Network security dynamic early warning method and system based on knowledge graph

Abstract

The invention discloses a network security dynamic early warning method and system based on a knowledge graph, and relates to the technical field of network security, the system can integrate various network security related information by constructing the knowledge graph, so that comprehensive network security situation cognition is formed, and the system is further helped to better understand the network security condition; the system adopts a dynamic early warning strategy, preliminarily monitors the abnormal condition of a data packet, timely sends out an early warning instruction, then judges the current network security level according to a related threshold value Q and a correlation index Gxzs, and gives out corresponding early warning measures, and the progressive early warning strategy improves the reaction efficiency of the system, can timely discover the security problem in the network, and meanwhile, improves the safety of the network. The system has a dynamic early warning and self-adaptive adjustment mechanism, can dynamically adjust the early warning strategy according to the actual network condition, and improves the efficiency and flexibility of the early warning response.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and specifically to a knowledge graph-based network security dynamic early warning method and system. Background Art

[0002] Knowledge graph is a strategy to organize and display knowledge in a graphical form, which allows computers to understand and apply this knowledge more effectively. In addition, it can also gather a lot of network security related information, such as known threats, potential security vulnerabilities, attack actions and security strategies, so as to build a clear understanding of the overall network security. In the field of network security, there is a large amount of data that needs to be analyzed, which includes the status of network hosts, communication status and possible abnormal behaviors. However, the analysis and processing of these massive data may affect the overall smoothness of the network operation.

[0003] In the Chinese invention patent with application publication number CN117834282A, a knowledge graph-based network security dynamic early warning system, method and storage medium are disclosed, including: a network data acquisition module, used to collect data from the network environment; a data processing and analysis module, used to process and analyze the collected data; a knowledge graph construction module, used to convert the processed data into a structured knowledge graph; a deep learning and pattern recognition module, used to analyze the data in the knowledge graph to identify and learn network security-related patterns and behaviors and obtain recognition results; an early warning and response module, which is responsible for generating and issuing network security early warnings based on the recognition results; a data storage module, used to store data, as well as knowledge graphs and recognition results; the present invention has a good dynamic network security early warning effect.

[0004] In the technical solutions recorded in the above applications, the efficiency and accuracy of network security monitoring and early warning can be significantly improved by applying knowledge graph technology and deep learning algorithms. Compared with traditional rule-based and signature-based systems, emerging and complex network threats can be identified more quickly. However, in combination with the existing technology and the above applications, the simultaneous processing of large amounts of data may affect the operating efficiency of the network, reduce the timeliness of the early warning, and lack a progressive dynamic early warning strategy, resulting in low response efficiency. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a knowledge graph-based network security dynamic early warning method and system, which solves the problems in the above-mentioned background technology.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network security dynamic early warning method based on knowledge graph, comprising the following steps:

[0007] S1. Acquire known dangerous software in advance, and use natural language processing technology to extract network security related information from the known dangerous software, and build a preliminary network security knowledge graph. At the same time, monitor the data packet transmission status information and communication status information in the actual network host, and combine the preliminary network security knowledge graph to obtain relevant abnormal behavior information and establish a host network status data set;

[0008] S2. Based on cluster analysis technology, the host network status data set is aggregated into the preliminary network security knowledge graph to build a complete network security knowledge graph;

[0009] S3, constructing a difference factor Czp of the data packet according to the actual data packet transmission status information in the network host, and if the difference factor Czp of the data packet exceeds the difference threshold w, an early warning instruction will be issued externally;

[0010] S4. After receiving the early warning instruction, based on the communication status information and related abnormal behavior information in the actual network host, and in combination with the trained associated security situation model, the communication difference coefficient Tyxs and the behavior similarity coefficient Xxb are obtained, and the association index Gxzs is obtained by fitting by associating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb;

[0011] S5. Preset a relevant threshold value Q and compare and analyze it with the correlation index Gxzs to estimate the current network security status and issue corresponding early warning measures based on the corresponding network security status.

[0012] Preferably, the S1 comprises:

[0013] S11. Using named entity recognition technology, identify entity information of known dangerous software, including but not limited to the name of the dangerous software, file hash value, communication port, attack method, user account, IP address, network domain name, name of the infected system and infection time;

[0014] S12, and extracting the attributes in the entity according to the entity, the attributes include but are not limited to the communication protocol usage Txs2, login time, login location, login behavior, dangerous software propagation mode, impact range, attack target, data packet value, communication time and communication direction in several groups of known dangerous software in multiple monitoring cycles;

[0015] S13. Then, the information captured in S11 and S12 is initially organized to obtain a preliminary network security knowledge graph.

