Network attack early warning method and device based on knowledge graph, equipment and medium

Abstract

The invention provides a network attack early warning method and device based on a knowledge graph, equipment and a medium. The method comprises the following steps: acquiring a preset network path knowledge graph; wherein the preset network path mapping knowledge domain comprises a plurality of nodes, the nodes in the preset network path mapping knowledge domain represent geographic positions where network connection exists, and the connection relation between different nodes represents network paths between different geographic positions; nodes in a preset path are determined, and the number of historical attacks between different nodes in the preset path is obtained from a preset network path knowledge graph; wherein the number of historical attacks represents the number of network attacks of the network path in a preset historical time period; and according to the number of historical attacks between different nodes in the preset path, determining whether to perform early warning processing on the preset path. And early warning processing is performed on the preset path, so that the preset path can be detected more accurately, and loss caused by traffic attack is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a knowledge graph-based network attack early warning method, device, equipment and medium. Background Art

[0002] In today's network world, high-volume attacks have become a major challenge facing network security. Attackers use some method to launch extremely high-volume attacks on target systems or networks, resulting in serious consequences such as system crashes, data loss, or privacy leaks. The consequences of such attacks may cause serious economic losses and privacy leaks to enterprises and individuals.

[0003] Therefore, how to issue early warning for large-volume attacks is an urgent problem that needs to be solved. Summary of the invention

[0004] The present application provides a knowledge graph-based network attack early warning method, device, equipment and medium to achieve early warning of large-volume attacks.

[0005] In the first aspect, the present application provides an early warning method for network attacks based on a knowledge graph, comprising:

[0006] Obtain a preset network path knowledge graph; wherein the preset network path knowledge graph includes a plurality of nodes, the nodes in the preset network path knowledge graph represent geographical locations where network connections exist, and the connection relationships between different nodes represent network paths between different geographical locations;

[0007] Determine the nodes in the preset path, and obtain the number of historical attacks between different nodes in the preset path from the preset network path knowledge graph; wherein the number of historical attacks represents the number of network attacks on the network path within a preset historical time period;

[0008] According to the number of historical attacks between different nodes in the preset path, it is determined whether to perform early warning processing on the preset path.

[0009] Optionally, the above method obtains the number of historical attacks between different nodes in a preset path from a preset network path knowledge graph, including:

[0010] From a preset network path knowledge graph, determine the edge connections between adjacent nodes in the preset path; wherein each edge connection in the preset network path knowledge graph stores a corresponding number of historical attacks;

[0011] The number of historical attacks corresponding to the edge connections between adjacent nodes in the preset path is obtained, and the number of historical attacks between different nodes in the preset path is determined.

[0012] Optionally, the above method, according to the number of historical attacks between different nodes in the preset path, determines whether to perform early warning processing on the preset path, including:

[0013] According to the correlation between the preset number of network attacks and the number weight, the number weight corresponding to the number of historical attacks between different nodes in the preset path is determined as the target weight; wherein the number weight represents the importance of the network path between different nodes;

[0014] According to the target weight, determine whether to perform early warning processing on the preset path.

[0015] Optionally, the above method determines whether to perform early warning processing on the preset path according to the target weight, including:

[0016] According to the target weight, the warning probability of the preset path is determined; wherein the warning probability represents the possibility of the preset path being attacked;

[0017] If the warning probability is greater than the preset probability threshold, the preset path will be warned.

[0018] Optionally, the above method, according to the target weight, determines the warning probability of the preset path, including:

[0019] Determine a subpath in the preset path; wherein the subpath represents a path between different nodes in the preset path;

[0020] According to the path direction of the preset path, determine the starting node in the subpath;

[0021] From the preset network path knowledge graph, obtain the number of nodes that have edge connections with the starting node as the target number;

[0022] According to the number of targets corresponding to each starting node and the weight of each target, the warning probability of the preset path is determined.

[0023] Optionally, the above method, according to the number of targets corresponding to each starting node and the weight of each target, determines the warning probability of the preset path, including:

[0024] Determine the target weight corresponding to the subpath where the starting node is located;

[0025] The warning probability of the preset path is determined according to the target quantity corresponding to the starting node, the target weight corresponding to the subpath where the starting node is located, and the number of subpaths in the preset path.

