Knowledge graph-based network attack early warning method, device, equipment and medium

Abstract

The application provides a knowledge graph-based network attack early warning method, device, equipment and medium. The method comprises the following steps: acquiring a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes; the nodes in the preset network path knowledge graph represent geographical positions with network connections; and the connection relationship between different nodes represents the network path between different geographical positions; determining the nodes in the preset path; acquiring the historical attack times between different nodes in the preset path from the preset network path knowledge graph; wherein the historical attack times represent the network attack times of the network path in a preset historical time period; and determining whether to perform early warning processing on the preset path according to the historical attack times between different nodes in the preset path. The early warning processing on the preset path can more accurately detect the preset path and reduce the loss caused by the flow attack.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network attack early warning method and device based on a knowledge graph, equipment and a medium. BACKGROUND

[0002] In today's network world, large flow attacks have become a major challenge to network security. Attackers use certain methods to attack target systems or networks with extremely high traffic, causing system crashes, data loss or privacy leaks, and other serious consequences. The consequences of such attacks can cause serious economic losses and privacy leaks to businesses and individuals.

[0003] Therefore, how to early warn of large flow attacks is a problem that needs to be solved at present. SUMMARY

[0004] The present application provides a network attack early warning method, device, equipment and medium based on a knowledge graph, which realizes early warning of large flow attacks.

[0005] In a first aspect, the present application provides a network attack early warning method based on a knowledge graph, comprising

[0006] Obtaining a preset network path knowledge graph; wherein the preset network path knowledge graph includes a plurality of nodes, and the nodes in the preset network path knowledge graph represent geographic locations with network connections, and the connection relationship between different nodes represents the network path between different geographic locations;

[0007] Determine the nodes in the preset path, and obtain the historical attack times between different nodes in the preset path from the preset network path knowledge graph; wherein the historical attack times represent the number of network attacks on the network path within a preset historical time period;

[0008] According to the historical attack times between different nodes in the preset path, determine whether to perform early warning processing on the preset path.

[0009] Optionally, the above method, from the preset network path knowledge graph, obtains the historical attack times between different nodes in the preset path, comprising:

[0010] From the preset network path knowledge graph, determine the edge connection between adjacent nodes in the preset path; wherein each edge connection in the preset network path knowledge graph corresponds to a historical attack time stored;

[0011] Obtain the historical attack times corresponding to the edge connection between the adjacent nodes in the preset path to determine the historical attack times between different nodes in the preset path.

[0012] Optionally, the method as above, according to the historical attack times between different nodes in the preset path, determines whether to perform the early warning processing on the preset path, comprising:

[0013] According to the preset association relationship between the network attack times and the times weight, the times weight corresponding to the historical attack times between different nodes in the preset path is determined as the target weight; wherein, the times weight represents the importance of the network path between different nodes;

[0014] According to the target weight, it is determined whether to perform the early warning processing on the preset path.

[0015] Optionally, the method as above, according to the target weight, determines whether to perform the early warning processing on the preset path, comprising:

[0016] According to the target weight, the early warning probability of the preset path is determined; wherein, the early warning probability represents the possibility of the preset path being attacked;

[0017] If the early warning probability is greater than the preset probability threshold, the preset path is processed by early warning.

[0018] Optionally, the method as above, according to the target weight, determines the early warning probability of the preset path, comprising:

[0019] The sub path in the preset path is determined; wherein, the sub path represents the path between different nodes in the preset path;

[0020] According to the path direction of the preset path, the starting node in the sub path is determined;

[0021] From the preset network path knowledge graph, the number of nodes connected to the starting node is obtained as the target number;

[0022] According to the target number corresponding to each starting node and each target weight, the early warning probability of the preset path is determined.

[0023] Optionally, the method as above, according to the target number corresponding to each starting node and each target weight, determines the early warning probability of the preset path, comprising:

[0024] The target weight corresponding to the sub path where the starting node is located is determined;

[0025] According to the target number corresponding to the starting node, the target weight corresponding to the sub path where the starting node is located, and the number of sub paths in the preset path, the early warning probability of the preset path is determined.

[0026] Optionally, the method as above, the preset network path knowledge graph is obtained, comprising:

[0027] If it is determined that the network path between different geographic locations exists, the number of network attacks on the network path between different geographic locations within a preset historical time period is obtained;

[0028] According to the direction of the network path, the starting point and the ending point in the different geographic locations are determined;

[0029] According to the starting point and the ending point in the different geographic locations, and the number of network attacks on the network path between different geographic locations within a preset historical time period, a triple data is constructed;

[0030] According to the triple data, a network path knowledge graph is generated.