[0016] Preferably, the S1 further includes:

[0017] S14, the relevant information in the host network status data set includes data packet transmission status information, communication status information and related abnormal behavior information;

[0018] Record the data packet transmission status information in the actual network host, the data packet transmission status information includes monitoring the data packet value Sb1 in several groups of time nodes, and according to the data packet value Sb1 in several groups of time nodes, combining statistical averaging to obtain the data packet mean

[0019] Preferably, S2 includes:

[0020] S21. Based on the preliminary network security knowledge graph and in combination with the host network status data set, a complete network security knowledge graph is constructed;

[0021] S22. At the same time, based on cluster analysis technology, the complete network security knowledge graph is identified and divided to form a number of clusters, each cluster representing a type of associated network security information, and the number of clusters include data packet difference information, communication difference information and behavior difference information.

[0022] Preferably, S3 includes:

[0023] S31, according to the data packet transmission status information in the actual network host, the data packet value Sb1 in the actual network host and the data packet value Sb2 in the known dangerous software are linearly normalized to obtain a difference factor Czp of the data packet, and the difference factor Czp of the data packet is obtained by the following formula:

[0024]

[0025] Where n is the number of monitored time nodes, i = 1, 2, 3, ..., n, Sb1 i Represented as the data packet value in the actual network host at the i-th time node, Sb2 i It is represented by the data packet value in the known dangerous software at the i-th time node;

[0026] S32, presetting a difference threshold w, and comparing and analyzing the difference factor Czp of the data packet with the difference threshold w to preliminarily estimate the current network security risk;

[0027] If the difference factor Czp of the data packet exceeds the difference threshold w, it indicates that the current network security is at risk, and an early warning instruction will be issued.

[0028] Preferably, S4 includes:

[0029] S41, receiving warning instructions;

[0030] S42. After receiving the early warning instruction, continuously obtain the communication status information of the actual network host in multiple monitoring cycles, as well as the related abnormal behavior information in the network:

[0031] S43, wherein the communication status information includes the communication protocol usage Tx1 in a plurality of groups of actual network hosts in a plurality of monitoring cycles, and extracts the maximum value therefrom;

[0032] S44, the related abnormal behavior information includes the failure reason number difference Dyz, the access file difference Fjc and the unauthorized access difference Ffc;

[0033] S45. According to the communication status information in the actual network host and the complete network security knowledge graph, the abnormal communication status is analyzed to obtain the communication difference coefficient Tyxs:

[0034]

[0035] Where, Tx1 max It is the maximum value of the communication protocol usage in the actual network host during the monitoring period; Tx2 max It is represented by the maximum usage of communication protocols in known dangerous software during the monitoring period; It is expressed as the average difference between the communication protocol usage in actual network hosts and the communication protocol usage in known dangerous software during the monitoring period.

[0036] Preferably, S46, according to the complete network security knowledge graph, combined with relevant abnormal behavior information, obtain the behavior similarity coefficient Xxb:

[0037]

[0038] Where, Ffc i It is represented as the difference between the unauthorized access between the actual network host and the known dangerous software at the i-th time node, Fjc i It is represented as the difference between the access files of the actual network host and the known dangerous software at the i-th time node, Dyz i It is expressed as the difference in the number of failures with the same cause between the actual network host and the known dangerous software at the i-th time node, Dyz avg It is expressed as the mean value of the difference Dyz of the number of failures with the same reason within the monitoring period, Ffc avg It is expressed as the mean value of the unauthorized access difference Ffc during the monitoring period, Fjc avg It is expressed as the mean value of the access file difference Fjc during the monitoring period.

[0039] Preferably, S45, by correlating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb, and after linear normalization processing, fitting to obtain the correlation index Gxzs, the correlation index Gxzs is obtained by the following formula:

[0040]

[0041] Where P is the correction constant.

[0042] Preferably, S5 includes:

[0043] S51, according to the comparison result of the correlation index Gxzs and the correlation threshold Q, the current network security status is estimated, and the specific content is as follows:

[0044] If the correlation index Gxzs> the correlation threshold Q, it indicates that the current network security is in an abnormal state;

[0045] If the correlation index Gxzs = the correlation threshold Q, it means that the current network security is not in an abnormal state;

[0046] If the correlation index Gxzs is less than the correlation threshold Q, it indicates that the current network security is in an abnormal state;

[0047] S52. Issue corresponding early warning measures based on network security status:

[0048] If the current network security is not in an abnormal state, an intermittent flashing green warning instruction will be automatically issued at this time, but it is still necessary to strengthen real-time monitoring of the system, promptly discover and handle abnormal activities, and require the user's authentication to be replaced within 12 hours; if the current network security is in an abnormal state, a continuous flashing red warning instruction will be automatically issued at this time, and access to network resources will be automatically prohibited, forcing users to log off, and temporarily changing passwords.