[0026] Optionally, the above method obtains a preset network path knowledge graph, including:

[0027] If it is determined that there is a network path between different geographical locations, the number of network attacks on the network path between the different geographical locations within a preset historical time period is obtained;

[0028] Determine the starting and ending points in different geographical locations based on the direction of the network path;

[0029] Construct triplet data based on the starting points and end points in different geographical locations, and the number of network attacks on the network paths between different geographical locations within a preset historical time period;

[0030] Generate a network path knowledge graph based on triple data.

[0031] In a second aspect, the present application provides an early warning device for network attacks based on a knowledge graph, comprising:

[0032] A first acquisition module is used to acquire a preset network path knowledge graph; wherein the preset network path knowledge graph includes a plurality of nodes, the nodes in the preset network path knowledge graph represent geographical locations where network connections exist, and the connection relationships between different nodes represent network paths between different geographical locations;

[0033] The second acquisition module is used to determine the nodes in the preset path, and obtain the number of historical attacks between different nodes in the preset path from the preset network path knowledge graph; wherein the number of historical attacks represents the number of network attacks on the network path within a preset historical time period;

[0034] The determination module is used to determine whether to perform early warning processing on the preset path according to the number of historical attacks between different nodes in the preset path.

[0035] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0036] Memory stores computer-executable instructions;

[0037] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0039] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0040] The present application provides a network attack warning method, device, equipment and medium based on knowledge graph, by obtaining a preset network path knowledge graph; wherein the preset network path knowledge graph includes multiple nodes, the nodes in the preset network path knowledge graph represent the geographical location where the network connection exists, and the connection relationship between different nodes represents the network path between different geographical locations; determine the nodes in the preset path, and obtain the historical attack times between different nodes in the preset path from the preset network path knowledge graph; save the historical attack times between different nodes through the preset network path knowledge graph, and through the structured and semantic display of the connection relationship between nodes and the historical attack times between nodes, the historical attack times of the corresponding nodes can be found more quickly. Among them, the historical attack times represent the number of network attacks on the network path within a preset historical time period; according to the historical attack times between different nodes in the preset path, determine whether to perform warning processing on the preset path. By using the geographical location of the network connection as a node in the preset network path knowledge graph and combining the historical attack times between nodes, the accuracy of the warning result can be improved, and the preset path warning processing can timely warn the preset path with high risk of traffic attack, thereby strengthening protection in advance and improving the security of the preset path. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] Figure 1 A schematic diagram of a flow chart of a network attack early warning method based on a knowledge graph provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of the structure of a network path knowledge graph provided in an embodiment of the present application;

[0044] Figure 3 A flowchart of another method for early warning of network attacks based on knowledge graphs provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of the structure of a knowledge graph-based network attack early warning device provided in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0047] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0048] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0049] First, the terms involved in this application are explained:

[0050] Knowledge graph: a structured way to represent and organize knowledge. It constructs a graph structure through nodes (representing entities or concepts) and edges (representing the relationship between entities), so that complex knowledge systems and associations can be more intuitively displayed.

[0051] Triplet data is a form of structured data used to represent relationships, and is commonly used in fields such as knowledge graphs, semantic webs, and natural language processing. A triplet consists of three elements, usually represented as (subject, predicate, object) or (entity 1, relationship, entity 2).

[0052] At present, in today's network world, large-volume attacks have become a major challenge facing network security. Attackers use some method to launch extremely high-volume attacks on target systems or networks, resulting in serious consequences such as system crashes, data loss or privacy leaks. The consequences of such attacks may cause serious economic losses and privacy leaks to enterprises and individuals. The existing technology mainly uses attributes such as the number of access permissions and the depth of access paths to warn of network security incidents. However, this method has low adaptability to network connection methods related to geographical locations, making the warning results inaccurate.

[0053] The present application provides a network attack warning method, device, equipment and medium based on knowledge graph, by obtaining a preset network path knowledge graph; wherein the preset network path knowledge graph includes multiple nodes, the nodes in the preset network path knowledge graph represent the geographical location where the network connection exists, and the connection relationship between different nodes represents the network path between different geographical locations; determine the nodes in the preset path, and obtain the historical attack times between different nodes in the preset path from the preset network path knowledge graph; save the historical attack times between different nodes through the preset network path knowledge graph, and through the structured and semantic display of the connection relationship between nodes and the historical attack times between nodes, the historical attack times of the corresponding nodes can be found more quickly. Among them, the historical attack times represent the number of network attacks on the network path within a preset historical time period; according to the historical attack times between different nodes in the preset path, determine whether to perform warning processing on the preset path. By using the geographical location of the network connection as a node in the preset network path knowledge graph and combining the historical attack times between nodes, the accuracy of the warning result can be improved, and the preset path warning processing can timely warn the preset path with high risk of traffic attack, thereby strengthening protection in advance and improving the security of the preset path.