[0031] In a second aspect, the present application provides a network attack early warning device based on a knowledge graph, comprising:

[0032] A first obtaining module is configured to obtain a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes, and the nodes in the preset network path knowledge graph represent geographic locations with network connections, and the connection relationship between different nodes represents the network path between different geographic locations;

[0033] A second obtaining module is configured to determine the nodes in the preset path, and obtain the historical attack number between different nodes in the preset path from the preset network path knowledge graph; wherein the historical attack number represents the number of network attacks on the network path within a preset historical time period;

[0034] A determining module is configured to determine whether to perform early warning processing on the preset path according to the historical attack number between different nodes in the preset path.

[0035] In a third aspect, the present application provides an electronic device, comprising a memory and a processor.

[0036] The memory stores computer execution instructions;

[0037] The processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementation manners of the first aspect.

[0038] In a fourth aspect, the present application provides a computer readable storage medium, which stores computer execution instructions, and the computer execution instructions are executed by the processor to realize the first aspect and / or various possible implementation manners of the first aspect.

[0039] In a fifth aspect, the present application provides a computer program product, which comprises a computer program, and the computer program is executed by the processor to realize the first aspect and / or various possible implementation manners of the first aspect.

[0040] The application provides a knowledge graph-based network attack early warning method, device, equipment and medium. The method comprises the following steps: acquiring a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes, and the nodes in the preset network path knowledge graph represent geographical positions with network connections, and the connection relationship between different nodes represents the network path between different geographical positions; determining the nodes in the preset path, acquiring the historical attack times between different nodes in the preset path from the preset network path knowledge graph; saving the historical attack times between different nodes through the preset network path knowledge graph, and exhibiting the connection relationship between nodes and the historical attack times between nodes through structuring and semanticizing, so that the historical attack times of the corresponding nodes can be found faster. The historical attack times represent the network attack times of the network path in a preset historical time period; and whether the preset path needs to be early warned is determined according to the historical attack times between different nodes in the preset path. The geographical positions with network connections are used as the nodes in the preset network path knowledge graph, and the historical attack times between nodes are combined, so that the accuracy of the early warning result can be improved, and the preset path can be early warned, so that the preset path with high traffic attack risk can be early warned in time, the protection can be strengthened in advance, and the security of the preset path can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0042] Figure 1 A flowchart of a knowledge graph-based network attack early warning method provided by an embodiment of the application;

[0043] Figure 2 A structural diagram of a network path knowledge graph provided by an embodiment of the application;

[0044] Figure 3 A flowchart of another knowledge graph-based network attack early warning method provided by an embodiment of the application;

[0045] Figure 4 A structural diagram of a knowledge graph-based network attack early warning device provided by an embodiment of the application;

[0046] Figure 5 An electronic device structural diagram provided by an embodiment of the application.

[0047] The specific embodiments of the application have been shown and described in the above drawings and text. In the following, more detailed description will be given. These drawings and text are not intended to limit the scope of the concept of the application in any way, but to illustrate the concept of the application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0048] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, the same numbers are used to indicate the same elements in different drawings. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application, as detailed in the appended claims.

[0049] First, the terms related to the present application are explained:

[0050] Knowledge graph: a structured way of representing and organizing knowledge. It builds a graphical structure through nodes (representing entities or concepts) and edges (representing relationships between entities), making it easier to visualize complex knowledge systems and relationships.

[0051] Triplet data: a structured data form used to represent relationships, commonly used in knowledge graphs, semantic networks, and natural language processing. Triplet consists of three elements, usually represented as (subject, predicate, object) or (entity1, relationship, entity2).

[0052] Currently, in today's network world, large flow attacks have become a major challenge to network security. Attackers use certain methods to attack target systems or networks with extremely high traffic, causing system crashes, data loss or privacy leaks, and other serious consequences. The consequences of such attacks can cause serious economic losses and privacy leaks to businesses and individuals. However, existing technologies mainly use access permissions, access path depth and other attributes to warn of network security incidents. However, this method has low adaptability to network connection methods related to geographic location, making the warning results inaccurate.

[0053] The application provides a network attack early warning method, device and equipment based on a knowledge graph and a medium. The method comprises the following steps: obtaining a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes, the nodes in the preset network path knowledge graph represent geographical positions with network connections, and the connection relationship between different nodes represents network paths between different geographical positions; determining the nodes in a preset path; obtaining the historical attack times between different nodes in the preset path from the preset network path knowledge graph; and saving the historical attack times between different nodes in the preset network path knowledge graph, and displaying the connection relationship between nodes and the historical attack times between nodes in a structured and semantic manner, so that the historical attack times of corresponding nodes can be found faster. The historical attack times represent the network attack times of the network path in a preset historical time period; and whether the preset path needs to be early warned is determined according to the historical attack times between different nodes in the preset path. The geographical positions with network connections are used as the nodes in the preset network path knowledge graph, and the historical attack times between nodes are combined, so that the accuracy of the early warning result can be improved, the preset path can be early warned, the preset path with high traffic attack risk can be early warned in time, the protection can be strengthened in advance, and the security of the preset path can be improved.