[0049] A network security dynamic early warning system based on knowledge graph, including a graph building module, a data collection module, an association module, a preliminary monitoring module, a security analysis module and a dynamic early warning module;

[0050] The graph building module is used to pre-acquire known dangerous software, extract network security related information from the known dangerous software using natural language processing technology, and construct a preliminary network security knowledge graph;

[0051] The data acquisition module is used to monitor and record the data packet transmission status information and communication status information in the actual network host, and obtain relevant abnormal behavior information in combination with the preliminary network security knowledge graph to establish a host network status data set;

[0052] The association module is used to summarize and identify the preliminary network security knowledge graph and the host network status data set based on cluster analysis technology to build a complete network security knowledge graph;

[0053] The preliminary monitoring module is used to construct a difference factor Czp of the data packet according to the actual data packet transmission status information in the network host. If the difference factor Czp of the data packet exceeds the difference threshold w, an early warning instruction will be issued externally;

[0054] The security analysis module is used to receive the early warning instruction, and after receiving the early warning instruction, based on the communication status information and related abnormal behavior information in the actual network host, and combined with the trained associated security situation model, obtain the communication difference coefficient Tyxs and the behavior similarity coefficient Xxb, and obtain the association index Gxzs by fitting by associating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb;

[0055] The dynamic warning module is used to pre-set the relevant threshold Q, and compare and analyze it with the correlation index Gxzs, and issue corresponding warning measures according to the corresponding network security level.

[0056] The present invention provides a knowledge graph-based network security dynamic early warning method and system, which has the following beneficial effects:

[0057] (1) By constructing a knowledge graph, the system can integrate various network security related information to form a comprehensive network security situation cognition, which further helps the system better understand the network security situation; the system adopts a dynamic early warning strategy to initially monitor the abnormal situation of data packets and issue early warning instructions in a timely manner. Then, it judges the current network security level according to the relevant threshold Q and the correlation index Gxzs, and issues corresponding early warning measures. This progressive early warning strategy improves the response efficiency of the system, can timely discover security problems in the network, and avoid affecting the network operation efficiency due to the simultaneous processing of a large amount of data. The system has a dynamic early warning and adaptive adjustment mechanism, which can dynamically adjust the early warning strategy according to the actual network situation, improving the efficiency and flexibility of the early warning response. Through the dynamic early warning module, the system can issue corresponding early warning measures in real time, including continuous flashing red, yellow and green early warning instructions, which improves the timely response capability of network security events. In short, this method has significant beneficial effects in improving network security situation cognition, early warning efficiency, response capability and data processing efficiency.

[0058] (2) By using natural language processing technology and cluster analysis technology, intelligent analysis of known dangerous software and network host data can be achieved, so that network security threats can be accurately and timely discovered and corresponding early warning measures can be taken. Not only the packet transmission status, communication status and abnormal behavior of the network host are monitored, but also a comprehensive analysis is conducted, taking into account the combined impact of multiple factors layer by layer, so as to further improve the accuracy and gradualness of the analysis results; various network security related information is integrated to build a comprehensive network security knowledge map, so as to realize the perception and cognition of network security situation, which helps to timely discover potential threats and take measures to deal with them. Therefore, this method plays an important role in improving network security protection capabilities and reducing network risks.

[0059] (3) Based on the comparison results of the correlation index Gxzs and the relevant threshold Q, the system can automatically determine whether the network security is abnormal and take corresponding early warning measures; for a network in normal state, the system will issue an intermittent flashing green early warning instruction to remind users to strengthen real-time monitoring and update authentication information to ensure network stability and security; for a network in abnormal state, the system will issue a continuous flashing red early warning instruction, and automatically prohibit access to network resources and force users to log off, effectively preventing operations that may cause security risks and ensuring network security. The system can issue early warning instructions and take corresponding measures in a timely manner, improving the response speed and accuracy of network security. At the same time, in response to abnormal conditions, the system will execute security measures such as temporary password changes to strengthen account security and help prevent unauthorized access and network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic diagram of the steps of a network security dynamic early warning method based on a knowledge graph according to the present invention;

[0061] Figure 2 This is a schematic diagram of the process of a knowledge graph-based network security dynamic early warning system of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Example 1

[0064] See also Figure 1 The present invention provides a network security dynamic early warning method based on knowledge graph, comprising the following steps:

[0065] S1. Acquire known dangerous software in advance, and use natural language processing technology to extract network security related information from the known dangerous software, and build a preliminary network security knowledge graph. At the same time, monitor the data packet transmission status information and communication status information in the actual network host, and combine the preliminary network security knowledge graph to obtain relevant abnormal behavior information and establish a host network status data set;

[0066] S2. Based on cluster analysis technology, the host network status data set is aggregated into the preliminary network security knowledge graph to build a complete network security knowledge graph;

[0067] S3, constructing a difference factor Czp of the data packet according to the actual data packet transmission status information in the network host, and if the difference factor Czp of the data packet exceeds the difference threshold w, an early warning instruction will be issued externally;

[0068] S4. After receiving the early warning instruction, based on the communication status information and related abnormal behavior information in the actual network host, and in combination with the trained associated security situation model, the communication difference coefficient Tyxs and the behavior similarity coefficient Xxb are obtained, and the association index Gxzs is obtained by fitting by associating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb;

[0069] S5. Preset a relevant threshold value Q and compare and analyze it with the correlation index Gxzs to estimate the current network security status and issue corresponding early warning measures based on the corresponding network security status.

[0070] During the operation of this system, by pre-acquiring known dangerous software and building a knowledge graph, the system can quickly identify emerging and complex network threats, including known threats, security vulnerabilities, and attack behaviors, further improving the efficiency and accuracy of network security monitoring; combined with deep learning and pattern recognition technology, the system can timely and accurately issue network security warnings, including red, yellow, and green warnings, to help network administrators quickly take corresponding preventive measures to improve the response speed of network security; compared with traditional rule-based and signature-based systems, this system reduces false positives and missed positives, improves the accuracy and credibility of security incidents, and makes network management more efficient. By building a complete network security knowledge graph, the system can achieve a comprehensive understanding of the network security situation, including threat types, attack behaviors, and vulnerabilities, providing strong support for network security decision-making, and through a progressive warning method, it can help organizations better protect their network resources and data security while reducing the risk of network operation efficiency.

[0071] Example 2

[0072] Please refer to Figure 1Specifically, S1 includes:

[0073] S11. Use named entity recognition technology to identify entity information of known dangerous software, including but not limited to the name of the dangerous software, file hash value, communication port, attack method, user account, IP address, network domain name, name of the infected system and infection time, so that the system can accurately identify known security threats and effectively monitor and analyze them;

[0074] S12, and extracting the attributes in the entity according to the entity, the attributes include but are not limited to the communication protocol usage Txs2, login time, login location, login behavior, dangerous software propagation mode, impact range, attack target, data packet value, communication time and communication direction in several groups of known dangerous software in multiple monitoring cycles;

[0075] Among them, named entity recognition technology is part of the field of natural language processing. It is specifically used to identify entities with specific meanings in texts, such as names of people, places, organizations, time or currency. In network security reports, named entity recognition can help identify specific entities such as the name of a malware family, the name of an infected system or a description of an attack method, and identify them as specific entity types to facilitate subsequent relationship extraction and graph construction.

[0076] S13. Then, the information captured in S11 and S12 is initially organized to obtain a preliminary network security knowledge graph.

[0077] The S1 further comprises:

[0078] S14. The relevant information in the host network status data set includes data packet transmission status information, communication status information and related abnormal behavior information; which is helpful to timely discover potential security threats.

[0079] Record the data packet transmission status information in the actual network host, the data packet transmission status information includes monitoring the data packet value Sb1 in several groups of time nodes, and according to the data packet value Sb1 in several groups of time nodes, combining statistical averaging to obtain the data packet mean

[0080] In this embodiment, the named entity recognition technology NER is used to accurately identify various entity information of known dangerous software, thereby establishing an entity library of dangerous software, providing basic data for subsequent analysis and early warning; after extracting the attributes within the entity, detailed attribute information about the characteristics and propagation methods of dangerous software is obtained, which is helpful for in-depth analysis of the behavioral characteristics and impact range of dangerous software. A preliminary network security knowledge graph is established, combining the acquired entity information and attribute information to form a structured network security knowledge graph, which provides a visual and easy-to-understand basis for subsequent security analysis and early warning. In short, this step is conducive to a comprehensive understanding and analysis of dangerous software and network security situations, and lays an important foundation for the construction of a dynamic early warning system.

[0081] Example 3

[0082] Please refer to Figure 1 Specifically, S2 includes:

[0083] S21. Based on the preliminary network security knowledge graph and in combination with the host network status data set, a complete network security knowledge graph is constructed;

[0084] S22. At the same time, based on cluster analysis technology, the complete network security knowledge graph is identified and divided to form a number of clusters, each cluster representing a type of associated network security information, and the number of clusters include data packet difference information, communication difference information and behavior difference information.