[0054] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0055] Figure 1 An early warning method for network attacks based on knowledge graph is provided in the embodiment of the present application. Figure 1 As shown, the execution subject of the method can be a server, and this embodiment does not make any special restrictions here. Figure 1 As shown, the method includes:

[0056] S101. Obtain a preset network path knowledge graph; wherein the preset network path knowledge graph includes multiple nodes, the nodes in the preset network path knowledge graph represent geographical locations where network connections exist, and the connection relationship between different nodes represents the network paths between different geographical locations.

[0057] The geographical location represents a specific area, for example, area A, area B.

[0058] A network path knowledge graph is pre-built, and the preset network path knowledge graph describes the relationship between traffic attacks during traffic transmission between networks in multiple specific areas and any two specific areas in multiple specific areas. For example, the relationship between traffic attacks can refer to the number of traffic attacks in two specific areas within a preset historical time.

[0059] A node can refer to a network in a specific area. A specific area can be regarded as a switch. Different nodes mean that the specific area networks represented by the nodes are different.

[0060] Figure 2 A schematic diagram of the structure of a network path knowledge graph provided in an embodiment of the present application. Figure 2 As shown, circle A represents the network of area A (also can be regarded as node A), circle B represents the network of area B (also can be regarded as node B), circle C represents the network of area C, circle D represents the network of area D, the number of times A transmits data to B and is attacked is 100, the number of times B transmits data to A is 200, and the rest is similar. It is worth noting that if there is no data transmission between A and D or the data transmission is not attacked, there is no arrow between A and D.

[0061] In the embodiment of the present application, obtaining a preset network path knowledge graph includes:

[0062] If it is determined that there is a network path between different geographical locations, the number of network attacks on the network path between the different geographical locations within a preset historical time period is obtained;

[0063] Determine the starting and ending points in different geographical locations based on the direction of the network path;

[0064] Construct triplet data based on the starting points and end points in different geographical locations, and the number of network attacks on the network paths between different geographical locations within a preset historical time period;

[0065] Generate a network path knowledge graph based on triple data.

[0066] The network path between different geographical locations refers to the data transmission path between two different specific area networks.

[0067] The preset historical time period refers to a preset period of time in the past, which can refer to the past month or the past two months.

[0068] The network path direction refers to the direction of data transmission. For example, there are networks in area A and area B, and data is transmitted from A to B and from B to A.

[0069] The number of network attacks can refer to the number of traffic attacks. Traffic attack is a type of network attack in which the attacker attempts to exhaust the resources of the target system by sending a large number of data packets or requests to the target system, making it unable to provide normal services. Traffic attack methods include: Denial of Service (DoS), Distributed Denial of Service (DDoS), SYN Flood, UDP Flood, ICMP Flood, HTTP Flood, DNS Amplification Attack, and NTP Amplification Attack.

[0070] The Common Weakness Enumeration (CWE) and the preset information security vulnerability library can be used to identify whether it is a traffic attack and the method of the traffic attack.

[0071] The triplet data includes the starting point and end point of the network path, and the number of traffic attacks between the starting point and the end point.

[0072] The network path knowledge graph refers to the representation of network paths through nodes (starting point and end point of the path) and edges (number of network attacks).

[0073] Determine the network of area A (also known as A node) and the network of area B (also known as B node), record the data transmitted from A to B as A->B, and the same applies to the rest of the application. If A->B has had data transmission in the past month and has been attacked by traffic, then obtain the number of traffic attacks on A->B: 100. At this time, A is the starting point and B is the end point. Then, according to point A, point B, and 100, the triple data obtained is (A, 100, B). At the same time, if B->A has had data transmission in the past month and has been attacked by traffic, then obtain the number of traffic attacks on B->A: 200. At this time, B is the starting point and A is the end point. Then, according to point A, point B, and 200, the triple data obtained is (B, 200, A). A network path knowledge graph is obtained based on all the triples obtained. For example, Figure 2 In the example, A is attacked 100 times when transmitting data to B, and B is attacked 200 times when transmitting data to A. The same goes for the rest.

[0074] The advantage of this setting is that by constructing a network path knowledge graph, it can effectively improve network security protection capabilities and help network security personnel better monitor, analyze and respond to network attack incidents.