[0054] The technical solutions of the application and how the technical solutions solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the application will be described below with reference to the drawings.

[0055] Figure 1 The application provides a network attack early warning method based on a knowledge graph. As shown in Figure 1 , the execution subject of the method can be a server, and the application is not particularly limited herein, as shown in Figure 1 , the method comprises the following steps:

[0056] S101, obtaining a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes, the nodes in the preset network path knowledge graph represent geographical positions with network connections, and the connection relationship between different nodes represents network paths between different geographical positions.

[0057] The geographical position represents a specific area, for example, area A or area B.

[0058] The network path knowledge graph is pre-constructed, and the preset network path knowledge graph describes a network of a plurality of specific regions and a relationship of a flow attack in a flow transmission process between the networks of any two specific regions in the plurality of specific regions. For example, the relationship of the flow attack can refer to a number of flow attacks between two specific regions in a preset historical time.

[0059] The node can refer to the network of a specific region, and the specific region can be regarded as a switch. The nodes are different, that is, the specific region networks represented by the nodes are different.

[0060] Figure 2 A structural diagram of a network path knowledge graph provided by an embodiment of the present application is shown in FIG. 1. Figure 2 As shown in FIG. 1, circle A represents the network of region A (which can also be regarded as node A), circle B represents the network of region B (which can also be regarded as node B), circle C represents the network of region C, and circle D represents the network of region D. The number of attacks on the data transmission from A to B is 100, the number of attacks on the data transmission from B to A is 200, and the rest are the same. It is worth noting that there is no data transmission or data transmission is not attacked between A and D, and therefore there is no arrow between A and D.

[0061] In the embodiment of the present application, the preset network path knowledge graph is obtained, including:

[0062] If it is determined that there is a network path between different geographical positions, the number of network attacks on the network path between the different geographical positions in a preset historical time period is obtained.

[0063] According to the direction of the network path, the starting point and the ending point in the different geographical positions are determined.

[0064] According to the starting point and the ending point in the different geographical positions and the number of network attacks on the network path between the different geographical positions in the preset historical time period, a triple data is constructed.

[0065] According to the triple data, a network path knowledge graph is generated.

[0066] The network path between different geographical positions refers to a data transmission path of two different specific region networks.

[0067] The preset historical time period refers to a preset past period of time, which can refer to a past month or a past two months.

[0068] The direction of the network path refers to the direction of data transmission. For example, there are a network of region A and a network of region B, and there is data transmission from A to B and data transmission from B to A.

[0069] The number of network attacks can refer to the number of traffic attacks. Traffic attack is a network attack method. Attackers send a large number of data packets or requests to the target system to try to exhaust the resources of the target system, so that it cannot normally serve. Traffic attack methods include: denial of service attack (DoS, Denial of Service), distributed denial of service attack (DDoS, Distributed Denial of Service), SYN flood attack (SYN Flood), UDP flood attack (UDP Flood), ICMP flood attack (ICMP Flood), HTTP flood attack (HTTP Flood), DNS amplification attack (DNS Amplification Attack), NTP amplification attack (NTP Amplification Attack).

[0070] Whether it is a traffic attack and the method of traffic attack can be identified through the vulnerability enumeration library CWE (Common Weakness Enumeration) and the preset information security vulnerability library.

[0071] The triple data includes the start and end points of the network path and the number of traffic attacks between the start and end points.

[0072] The network path knowledge graph refers to representing the network path through nodes (path start and end points) and edges (number of network attacks).

[0073] Determine the network of area A (also referred to as A node) and the network of area B (also referred to as B node). A->B is used to represent the data transmission from A to B, which is also used in other places in the application. If A->B exists data transmission in the past month and is attacked by traffic attack, the number of traffic attacks of A->B is obtained: 100. At this time, A is the start point and B is the end point. Then, according to the A point, the B point and the 100, the triple data (A, 100, B) is obtained. At the same time, if B->A exists data transmission in the past month and is attacked by traffic attack, the number of traffic attacks of B->A is obtained: 200. At this time, B is the start point and A is the end point. Then, according to the A point, the B point and the 200, the triple data (B, 200, A) is obtained. The network path knowledge graph is obtained according to all the obtained triples. For example, Figure 2 In the example, the number of attacks on A transmitting data to B is 100, and the number of attacks on B transmitting data to A is 200, and the rest is the same.