[0085] In this embodiment, the complete network security knowledge graph constructed in the S21 stage can not only include known network security information, but also integrate the network host status information and abnormal behavior information monitored in real time, further forming a more comprehensive network security situation cognition; at the same time, cluster analysis technology is used to identify and divide the complete network security knowledge graph to form several clusters. Such division can better organize and manage network security information and provide a more accurate data basis for subsequent security analysis and early warning. Therefore, the work in the S2 stage helps the system to establish a more complete and accurate network security knowledge graph, improve the comprehensive cognition and monitoring capabilities of the network security situation, and provide more powerful support for the system's dynamic early warning and response.

[0086] Example 4

[0087] Please refer to Figure 1 Specifically, S3 includes:

[0088] S31, according to the data packet transmission status information in the actual network host, the data packet value Sb1 in the actual network host and the data packet value Sb2 in the known dangerous software are linearly normalized to obtain a difference factor Czp of the data packet, and the difference factor Czp of the data packet is obtained by the following formula:

[0089]

[0090] Where n is the number of monitored time nodes, i = 1, 2, 3, ..., n, Sb1 i Represented as the data packet value in the actual network host at the i-th time node, Sb2 i It is represented by the data packet value in the known dangerous software at the i-th time node;

[0091] The data packet value Sb1 in the actual network host and the data packet value Sb2 in the known dangerous software can be obtained through network traffic monitoring equipment or software. These equipment can be network data packet capturers, traffic analyzers or dedicated network traffic monitoring hardware;

[0092] S32, presetting a difference threshold w, and comparing and analyzing the difference factor Czp of the data packet with the difference threshold w to preliminarily estimate the current network security risk;

[0093] If the difference factor Czp of the data packet exceeds the difference threshold w, it indicates that the current network security is at risk, and an early warning instruction will be issued.

[0094] In this embodiment, in the S31 stage, the difference factor Czp of the data packet is calculated based on the data packet transmission status information in the actual network host, so as to quantify the difference between the network host data packet and the known dangerous software data packet, and further analyze the network security status; and the calculated data packet difference factor Czp is compared and analyzed with the difference threshold w. If the difference factor Czp of the data packet exceeds the set difference threshold w, it means that the current network security is at risk, and the system will issue an early warning instruction. This step can timely discover network security risks so as to initially take corresponding early warning measures. Therefore, the work in the S3 stage helps the system to quickly and accurately identify network security risks, issue early warning instructions in a timely manner, and effectively protect network security.

[0095] Example 5

[0096] Please refer to Figure 1 Specifically, S4 includes:

[0097] S41, receiving warning instructions;

[0098] S42. After receiving the early warning instruction, continuously obtain the communication status information of the actual network host in multiple monitoring cycles, as well as the related abnormal behavior information in the network:

[0099] S43, wherein the communication status information includes the communication protocol usage Tx1 in several groups of actual network hosts within multiple monitoring cycles, and extracts the maximum value therefrom; wherein the communication protocol usage Tx1 in several groups of actual network hosts can be monitored and statistics on the usage of different protocols through a network protocol analyzer, such as Wireshark, tcpdump.

[0100] S44. The related abnormal behavior information includes the difference Dyz between the number of failures with the same reason, the difference Fjc between accessed files, and the difference Ffc between unauthorized accesses. The difference Dyz between the number of failures with the same reason, the difference Fjc between accessed files, and the difference Ffc between unauthorized accesses are usually monitored by network security devices, such as firewalls or intrusion detection systems, to monitor abnormal activities, access behaviors, and security incidents in the network. These devices will record and report changes in these indicators.

[0101] In addition, the difference in the number of failures with the same reason Dyz refers to the difference in the number of user login failures caused by the same reason. The reasons for login failure include incorrect password, non-existent account, locked account, expired account or insufficient authority, etc.

[0102] S45. According to the communication status information in the actual network host and the complete network security knowledge graph, the abnormal communication status is analyzed to obtain the communication difference coefficient Tyxs:

[0103]

[0104] Where, Tx1 max It is the maximum value of the communication protocol usage in the actual network host during the monitoring period; Tx2 max It is represented by the maximum usage of communication protocols in known dangerous software during the monitoring period; It is expressed as the average difference between the communication protocol usage in actual network hosts and the communication protocol usage in known dangerous software during the monitoring period.

