audio module, a speaker, a microphone, a sensor module, buttons, a camera, a display, and a SIM card interface, etc.

[0086] It is to be understood that the structure illustrated in the embodiments of the present application does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0087] The processor may include one or more processing units, for example, the processor may include a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated into one or more processors.

[0088] The processor can be the nerve center and command center of the electronic device. The controller can generate an operation control signal according to the instruction operation code and timing signal to complete the control of fetching and executing instructions.

[0089] A memory may also be provided in the processor for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. The memory may store instructions or data that the processor has just used or is cyclically used. If the processor needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor, and thus improves system efficiency.

[0090] The external memory interface can be used to connect an external memory card, such as a MicroSD card, to expand the storage capacity of the electronic device. The external memory card communicates with the processor through the external memory interface to implement data storage functions. For example, files such as music and videos can be saved in the external memory card.

[0091] The internal memory can be used to store computer executable program codes, which include instructions. The processor executes various functional applications and data processing of the electronic device by running the instructions stored in the internal memory. The internal memory may include a program storage area and a data storage area. The internal memory may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0092] The wireless communication function of an electronic device can be realized through an antenna, a wireless communication module, a modem processor, and a baseband processor.

[0093] The wireless communication module can provide wireless communication solutions for electronic devices, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared technology (IR), etc.

[0094] Electronic devices can implement audio functions, etc. through audio modules, speakers, receivers, microphones, headphone jacks, and application processors.

[0095] Electronic devices can achieve shooting functions through ISP, camera, video codec, GPU, display and application processor.

[0096] Electronic devices can achieve display functions through GPU, display screen and application processor.

[0097] The GPU is a microprocessor for image processing that connects the display screen and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor may include one or more GPUs that execute program instructions to generate or change display information.

[0098] The display screen is used to display images, videos, etc. The display screen includes a display panel.

[0099] The above-mentioned electronic device realizes the subject name of the method for constructing an intranet entity behavior graph of the present application, which classifies internal network activity entities and behaviors according to business expert knowledge to construct an ontology; collects different logs of internal network activities, and extracts triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph; vectorizes the triples and performs similarity calculations to obtain a normal distribution of the similarity matrix and the triple correlation, and groups them according to the correlation, and links the grouped triplets. The technical solution achieves the effect of only updating the local graph when there is a new triple, which is closer to reality, and the generated entity behavior spectrum has high accuracy, strong practicality, and high efficiency.

[0100] The storage medium provided in the present application stores a program product that can implement a method for constructing an intranet entity behavior graph.

[0101] The method for constructing an intranet entity behavior graph includes: classifying internal network activity entities and behaviors according to business expert knowledge to construct an ontology; collecting different logs of internal network activities, and extracting triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph; vectorizing the triples and performing similarity calculation to obtain a similarity matrix and a normal distribution of triple correlation, and grouping them according to the correlation, and linking the grouped triples.

[0102] In some possible implementations, the method and system for constructing an intranet entity behavior graph, the subject name of the present disclosure, can be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps described in the above "Exemplary Method" section of this specification according to various exemplary implementations of the present disclosure.

[0103] The storage medium of the present disclosure can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0104] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for constructing an intranet entity behavior graph, characterized in that: include: Classify internal network activity entities and behaviors based on business expert knowledge to build an ontology; Collect different logs of internal network activities and extract triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph; Vectorize the triples and calculate the similarity to obtain the similarity matrix and the normal distribution of the triple association degree, group them according to the association degree, and link the grouped triples; Specifically, a standard behavior tree is abstracted based on the knowledge of business experts to construct the ontology; heterogeneous data is cleaned into the standard behavior tree based on keyword rules to extract triples; Specifically, the triples are vectorized and similarity is calculated to obtain a similarity matrix and a normal distribution of triple associations, and grouping is performed according to the associations, including: The attribute information contained in the triple is one-hot encoded and concatenated into a triple vector; Traverse the triple vector set, calculate the distance between two triplets, form a matrix of the distance relationships between all triplets, and calculate the standard deviation and mean of the distance. If it conforms to the normal distribution law, remove the values ​​in the triple that exceed the distance threshold; Add relevance to repeated triplets and group the triplets; Specifically, the distance between two triplets is calculated according to the following formula: ； Where d represents the distance between triple x and triple y, and triple x is expressed as , the triple y is represented as .

2. The method for constructing an intranet entity behavior graph according to claim 1, characterized in that: Entity classification includes host, person, application, account and device; behavior classification includes operation, subordination, access and association.

3. The method for constructing an intranet entity behavior graph according to claim 1, characterized in that: After collecting different logs of internal network activities and extracting triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph, the method for constructing the intranet entity behavior graph also includes supplementing the triple knowledge with asset information, attributes and dimension data: Each triple is marked and identified to find supplementary knowledge through the identification, and the timestamp of each extracted triple is determined.

4. The method for constructing an intranet entity behavior graph according to claim 2, characterized in that: Link the grouped triplets, including: For the same node, personnel and hosts are related through registered asset subordination, applications and hosts are related through registered association tables, and accounts and applications are related through asset registration tables. According to the relationship between personnel and hosts established through registered asset subordination, the relationship between applications and hosts established through the registered association table, and the relationship between accounts and applications established through the asset registration table, select entities whose occurrence frequency and relevance meet the preset requirements to link each subgraph.

5. The method for constructing an intranet entity behavior graph according to claim 2, characterized in that: The activity subject feature configuration rules are characterized as follows: host by IP / MAC, personnel by ID, application by IP / PORT, account by permission table ID, and device by PID / VID.

6. A system for constructing an intranet entity behavior graph applied to the method for constructing an intranet entity behavior graph according to any one of claims 1 to 5, characterized in that: include: Building blocks, used to classify internal network activity entities and behaviors based on business expert knowledge to build an ontology; The collection unit is used to collect different logs of internal network activities and extract triples according to the activity subject feature configuration rules to characterize the relationship between nodes in the intranet entity behavior graph; The linking unit is used to vectorize the triples and calculate the similarity, obtain the similarity matrix and the normal distribution of the triple association, group them according to the association, and link the grouped triples.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method for constructing an intranet entity behavior map as described in any one of claims 1 to 5 are implemented.

8. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for constructing an intranet entity behavior map as described in any one of claims 1 to 5 are implemented.

Images