[0074] The advantage of such an arrangement is that by constructing a network path knowledge graph, the network security protection capability can be effectively improved, and network security personnel can better monitor, analyze and respond to network attack events.

[0075] S102, determine the nodes in the preset path, and obtain the historical attack times between different nodes in the preset path from the preset network path knowledge graph; wherein the historical attack times represent the number of network attacks on the network path in a preset historical time period.

[0076] The path to be detected is preset as the preset path. The nodes in the preset path include a node representing the starting point of the path and a node representing the end point of the path. There can be other nodes between the node representing the starting point of the path and the node representing the end point of the path, or there can be no other nodes. After confirming the node representing the starting point of the path and the node representing the end point of the path, the number of network attacks on the node representing the starting point of the path to the node representing the end point of the path in a preset historical time period is obtained from the preset network path knowledge graph as the historical attack times.

[0077] In the embodiment of the application, the historical attack times between different nodes in the preset path are obtained from the preset network path knowledge graph, including:

[0078] From the preset network path knowledge graph, the edge connections between adjacent nodes in the preset path are determined; wherein each edge connection in the preset network path knowledge graph corresponds to a historical attack time stored;

[0079] The historical attack times corresponding to the edge connections between adjacent nodes in the preset path are obtained, and the historical attack times between different nodes in the preset path are determined.

[0080] The preset path contains at least two nodes, which can be two nodes or three nodes.

[0081] The edge connection represents two nodes, the transmission direction between the two nodes, and the historical attack times corresponding to the transmission direction of the two nodes.

[0082] If the preset path is A->B->C, wherein region A is the node representing the starting point, region C is the node representing the end point, and region B is the intermediate node. A and B are adjacent nodes, and B and C are adjacent nodes. Then the edge connection A->B corresponding to the historical attack times is (A, 1000, B) obtained from the preset network knowledge graph, and the edge connection B->C corresponding to the historical attack times is (B, 2000, C) obtained from the preset network knowledge graph. 1000 is the historical attack times of A->B, and 2000 is the historical attack times of B->C.

[0083] The advantage of such an arrangement is that by obtaining the historical attack times between different nodes in the preset path from the preset network path knowledge graph, the accuracy and effectiveness of network security protection can be further improved, helping network security personnel to better monitor, analyze and respond to network attack events.

[0084] S103, determining whether to perform early warning processing on the preset path according to the historical attack times between different nodes in the preset path.

[0085] Among them, according to the size of the historical attack times between different nodes in the preset path, the subsequent processing of the preset path is determined. If the historical attack times are large, the preset path needs to be warned, or the protection needs to be strengthened, or the monitoring needs to be strengthened. If the attack times are small, no warning is needed.

[0086] In the embodiment of the application, according to the historical attack times between different nodes in the preset path, whether to perform early warning processing on the preset path is determined, including:

[0087] According to the association relationship between the preset network attack times and the times weight, the times weight corresponding to the historical attack times between different nodes in the preset path is determined as the target weight; wherein the times weight represents the importance of the network path between different nodes;

[0088] According to the target weight, it is determined whether to perform early warning processing on the preset path.

[0089] Among them, the association relationship means that different sizes of network attack times correspond to different sizes of times weight. If the network attack times are small, the data transmission attack probability of the corresponding node is small, and the corresponding times weight is small. If the network attack times are large, the data transmission attack probability of the corresponding node is large, and the corresponding times weight is large.

[0090] The target weight can be any value, but it is best less than or equal to 1, for example: 1, 0.3, 0.5, etc.

[0091] For example: when the network attack times are less than 1000 times, the times weight is 0.3; when the network attack times are greater than 1000 times and less than 2000 times, the times weight is 0.5; when the network attack times are greater than 2000 times, the times weight is 1. If there is a path A->B, the corresponding historical attack times are 1500, and the corresponding times weight is 0.5, that is, the target weight. If the target weight threshold is set to 1, the times weight 0.5 is less than 1, that is, no early warning processing is needed for path A->B. Other weights can also be introduced to comprehensively judge whether path A->B needs to be early warned by combining other weights and times weights. The other weights can be weights representing the importance of the nodes.

[0092] The advantage of such an arrangement is that by determining whether to perform early warning processing on the preset path according to the historical attack times between different nodes in the preset path, the accuracy and timeliness of network security early warning can be significantly improved, helping network security personnel to better monitor, analyze and respond to network attack events.

[0093] In the embodiments of the present application, determining whether to perform early warning processing on the preset path according to the target weight comprises:

[0094] Determining an early warning probability of the preset path according to the target weight; wherein the early warning probability represents the likelihood of the preset path being attacked;

[0095] If the early warning probability is greater than a preset probability threshold, early warning processing is performed on the preset path.