[0075] S102. Determine the nodes in the preset path, and obtain the number of historical attacks between different nodes in the preset path from the preset network path knowledge graph; wherein the number of historical attacks represents the number of network attacks on the network path within a preset historical time period.

[0076] Among them, the path to be detected is pre-set as a preset path. The nodes in the preset path include a node representing the starting point of the path and a node representing the end point of the path. There may be other nodes between the node at the starting point of the path and the node at the end point of the path, or there may be no other nodes. After confirming the node at the starting point of the path and the node at the end point of the path, the number of network attacks from the node at the starting point of the path to the node at the end point of the path in a preset historical time period is obtained from the preset network path knowledge graph as the number of historical attacks.

[0077] In the embodiment of the present application, the number of historical attacks between different nodes in the preset path is obtained from the preset network path knowledge graph, including:

[0078] From a preset network path knowledge graph, determine the edge connections between adjacent nodes in the preset path; wherein each edge connection in the preset network path knowledge graph stores a corresponding number of historical attacks;

[0079] The number of historical attacks corresponding to the edge connections between adjacent nodes in the preset path is obtained, and the number of historical attacks between different nodes in the preset path is determined.

[0080] The preset path includes at least two nodes, which can be two nodes or three nodes.

[0081] The edge connection represents two nodes, the transmission direction between the two nodes, and the number of historical attacks on the two nodes in the corresponding transmission direction.

[0082] If the preset path is A->B->C, where region A is the starting node, region C is the ending node, and region B is the intermediate node. A and B are adjacent nodes, and B and C are adjacent nodes. Then the edge connection of A->B and the corresponding number of historical attacks are obtained from the preset network knowledge graph, which is (A, 1000, B), and the corresponding edge connection of B->C and the corresponding number of historical attacks are obtained from the preset network knowledge graph, which is (B, 2000, C), where 1000 is the number of historical attacks of A->B, and 2000 is the number of historical attacks of B->C.

[0083] The advantage of this setting is that by obtaining the historical attack times between different nodes in the preset path from the preset network path knowledge graph, the accuracy and effectiveness of network security protection can be further improved, helping network security personnel to better monitor, analyze and respond to network attack incidents.

[0084] S103: Determine whether to perform early warning processing on the preset path according to the number of historical attacks between different nodes in the preset path.

[0085] The subsequent processing of the preset path is determined according to the number of historical attacks between different nodes in the preset path. If the number of historical attacks is large, it is necessary to issue an early warning for the preset path, or to strengthen protection or monitoring. If the number of attacks is small, no early warning is required.

[0086] In the embodiment of the present application, determining whether to perform early warning processing on the preset path according to the number of historical attacks between different nodes in the preset path includes:

[0087] According to the correlation between the preset number of network attacks and the number weight, the number weight corresponding to the number of historical attacks between different nodes in the preset path is determined as the target weight; wherein the number weight represents the importance of the network path between different nodes;

[0088] According to the target weight, determine whether to perform early warning processing on the preset path.

[0089] Among them, the correlation relationship refers to the different sizes of network attack times corresponding to different sizes of number weights. If the number of network attacks is small, then the probability of the data transmission of the corresponding node being attacked is small, and the corresponding number weight is small. If the number of network attacks is large, then the probability of the data transmission of the corresponding node being attacked is large, and the corresponding number weight is large.

[0090] The target weight can be any value, but it is best to be less than or equal to 1, for example: 1, 0.3, 0.5, etc.

[0091] For example: when the number of network attacks is less than 1000, the number weight is 0.3; when the number of network attacks is greater than 1000 and less than 2000, the number weight is 0.5; when the number of network attacks is greater than 2000, the number weight is 1. If there is a path A->B, and the corresponding historical attack number is 1500, then the corresponding number weight is 0.5, which is the target weight. If the target weight threshold is set to 1, then the number weight 0.5 is less than 1, which means that there is no need to perform early warning processing on the path A->B. Other weights can also be introduced to comprehensively judge whether it is necessary to perform early warning processing on the path A->B through other weights and number weights. Other weights can be weights that characterize the importance of nodes.

[0092] The advantage of this setting is that by determining whether to issue an early warning for the preset path based on the number of historical attacks between different nodes in the preset path, the accuracy and timeliness of network security early warnings can be significantly improved, helping network security personnel to better monitor, analyze and respond to network attack incidents.