[0105] S46. Based on the complete network security knowledge graph and combined with relevant abnormal behavior information, obtain the behavior similarity coefficient Xxb:

[0106]

[0107] Where, Ffc i It is represented as the difference between the unauthorized access between the actual network host and the known dangerous software at the i-th time node, Fjc iIt is represented as the difference between the access files of the actual network host and the known dangerous software at the i-th time node, Dyz i It is expressed as the difference in the number of failures with the same cause between the actual network host and the known dangerous software at the i-th time node, Dyz avg It is expressed as the mean value of the difference Dyz of the number of failures with the same reason within the monitoring period, Ffc avg It is expressed as the mean value of the unauthorized access difference Ffc during the monitoring period, Fjc avg It is expressed as the mean value of the access file difference Fjc during the monitoring period.

[0108] In this embodiment, the appearance of stage S41 means that the system has realized that there may be security problems or abnormal situations in the network, which need further analysis and processing, and continuously obtains the communication status information of the actual network host and the relevant abnormal behavior information in the network within multiple monitoring cycles. The step of stage S43 helps the system understand the abnormal status and differences of network communication, thereby laying a foundation for subsequent judgment of network security situation; the system calculates the behavior similarity coefficient Xxb based on the complete network security knowledge graph and relevant abnormal behavior information, and by analyzing the unauthorized access difference Ffc, access file difference Fjc and failure number difference Dyz between the actual network host and the known dangerous software, the system can evaluate the similarity of the behavior in the network, thereby further judging the network security status. In summary, the work of stage S4 helps the system to conduct in-depth analysis and evaluation of network security risks, improves the system's perception and recognition capabilities of abnormal situations, and thus strengthens the monitoring and early warning effects of network security.

[0109] Example 6

[0110] Please refer to Figure 1 Specifically: S45, by associating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb, and after linear normalization processing, fitting to obtain the correlation index Gxzs, the correlation index Gxzs is obtained by the following formula:

[0111]

[0112] Where P is the correction constant.

[0113] The S5 includes:

[0114] S51, according to the comparison result of the correlation index Gxzs and the correlation threshold Q, the current network security status is estimated, and the specific content is as follows:

[0115] If the correlation index Gxzs> the correlation threshold Q, it indicates that the current network security is in an abnormal state;

[0116] If the correlation index Gxzs = the correlation threshold Q, it means that the current network security is not in an abnormal state;

[0117] If the correlation index Gxzs is less than the correlation threshold Q, it indicates that the current network security is in an abnormal state;

[0118] S52. Issue corresponding early warning measures based on network security status:

[0119] If the current network security is not in an abnormal state, an intermittent flashing green warning instruction will be automatically issued at this time. However, it is still necessary to strengthen real-time monitoring of the system, promptly discover and handle abnormal activities, and stipulate that the user's authentication must be replaced within 12 hours to ensure the security and stability of the network; if the current network security is in an abnormal state, a continuous flashing red warning instruction will be automatically issued at this time, and access to network resources will be automatically prohibited, operations that may cause security risks will be blocked, and users will be forced to go offline to prevent further threats to the network, and passwords will be temporarily changed to improve account security.

[0120] In this embodiment, by monitoring and analyzing real-time network data, the system can quickly identify potential security issues and issue timely warning instructions according to the relevant threshold Q, further improving the response speed and accuracy of network security. Through deep learning and pattern recognition technology, the system can identify emerging and complex network threats, and compared with traditional rule-based and signature-based systems, it reduces false positives and false negatives. According to the comparison results of the correlation index Gxzs and the relevant threshold Q, the system can automatically judge the current network security status and issue corresponding warning measures. This dynamic adjustment can more effectively respond to security threats in different situations and improve the adaptability and flexibility of the system. In the abnormal state of network security, the system can automatically take measures, such as forcing users to go offline or change passwords, etc., to further improve the security of accounts and the protection level of network resources, and reduce the spread and impact of security risks. In general, this knowledge graph-based network security dynamic warning system can effectively improve the monitoring, warning and response capabilities of network security, and ensure the stable operation of the network and the security of data.