[0096] The early warning probability represents the likelihood of the preset path actually being attacked, and the early warning probability can be calculated by the target weight, for example, by inputting the target weight into a preset formula to obtain the early warning probability.

[0097] The probability threshold is only a numerical value, which can be calculated according to the historical attack data of the past 3 months (or the past 1 month), then all nodes are combined in pairs, and then an average value is calculated as the probability threshold according to the out-degree weight of all paths and the attack weight of all paths. Each enterprise can develop it according to the actual situation, for example, some enterprises have high security requirements and important data transmission, so the threshold is set lower to process all potential attacks, and some enterprises have lower requirements and less important data, so the threshold is set higher to only process high-risk attacks.

[0098] According to the target weight, the early warning probability of the preset path is obtained, and if the early warning probability is greater than a preset probability threshold, it indicates that the preset path has a high probability of being attacked, and early warning processing is performed on the preset path to remind relevant personnel to strengthen protection of the preset path.

[0099] The advantage of such an arrangement is that by determining the early warning probability of the preset path according to the target weight and performing early warning processing when the early warning probability is greater than a preset probability threshold, the accuracy and timeliness of network security early warning can be significantly improved.

[0100] In the embodiments of the present application, determining the early warning probability of the preset path according to the target weight comprises:

[0101] Determining a sub-path in the preset path; wherein the sub-path represents a path between different nodes in the preset path;

[0102] determine a starting node in the sub-path according to a path direction of the preset path;

[0103] obtain, from the preset network path knowledge graph, a number of nodes connected to the starting node by an edge as a target number;

[0104] determine a preset path warning probability according to the target number corresponding to each starting node and each target weight.

[0105] The number of nodes in the sub-path is less than that in the preset path, the adjacent nodes connected in the sub-path are consistent with those in the preset path, and the data transmission direction of the sub-path is consistent with that of the preset path. For example, the preset path is A->B->C->D, and the sub-path obtained by splitting is A->B, and it cannot be B->A.

[0106] Each target weight refers to a target weight of each sub-path.

[0107] For example, the preset path is A->B->C->D, and the sub-path obtained by splitting is A->B, B->C, C->D, and A->B->C. For A->B, A is the starting node. For B->C, B is the starting node. For C->D, C is the starting node. For A->B->C, if there are (A, 100, B), (A, 200, C), and (A, 200, D) in the preset knowledge graph, it is proved that there are three nodes B, C, and D connected to A by an edge. The target number of A is 3, and B, C, and D can be obtained in the same way. The preset path warning probability is obtained by calculating the target number of each sub-path, each target weight, and each target weight. The target number of each sub-path and each target weight can be substituted into the preset enterprise to obtain the preset path warning probability.

[0108] The advantage of such setting is that the preset path warning probability is determined according to the target weight and the target number, which can further improve the accuracy and effectiveness of network security warning, and help network security personnel to better monitor, analyze and respond to network attack events.

[0109] In the embodiments of the present application, the preset path warning probability is determined according to the target number corresponding to each starting node and each target weight, including:

[0110] determine the target weight corresponding to the sub-path where the starting node is located;

[0111] determine the preset path warning probability according to the target number corresponding to the starting node, the target weight corresponding to the sub-path where the starting node is located, and the number of sub-paths in the preset path.

[0112] The target weight is also the number of times of the sub-path.

[0113] The early warning probability of the preset path satisfies:

[0114] p = (C1 x R1 + C2 x R2 + … + Cn x Rn) / n,

[0115] wherein C1, C2, …, Cn represent the target quantity corresponding to the starting node, R1, R2, …, Rn represent the target weight corresponding to the sub-path where the starting node is located, n represents the number of sub-paths in the preset path, and p represents the early warning probability of the preset path.

[0116] When the number of preset network attacks is less than 1000, the number weight is 0.3, when the number of network attacks is greater than 1000 and less than 2000, the number weight is 0.5, and when the number of network attacks is greater than 2000, the number weight is 1. The preset path is A->B->C->D, and the sub-paths obtained by splitting are A->B, B->C, C->D, and A->B->C. For A->B, (A, 800, B) is obtained from the preset network path knowledge graph, and the corresponding 800 is less than 1000, so the number weight of A->B is 0.3, that is, the target weight corresponding to A->B is 0.3. Similarly, the number weights of B->C, C->D, and A->B->C are obtained. It is worth noting that the number weight of A->B->C here is the number weight corresponding to (A, x, C) obtained from the preset network path knowledge graph, and x is the corresponding historical attack number, x is any positive integer. At this time, if (A, 100, B), (A, 200, C), and (A, 200, D) exist in the preset knowledge graph, it is proved that there are three nodes B, C, and D connected with A, so in A->B, the target quantity of the starting node A is 3, and the target quantities of the starting nodes B, C, and A in B->C, C->D, and A->B->C are obtained in the same way. And the sub-paths have A->B, B->C, C->D, and A->B->C (that is, n is 4). Therefore, the early warning probability of the preset path can be obtained by substituting the formula:

[0117] The early warning probability p of the preset path A->B->C->D = {(the target quantity of the starting node A in A->B) x (the number weight of A->B) + (the target quantity of the starting node B in B->C) x (the number weight of B->C) + (the target quantity of the starting node C in C->D) x (the number weight of C->D) + (the target quantity of the starting node A in A->B->C) x (the number weight of A->B->C is 0.3)} / 4.

[0118] The advantage of such an arrangement is that by determining the early warning probability of the preset path according to the target quantity corresponding to each starting node and the target weight, the accuracy and effectiveness of network security early warning can be further improved, helping network security personnel to better monitor, analyze and respond to network attack events.

[0119] The early warning method for network attacks based on a knowledge graph provided in the present application determines the historical attack times between different nodes in a preset path through a preset network path knowledge graph, and obtains the early warning probability of the preset path through the historical attack times and the target quantity of the starting node of a sub-path in the preset path. The early warning probability and the probability threshold are compared to timely detect the risk of the preset path and improve the security of data transmission of each node.

[0120] Figure 3 Another early warning method for network attacks based on a knowledge graph is provided for the embodiments of the present application. As shown in Figure 3 the method execution subject can be a server, and the embodiments are not particularly limited here, as shown in Figure 3 the method includes:

[0121] S301: Construct a knowledge graph.

[0122] The method for constructing the knowledge graph is:

[0123] According to the historical attack data, the knowledge graph is constructed:

[0124] The knowledge graph includes the (N, R) formula and the P(Nk, Rr, Nj) formula. In the H=(N, R) formula, the node set N=(N1, N2, …, Nk), and the relationship set R=(R1, R2, …, Rm). K is the number of nodes, and m is the number of relationships (i.e., the number of attack times). The relationship set represents the number of attack times, and the node set represents the number of regional networks, for example, there are three regional networks A, B, and C, so N=(A, B, C). There are attack times 1000, 2000, 500, and 100, so the relationship set R=(1000, 2000, 500, 100). In the P(Nk, Rr, Nj) formula, P is a predicate; Nk and Nj are the kth node and the jth node, respectively; and Rr is an attack relationship (i.e., the number of attack times). For example, the number of attack times from A to B is 100, which is represented as P(A, 100, B). All data is represented in the form of the above triplets, which can clearly represent the relationship between nodes on the backbone network and the number of attack times between any two nodes.

[0125] S302: Split the historical attack path to obtain a plurality of sub-attack paths of the historical attack path.

[0126] S303: According to the attack times between each node in the knowledge graph, the out-degree weight of each node, the attack times weight, the number of sub-attack paths, the attack probability of the historical path.

[0127] Wherein, if the attack times is greater than 2000, then the attack times weight is 1; if the attack times is less than 2000 but greater than 1000, then the attack times weight is 0.5; if the attack times is less than 1000, then the attack times weight is 0.3.

[0128] The out-degree weight represents how many paths have the node as the starting node, for example: there are (A, 100, B) and (A, 1000, C) in the knowledge graph, so there are two paths with A as the starting node, and the out-degree weight of A is A.

[0129] The historical attack path is A->B->C->D, and the sub-paths obtained by splitting are A->B, B->C, C->D, and A->B->C, so there are four sub-attack paths.

[0130] The attack probability of the sub-attack path is:

[0131] The attack probability of the sub-path is: p=(C1xR1+C2xR2+…+CnxRn) / n,

[0132] Wherein, p represents the attack probability of the historical path, C represents the out-degree weight of each node, R represents the attack times weight of each sub-attack path, and n represents the number of sub-attack paths.

[0133] S304: Compare the preset threshold value with the attack probability of each sub-path, if the attack probability of the sub-attack path exceeds the threshold value, then pre-warning is performed on the sub-attack path, and the sub-attack path is recorded.

[0134] Another network attack early warning method based on a knowledge graph provided by the application, by constructing a knowledge graph, constructing existing triples, the entire triple includes entities (entity) and relations (relation), the entity as a node, and the relation as a directed edge. Through the triples of the knowledge graph, the path and weight between two entities are confirmed, the link that may be attacked is predicted and reasoned out, and then early prevention is performed to reduce the loss caused by flow attacks and change from original indefiniteness to predictability.