[0093] In the embodiment of the present application, determining whether to perform early warning processing on the preset path according to the target weight includes:

[0094] According to the target weight, the warning probability of the preset path is determined; wherein the warning probability represents the possibility of the preset path being attacked;

[0095] If the warning probability is greater than the preset probability threshold, the preset path will be warned.

[0096] Among them, the warning probability represents the possibility that the preset path is actually attacked. The warning probability can be calculated by the target weight, for example: the preset formula, the target weight is input into the preset formula, and the warning probability can be obtained.

[0097] The probability threshold itself is just a numerical value. It can be calculated based on the historical attack data of the past three months (or the historical attack data of the past month), and then all nodes are combined in pairs in an exhaustive manner, and then an average value is calculated based on the out-degree weight of all paths and the attack weight of all paths as the probability threshold. Each enterprise can set it according to the actual situation. For example, some enterprises have higher security requirements and more important data transmission, so they will set a lower threshold and process all potential attacks. Some enterprises have less requirements and less important data, so they will set a larger threshold and only process very high-risk attacks.

[0098] According to the target weight, the warning probability of the preset path is obtained. If the warning probability is greater than the preset probability threshold, it indicates that the preset path is likely to be attacked. In this case, the preset path is warned to remind relevant personnel to strengthen protection of the preset path.

[0099] The advantage of this setting is that by determining the warning probability of the preset path according to the target weight, and performing warning processing when the warning probability is greater than the preset probability threshold, the accuracy and timeliness of network security warnings can be significantly improved.

[0100] In the embodiment of the present application, determining the warning probability of the preset path according to the target weight includes:

[0101] Determine a subpath in the preset path; wherein the subpath represents a path between different nodes in the preset path;

[0102] According to the path direction of the preset path, determine the starting node in the subpath;

[0103] From the preset network path knowledge graph, obtain the number of nodes that have edge connections with the starting node as the target number;

[0104] According to the number of targets corresponding to each starting node and the weight of each target, the warning probability of the preset path is determined.

[0105] Among them, the sub-path has fewer nodes than the preset path, the adjacent nodes with connection relationship in the sub-path are consistent with the preset path, and the data transmission direction of the sub-path is consistent with the preset path. For example, the preset path is A->B->C->D, and the sub-path obtained by splitting is A->B, but not B->A.

[0106] Each target weight refers to the target weight of each subpath.

[0107] For example: the preset path is A->B->C->D, and the sub-paths obtained by splitting are A->B, B->C, C->D, and A->B->C. For A->B, A is the starting node, for B->C, B is the starting node, and for C->D, C is the starting node. For A->B->C, if there are (A, 100, B), (A, 200, C), and (A, 200, D) in the preset knowledge graph, then it is proved that there are three nodes B, C, and D connected to A by edges, then the target number of A is 3, and the same can be obtained for B, C, and D. The target number and target weight of each sub-path are calculated to obtain the warning probability of the preset path. The target number and target weight of each sub-path can be substituted into the preset enterprise to obtain the warning probability of the preset path.

[0108] The advantage of this setting is that by determining the warning probability of the preset path based on the target weight and the number of targets, the accuracy and effectiveness of network security warnings can be further improved, helping network security personnel to better monitor, analyze and respond to network attack incidents.

[0109] In the embodiment of the present application, the warning probability of the preset path is determined according to the number of targets corresponding to each starting node and the weight of each target, including:

[0110] Determine the target weight corresponding to the subpath where the starting node is located;

[0111] The warning probability of the preset path is determined according to the target quantity corresponding to the starting node, the target weight corresponding to the subpath where the starting node is located, and the number of subpaths in the preset path.

[0112] Among them, the target weight is also the frequency weight of the sub-path.

[0113] The warning probability of the preset path satisfies:

[0114] p=(C1×R1+C2×R2+……+Cn×Rn) / n,

[0115] Among them, C1, C2, ..., Cn represent the target quantity corresponding to the starting node, R1, R2, ..., Rn represent the target weight corresponding to the sub-path where the starting node is located, n represents the number of sub-paths in the preset path, and p represents the warning probability of the preset path.