[0121] Example 7

[0122] Please refer to Figure 2 ,Specifically: A network security dynamic early warning system based on knowledge graph, including a graph building module, a data collection module, an association module, a preliminary monitoring module, a security analysis module, and a dynamic early warning module;

[0123] The graph building module is used to pre-acquire known dangerous software, extract network security related information from the known dangerous software using natural language processing technology, and construct a preliminary network security knowledge graph;

[0124] The data acquisition module is used to monitor and record the data packet transmission status information and communication status information in the actual network host, and obtain relevant abnormal behavior information in combination with the preliminary network security knowledge graph to establish a host network status data set;

[0125] The association module is used to summarize and identify the preliminary network security knowledge graph and the host network status data set based on cluster analysis technology to build a complete network security knowledge graph;

[0126] The preliminary monitoring module is used to construct a difference factor Czp of the data packet according to the actual data packet transmission status information in the network host. If the difference factor Czp of the data packet exceeds the difference threshold w, an early warning instruction will be issued externally;

[0127] The security analysis module is used to receive the early warning instruction, and after receiving the early warning instruction, based on the communication status information and related abnormal behavior information in the actual network host, and combined with the trained associated security situation model, obtain the communication difference coefficient Tyxs and the behavior similarity coefficient Xxb, and obtain the association index Gxzs by fitting by associating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb;

[0128] The dynamic warning module is used to pre-set the relevant threshold Q, and compare and analyze it with the correlation index Gxzs, and issue corresponding warning measures according to the corresponding network security level.

[0129] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security dynamic early warning method based on knowledge graph, characterized by: The following steps are involved: S1. Acquire known dangerous software in advance, and use natural language processing technology to extract network security related information from the known dangerous software, and build a preliminary network security knowledge graph. At the same time, monitor the data packet transmission status information and communication status information in the actual network host, and combine the preliminary network security knowledge graph to obtain relevant abnormal behavior information and establish a host network status data set; S2. Based on cluster analysis technology, the host network status data set is aggregated into the preliminary network security knowledge graph to build a complete network security knowledge graph; S3, constructing a difference factor Czp of the data packet according to the actual data packet transmission status information in the network host, and if the difference factor Czp of the data packet exceeds the difference threshold w, an early warning instruction will be issued externally; S4. After receiving the early warning instruction, based on the communication status information and related abnormal behavior information in the actual network host, and in combination with the trained associated security situation model, the communication difference coefficient Tyxs and the behavior similarity coefficient Xxb are obtained, and the association index Gxzs is obtained by fitting by associating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb; S5. Preset a relevant threshold value Q and compare and analyze it with the correlation index Gxzs to estimate the current network security status and issue corresponding early warning measures based on the corresponding network security status.

2. According to claim 1, a knowledge graph-based network security dynamic early warning method is characterized by: The S1 includes: S11. Using named entity recognition technology, identify entity information of known dangerous software, including but not limited to the name of the dangerous software, file hash value, communication port, attack method, user account, IP address, network domain name, name of the infected system and infection time; S12, and extracting the attributes in the entity according to the entity, the attributes include but are not limited to the communication protocol usage Txs2, login time, login location, login behavior, dangerous software propagation mode, impact range, attack target, data packet value, communication time and communication direction in several groups of known dangerous software in multiple monitoring cycles; S13. Then, the information captured in S11 and S12 is initially organized to obtain a preliminary network security knowledge graph.

3. According to claim 2, a network security dynamic early warning method based on knowledge graph is characterized by: The S1 further comprises: S14, the relevant information in the host network status data set includes data packet transmission status information, communication status information and related abnormal behavior information; Record the data packet transmission status information in the actual network host, the data packet transmission status information includes monitoring the data packet value Sb1 in several groups of time nodes, and according to the data packet value Sb1 in several groups of time nodes, combining statistical averaging to obtain the data packet mean 4. According to claim 1, a network security dynamic early warning method based on knowledge graph is characterized by: The S2 includes: S21. Based on the preliminary network security knowledge graph and in combination with the host network status data set, a complete network security knowledge graph is constructed; S22. At the same time, based on cluster analysis technology, the complete network security knowledge graph is identified and divided to form a number of clusters, each cluster represents a type of related network security information, and the number of clusters include data packet difference information, communication difference information and behavior difference information.

5. According to claim 3, a knowledge graph-based network security dynamic early warning method is characterized by: The S3 includes: S31, according to the data packet transmission status information in the actual network host, the data packet value Sb1 in the actual network host and the data packet value Sb2 in the known dangerous software are linearly normalized to obtain a difference factor Czp of the data packet, and the difference factor Czp of the data packet is obtained by the following formula: Where n is the number of monitored time nodes, i = 1, 2, 3, ..., n, Sb1 i Represented as the data packet value in the actual network host at the i-th time node, Sb2 i It is represented by the data packet value in the known dangerous software at the i-th time node; S32, presetting a difference threshold w, and comparing and analyzing the difference factor Czp of the data packet with the difference threshold w to preliminarily estimate the current network security risk; If the difference factor Czp of the data packet exceeds the difference threshold w, it indicates that the current network security is at risk, and an early warning instruction will be issued.