[0135] Figure 4 A network attack early warning device based on a knowledge graph provided by the embodiment of the application is shown in the structural diagram. The device of the embodiment can be in the form of software and / or hardware. Figure 4As shown, the embodiment of the present application provides a network attack early warning device 40 based on a knowledge graph, the device comprises: a first acquisition module 401, a second acquisition module 402, and a determination module 403, wherein:

[0136] The first acquisition module 401 is configured to acquire a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes, and the nodes in the preset network path knowledge graph represent geographical positions with network connections, and the connection relationship between different nodes represents network paths between different geographical positions.

[0137] The second acquisition module 402 is configured to determine the nodes in the preset path, and acquire the historical attack times between different nodes in the preset path from the preset network path knowledge graph; wherein the historical attack times represent the number of network attacks on the network path within a preset historical time period.

[0138] The determination module 403 is configured to determine whether to perform early warning processing on the preset path according to the historical attack times between different nodes in the preset path.

[0139] In one example, the second acquisition module 402 comprises:

[0140] The first determination unit is configured to determine the edge connection between adjacent nodes in the preset path from the preset network path knowledge graph; wherein each edge connection in the preset network path knowledge graph corresponds to a historical attack time stored therein.

[0141] The second determination unit is configured to acquire the historical attack times corresponding to the edge connection between adjacent nodes in the preset path, and determine the historical attack times between different nodes in the preset path.

[0142] In one example, the determination module 403 comprises:

[0143] The third determination unit is configured to determine the times weight corresponding to the historical attack times between different nodes in the preset path according to the association relationship between the preset network attack times and the times weight, as a target weight; wherein the times weight represents the importance of the network path between different nodes.

[0144] The fourth determination unit is configured to determine whether to perform early warning processing on the preset path according to the target weight.

[0145] In one possible implementation, the fourth determination unit is specifically configured to:

[0146] determine the early warning probability of the preset path according to the target weight; wherein the early warning probability represents the possibility of the preset path being attacked.

[0147] If the early warning probability is greater than the preset probability threshold, the preset path is subjected to early warning processing.

[0148] In a possible implementation, the fourth determining unit is specifically configured to:

[0149] determine a sub-path in the preset path, wherein the sub-path represents a path between different nodes in the preset path;

[0150] determine a starting node in the sub-path according to a path direction of the preset path;

[0151] obtain, from the preset network path knowledge graph, a number of nodes connected to the starting node by an edge, as a target number;

[0152] determine the early warning probability of the preset path according to the target number corresponding to each starting node and each target weight.

[0153] In a possible implementation, the fourth determining unit is specifically configured to:

[0154] determine a target weight corresponding to the sub-path in which the starting node is located;

[0155] determine the early warning probability of the preset path according to the target number corresponding to the starting node, the target weight corresponding to the sub-path in which the starting node is located, and the number of sub-paths in the preset path.

[0156] In an example, the first obtaining module 401 includes:

[0157] an obtaining unit configured to, if it is determined that there is a network path between different geographic locations, obtain a number of network attacks on the network path between the different geographic locations within a preset historical time period;

[0158] a fifth determining unit configured to determine a starting point and an ending point in the different geographic locations according to a direction of the network path;

[0159] a constructing unit configured to construct a triple data according to the starting point and the ending point in the different geographic locations and the number of network attacks on the network path between the different geographic locations within the preset historical time period;

[0160] a generating unit configured to generate a network path knowledge graph according to the triple data.

[0161] Figure 5 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 1. Figure 5 As shown in FIG. 1, the electronic device 50 includes:

[0162] The electronic device 50 can include a processor 501 having one or more processing cores, a memory 502 having one or more computer readable storage media, a communication component 503, and the like. Among them, the processor 501, the memory 502 and the communication component 503 are connected through a bus 503.

[0163] In the implementation process, the at least one processor 501 executes the computer execution instructions stored in the memory 502, so that the at least one processor 501 executes the above-mentioned knowledge graph-based network attack early warning method.

[0164] In the above-mentioned Figure 5 In the embodiment shown, it should be understood that the processor can be a central processing unit (English: Central Processing Unit, for short: CPU), and can also be other general-purpose processors, digital signal processors (English: Digital Signal Processor, for short: DSP), application specific integrated circuits (English: Application Specific Integrated Circuit, for short: ASIC) and the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor and the like. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution, or executed by hardware and software modules in the processor.