[0116] When the preset number of network attacks is less than 1000, the number weight is 0.3. When the number of network attacks is greater than 1000 and less than 2000, the number weight is 0.5. When the number of network attacks is greater than 2000, the number weight is 1. The preset path is A->B->C->D, and the sub-paths obtained by splitting are A->B, B->C, C->D, and A->B->C. For A->B, (A, 800, B) is obtained from the preset network path knowledge graph, and the corresponding 800 is less than 1000. Therefore, the number weight of A->B is 0.3, that is, the target weight corresponding to A->B is 0.3. Similarly, the number weights of B->C, C->D, and A->B->C are obtained. It is worth noting that the number weight of A->B->C here is the number weight corresponding to (A, x, C) obtained from the preset network path knowledge graph, x is the corresponding number of historical attacks, and x is any positive integer. At this time, if there are (A, 100, B), (A, 200, C), (A, 200, D) in the preset knowledge graph, then it is proved that there are three nodes B, C, and D connected to A by edges. Then in A->B, the target number of the starting node A is 3. Similarly, the target number corresponding to the starting node B in B->C, the target number corresponding to the starting node C in C->D, and the target number of the starting node A in A->B->C can be obtained. And there are four subpaths, A->B, B->C, C->D, and A->B->C (that is, n). Therefore, the warning probability of the preset path can be obtained by substituting it into the formula:

[0117] The warning probability p of the preset path A->B->C->D = {(the target number of starting node A in A->B) × (the frequency weight of A->B) + (the target number of starting node B in B->C) × (the frequency weight of B->C) + (the target number of starting node C in C->D) × (the frequency weight of C->D) + (the target number of starting node A in A->B->C) × (the frequency weight of A->B->C is 0.3)} / 4.

[0118] The advantage of this setting is that by determining the warning probability of the preset path based on the number of targets corresponding to each starting node and the weight of each target, the accuracy and effectiveness of network security warnings can be further improved, helping network security personnel to better monitor, analyze and respond to network attack incidents.

[0119] The knowledge graph-based network attack early warning method provided by the present application uses a preset network path knowledge graph to confirm the number of historical attacks between different nodes in the preset path, and obtains the early warning probability of the preset path through the number of historical attacks and the target number of starting nodes of the sub-path in the preset path. At the same time, the early warning probability is compared with the probability threshold, which can timely detect the risks of the preset path and improve the security of data transmission at each node.

[0120] Figure 3 Another early warning method for network attacks based on knowledge graphs is provided in the embodiment of the present application. Figure 3 As shown, the execution subject of the method can be a server, and this embodiment does not make any special restrictions here. Figure 3 As shown, the method includes:

[0121] S301: Build a knowledge graph.

[0122] Among them, the method of constructing the knowledge graph is:

[0123] Based on historical attack data, build a knowledge graph:

[0124] The knowledge graph includes: (N, R) formula and P(Nk, Rr, Nj) formula. In the formula H=(N, R), the node set N=(N1, N2, ..., Nk), and the relationship set R=(R1, R2, ..., Rm); k is the number of nodes, m is the number of relationships (i.e., the number of attacks), the relationship set represents the number of attacks, and the node set represents the number of regional networks. For example, if there are three regional networks A, B, and C, then N=(A, B, C), and the number of attacks is 1000, 2000, 500, and 100, then the relationship set R=(1000, 2000, 500, 100); in the formula P(Nk, Rr, Nj), P is the predicate; Nk and Nj are the kth node and the jth node respectively; Rr is the attack relationship (i.e., the number of attacks). For example, the number of attacks from A to B is 100, which is expressed as P(A, 100, B). Representing all data in the form of the above triples can clearly represent the relationship between the nodes on the backbone network and the number of attacks between any two nodes.

[0125] S302: Split the historical attack path to obtain multiple sub-attack paths of the historical attack path;

[0126] S303: The attack probability of the historical path is calculated based on the number of attacks between nodes in the knowledge graph, the out-degree weight of each node, the weight of the number of attacks, the number of sub-attack paths, and the attack probability of the historical path.

[0127] Among them, if the number of attacks is greater than 2000, the weight of the number of attacks is 1; if the number of attacks is less than 2000 but greater than 1000, the weight of the number of attacks is 0.5; if the number of attacks is less than 1000, the weight of the number of attacks is 0.3.

[0128] The out-degree weight indicates how many paths there are with a node as the starting node. For example, in the knowledge graph, there are (A, 100, B) and (A, 1000, C), which means that there are two paths with A as the starting node, so the out-degree weight of A is A.

[0129] The historical attack path is A->B->C->D, and the sub-paths obtained by splitting are A->B, B->C, C->D, A->B->C, so there are 4 sub-attack paths.

[0130] The attack probability of the sub-attack path is:

[0131] The attack probability of a subpath is: p = (C1×R1+C2×R2+…+Cn×Rn) / n,

[0132] Among them, p represents the attack probability of the historical path, C represents the out-degree weight of each node, R represents the attack number weight of each sub-attack path, and n represents the number of sub-attack paths.