6. A network security dynamic early warning method based on knowledge graph according to claim 5, characterized in that: The S4 includes: S41, receiving warning instructions; S42. After receiving the early warning instruction, continuously obtain the communication status information of the actual network host in multiple monitoring cycles, as well as the related abnormal behavior information in the network: S43, wherein the communication status information includes the communication protocol usage Tx1 in a plurality of groups of actual network hosts in a plurality of monitoring cycles, and extracts the maximum value therefrom; S44, the related abnormal behavior information includes the failure reason number difference Dyz, the access file difference Fjc and the unauthorized access difference Ffc; S45. According to the communication status information in the actual network host and the complete network security knowledge graph, the abnormal communication status is analyzed to obtain the communication difference coefficient Tyxs: Where, Tx1 max It is the maximum value of the communication protocol usage in the actual network host during the monitoring period; Tx2 max It is represented by the maximum usage of communication protocols in known dangerous software during the monitoring period; It is expressed as the average difference between the communication protocol usage in actual network hosts and the communication protocol usage in known dangerous software during the monitoring period.

7. A network security dynamic early warning method based on knowledge graph according to claim 6, characterized in that: S46. Based on the complete network security knowledge graph and combined with relevant abnormal behavior information, obtain the behavior similarity coefficient Xxb: Where, Ffc i It is represented as the difference between the unauthorized access between the actual network host and the known dangerous software at the i-th time node, Fjc i It is represented as the difference between the access files of the actual network host and the known dangerous software at the i-th time node, Dyz i It is expressed as the difference in the number of failures with the same cause between the actual network host and the known dangerous software at the i-th time node, Dyz avg It is expressed as the mean value of the difference Dyz of the number of failures with the same reason within the monitoring period, Ffc avg It is expressed as the mean value of the unauthorized access difference Ffc during the monitoring period, Fjc avg It is expressed as the mean value of the access file difference Fjc during the monitoring period.

8. The method for dynamic network security early warning based on knowledge graph according to claim 1 is characterized by: S45, by correlating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb, and after linear normalization processing, fitting to obtain the correlation index Gxzs, the correlation index Gxzs is obtained by the following formula: Where P is the correction constant.

9. A knowledge graph-based network security dynamic early warning method according to claim 8, characterized in that: The S5 includes: S51, according to the comparison result of the correlation index Gxzs and the correlation threshold Q, the current network security status is estimated, and the specific content is as follows: If the correlation index Gxzs> the correlation threshold Q, it indicates that the current network security is in an abnormal state; If the correlation index Gxzs = the correlation threshold Q, it means that the current network security is not in an abnormal state; If the correlation index Gxzs is less than the correlation threshold Q, it indicates that the current network security is in an abnormal state; S52. Issue corresponding early warning measures based on network security status: If the current network security is not in an abnormal state, an intermittent flashing green warning instruction will be automatically issued at this time, but it is still necessary to strengthen real-time monitoring of the system, promptly discover and handle abnormal activities, and require the user's authentication to be replaced within 12 hours; if the current network security is in an abnormal state, a continuous flashing red warning instruction will be automatically issued at this time, and access to network resources will be automatically prohibited, forcing users to log off, and temporarily changing passwords.

10. A network security dynamic early warning system based on knowledge graph, comprising a network security dynamic early warning method based on knowledge graph as claimed in any one of claims 1 to 9, characterized in that: It includes graph building module, data collection module, association module, preliminary monitoring module, safety analysis module and dynamic warning module; The graph building module is used to pre-acquire known dangerous software, extract network security related information from the known dangerous software using natural language processing technology, and construct a preliminary network security knowledge graph; The data acquisition module is used to monitor and record the data packet transmission status information and communication status information in the actual network host, and obtain relevant abnormal behavior information in combination with the preliminary network security knowledge graph to establish a host network status data set; The association module is used to summarize and identify the preliminary network security knowledge graph and the host network status data set based on cluster analysis technology to build a complete network security knowledge graph; The preliminary monitoring module is used to construct a difference factor Czp of the data packet according to the actual data packet transmission status information in the network host. If the difference factor Czp of the data packet exceeds the difference threshold w, an early warning instruction will be issued externally; The security analysis module is used to receive the early warning instruction, and after receiving the early warning instruction, based on the communication status information and related abnormal behavior information in the actual network host, and combined with the trained associated security situation model, obtain the communication difference coefficient Tyxs and the behavior similarity coefficient Xxb, and obtain the association index Gxzs by fitting by associating the communication difference coefficient Tyxs with the behavior similarity coefficient Xxb; The dynamic warning module is used to pre-set the relevant threshold Q, and compare and analyze it with the correlation index Gxzs, and issue corresponding warning measures according to the corresponding network security level.

Images