[0133] S304: Compare the preset threshold with the attack probability of each sub-path. If the attack probability of the sub-attack path exceeds the threshold, issue an early warning to the sub-attack path and record the sub-attack path.

[0134] This application provides another early warning method for network attacks based on knowledge graphs. By constructing knowledge graphs, existing triples are constructed. The entire triple includes entities and relations, with entities as nodes and relations as directed edges. Through the triples of the knowledge graph, the path and weight between two entities are confirmed, and the links that may be attacked are predicted and inferred, so as to take precautions in advance to reduce the losses caused by traffic attacks and transform them from their original non-directionality to predictability.

[0135] Figure 4 This is a schematic diagram of the structure of a network attack warning device based on a knowledge graph provided in an embodiment of the present application. The device of this embodiment can be in the form of software and / or hardware. Figure 4As shown, an early warning device 40 for network attacks based on a knowledge graph provided in an embodiment of the present application includes: a first acquisition module 401, a second acquisition module 402, and a determination module 403, wherein:

[0136] The first acquisition module 401 is used to acquire a preset network path knowledge graph; wherein the preset network path knowledge graph includes a plurality of nodes, the nodes in the preset network path knowledge graph represent geographical locations where network connections exist, and the connection relationship between different nodes represents the network paths between different geographical locations;

[0137] The second acquisition module 402 is used to determine the nodes in the preset path, and obtain the number of historical attacks between different nodes in the preset path from the preset network path knowledge graph; wherein the number of historical attacks represents the number of network attacks on the network path within a preset historical time period;

[0138] The determination module 403 is used to determine whether to perform early warning processing on the preset path according to the number of historical attacks between different nodes in the preset path.

[0139] In one example, the second acquisition module 402 includes:

[0140] A first determination unit is used to determine, from a preset network path knowledge graph, edge connections between adjacent nodes in a preset path; wherein each edge connection in the preset network path knowledge graph stores a corresponding number of historical attacks;

[0141] The second determining unit is used to obtain the number of historical attacks corresponding to the edge connections between adjacent nodes in the preset path, and determine the number of historical attacks between different nodes in the preset path.

[0142] In one example, the determination module 403 includes:

[0143] The third determining unit is used to determine the number of times weight corresponding to the number of historical attacks between different nodes in the preset path according to the correlation between the preset number of network attacks and the number of times weight, as the target weight; wherein the number of times weight represents the importance of the network path between different nodes;

[0144] The fourth determining unit is used to determine whether to perform early warning processing on the preset path according to the target weight.

[0145] In a possible implementation manner, the fourth determining unit is specifically configured to:

[0146] According to the target weight, the warning probability of the preset path is determined; wherein the warning probability represents the possibility of the preset path being attacked;

[0147] If the warning probability is greater than the preset probability threshold, the preset path will be warned.

[0148] In a possible implementation manner, the fourth determining unit is specifically configured to:

[0149] Determine a subpath in the preset path; wherein the subpath represents a path between different nodes in the preset path;

[0150] According to the path direction of the preset path, determine the starting node in the subpath;

[0151] From the preset network path knowledge graph, obtain the number of nodes that have edge connections with the starting node as the target number;

[0152] According to the number of targets corresponding to each starting node and the weight of each target, the warning probability of the preset path is determined.

[0153] In a possible implementation manner, the fourth determining unit is specifically configured to:

[0154] Determine the target weight corresponding to the subpath where the starting node is located;

[0155] The warning probability of the preset path is determined according to the target quantity corresponding to the starting node, the target weight corresponding to the subpath where the starting node is located, and the number of subpaths in the preset path.

[0156] In one example, the first acquisition module 401 includes:

[0157] An acquisition unit, configured to acquire the number of network attacks on the network path between the different geographical locations within a preset historical time period if it is determined that there is a network path between the different geographical locations;

[0158] A fifth determining unit, configured to determine the starting point and the end point in different geographical locations according to the direction of the network path;

[0159] A construction unit, used to construct triple data according to the starting points and end points in different geographical locations and the number of network attacks on the network paths between the different geographical locations within a preset historical time period;

[0160] The generation unit is used to generate a network path knowledge graph based on triple data.

[0161] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 As shown, the electronic device 50 includes:

[0162] The electronic device 50 may include a processor 501 with one or more processing cores, a memory 502 with one or more computer-readable storage media, a communication component 503 and other components. The processor 501, the memory 502 and the communication component 503 are connected via a bus 503.

[0163] In the specific implementation process, at least one processor 501 executes the computer execution instructions stored in the memory 502, so that at least one processor 501 executes the above-mentioned early warning method for network attacks based on the knowledge graph.

[0164] In the above Figure 5 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0165] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0166] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0167] In some embodiments, a computer program product is also proposed, including a computer program or instructions, which, when executed by a processor, implement the steps of any of the above-mentioned knowledge graph-based network attack early warning methods.

[0168] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0169] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0170] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0171] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0172] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0173] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0174] In the above embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0175] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0176] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A network attack early warning method based on knowledge graph, characterized in that: include: Obtain a preset network path knowledge graph; wherein the preset network path knowledge graph includes a plurality of nodes, the nodes in the preset network path knowledge graph represent geographical locations where network connections exist, and the connection relationships between different nodes represent network paths between different geographical locations; Determine the nodes in the preset path, and obtain the number of historical attacks between different nodes in the preset path from the preset network path knowledge graph; wherein the number of historical attacks represents the number of network attacks on the network path within a preset historical time period; According to the number of historical attacks between different nodes in the preset path, it is determined whether to perform early warning processing on the preset path.

2. The method according to claim 1, characterized in that The obtaining, from the preset network path knowledge graph, the number of historical attacks between different nodes in the preset path includes: From the preset network path knowledge graph, determine the edge connections between adjacent nodes in the preset path; wherein each edge connection in the preset network path knowledge graph stores a corresponding number of historical attacks; The number of historical attacks corresponding to the edge connections between adjacent nodes in the preset path is obtained, and the number of historical attacks between different nodes in the preset path is determined.

3. The method according to claim 1, characterized in that The determining whether to perform early warning processing on the preset path according to the number of historical attacks between different nodes in the preset path includes: According to the correlation between the preset number of network attacks and the number weight, the number weight corresponding to the number of historical attacks between different nodes in the preset path is determined as the target weight; wherein the number weight represents the importance of the network path between different nodes; According to the target weight, it is determined whether to perform early warning processing on the preset path.

4. The method according to claim 3, characterized in that The determining whether to perform early warning processing on the preset path according to the target weight includes: Determine the warning probability of the preset path according to the target weight; wherein the warning probability represents the possibility of the preset path being attacked; If the warning probability is greater than a preset probability threshold, a warning process is performed on the preset path.

5. The method according to claim 4, characterized in that Determining the warning probability of the preset path according to the target weight includes: Determine a subpath in the preset path; wherein the subpath represents a path between different nodes in the preset path; Determining a starting node in the subpath according to the path direction of the preset path; From the preset network path knowledge graph, the number of nodes having edge connections with the starting node is obtained as the target number; The warning probability of the preset path is determined according to the target quantity corresponding to each starting node and the target weight.

6. The method according to claim 5, characterized in that The step of determining the warning probability of the preset path according to the number of targets corresponding to each of the starting nodes and the weight of each of the targets includes: Determine the target weight corresponding to the subpath where the starting node is located; The warning probability of the preset path is determined according to the target quantity corresponding to the starting node, the target weight corresponding to the sub-path where the starting node is located, and the number of sub-paths in the preset path.

7. The method according to claim 1, characterized in that The obtaining of a preset network path knowledge graph includes: If it is determined that there is a network path between different geographical locations, the number of network attacks on the network path between the different geographical locations within a preset historical time period is obtained; Determine the starting and ending points in different geographical locations based on the direction of the network path; Constructing triplet data according to the starting points and end points in different geographical locations and the number of network attacks on the network paths between the different geographical locations within a preset historical time period; The network path knowledge graph is generated based on the triple data.

8. A network attack early warning device based on knowledge graph, characterized in that: include: A first acquisition module is used to acquire a preset network path knowledge graph; wherein the preset network path knowledge graph includes a plurality of nodes, the nodes in the preset network path knowledge graph represent geographical locations where network connections exist, and the connection relationship between different nodes represents the network paths between different geographical locations; A second acquisition module is used to determine the nodes in the preset path, and obtain the number of historical attacks between different nodes in the preset path from the preset network path knowledge graph; wherein the number of historical attacks represents the number of network attacks on the network path within a preset historical time period; The determination module is used to determine whether to perform early warning processing on the preset path according to the number of historical attacks between different nodes in the preset path.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images