[0165] The memory can include random access memory (Random Access Memory, RAM), and can also include non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0166] The bus can be an industry standard architecture (Industry Standard Architecture, ISA) bus, a peripheral component interconnect (Peripheral Component, PCI) bus, or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, and the like. The bus can be divided into address bus, data bus, control bus and the like. For the convenience of representation, the bus in the drawings of the present application does not limit only one bus or one type of bus.

[0167] In some embodiments, a computer program product is also proposed, including a computer program or instructions, which are executed by the processor to realize the steps in any of the above-mentioned knowledge graph-based network attack early warning methods.

[0168] It should be noted that, for the foregoing method embodiments, the sequences of the described actions are merely illustrative, and the present application is not limited to the sequences of the described actions. In some embodiments, the sequences of the described actions can be changed or reordered. In some embodiments, some of the actions can be performed simultaneously. In some embodiments, some of the actions can be omitted, or other actions can be added.

[0169] It should be noted that, for the foregoing method embodiments, the sequences of the described actions are merely illustrative, and the present application is not limited to the sequences of the described actions. In some embodiments, the sequences of the described actions can be changed or reordered. In some embodiments, some of the actions can be performed simultaneously. In some embodiments, some of the actions can be omitted, or other actions can be added.

[0170] It should be understood that the above-described apparatus embodiments are merely illustrative, and the apparatus of the present application can also be implemented in other manners. For example, the division of the units / modules in the above-described embodiments is merely a logical function division, and actual implementation can be in another manner. For example, a plurality of units / modules or components can be combined, or can be integrated into another system, or some features can be omitted or not performed.

[0171] In addition, unless specifically stated otherwise, each functional unit / module in each embodiment of the present application can be integrated in one unit / module, or each unit / module can exist physically, or two or more units / modules can be integrated together. The integrated unit / module can be implemented in the form of hardware or in the form of a software program module.

[0172] If the integrated units / modules are implemented in the form of hardware, the hardware can be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. Unless otherwise specified, the storage unit can be any appropriate magnetic storage medium or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), hybrid memory cube (HMC), etc.

[0173] If the integrated units / modules are implemented in the form of software program modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the essential part or all or part of the technical solutions that make contributions to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0174] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application

[0175] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0176] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A method for early warning of a cyber attack based on a knowledge graph, characterized in that, The method comprises: acquiring a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes, and the nodes in the preset network path knowledge graph represent geographical locations connected by a network, and the connection relationship between different nodes represents the network path between different geographical locations; determining the nodes in a preset path, and acquiring the historical attack times between different nodes in the preset path from the preset network path knowledge graph; wherein the historical attack times represent the number of network attacks on the network path within a preset historical time period; determining whether to perform early warning processing on the preset path according to the historical attack times between different nodes in the preset path.

2. The method of claim 1, wherein, The step of acquiring the historical attack times between different nodes in the preset path from the preset network path knowledge graph comprises: determining the edge connections between adjacent nodes in the preset path from the preset network path knowledge graph; wherein each edge connection in the preset network path knowledge graph corresponds to a stored historical attack time; acquiring the historical attack times corresponding to the edge connections between adjacent nodes in the preset path to determine the historical attack times between different nodes in the preset path.

3. The method of claim 1, wherein, The step of determining whether to perform early warning processing on the preset path according to the historical attack times between different nodes in the preset path comprises: determining a time weight corresponding to the historical attack times between different nodes in the preset path as a target weight according to the association between the preset network attack times and the time weight; wherein the time weight represents the importance of the network path between different nodes; determining whether to perform early warning processing on the preset path according to the target weight.

4. The method of claim 3, wherein, The step of determining whether to perform early warning processing on the preset path according to the target weight comprises: determining an early warning probability of the preset path according to the target weight; wherein the early warning probability represents the possibility of an attack on the preset path; if the early warning probability is greater than a preset probability threshold, performing early warning processing on the preset path.

5. The method of claim 4, wherein, The step of determining the early warning probability of the preset path according to the target weight comprises: determining a sub-path in the preset path; wherein the sub-path represents the path between different nodes in the preset path; determining a starting node in the sub-path according to the path direction of the preset path; acquiring the number of nodes having an edge connection with the starting node from the preset network path knowledge graph as a target number; determining the early warning probability of the preset path according to the target number corresponding to each starting node and each target weight.

6. The method of claim 5, wherein, The step of determining the early warning probability of the preset path according to the target number corresponding to each starting node and each target weight comprises: determining the target weight corresponding to the sub-path in which the starting node is located; determining the early warning probability of the preset path according to the target number corresponding to the starting node, the target weight corresponding to the sub-path in which the starting node is located, and the number of sub-paths in the preset path.

7. The method of claim 1, wherein, The preset network path knowledge graph is acquired, and the method comprises the following steps: If it is determined that there is a network path between different geographical positions, the number of network attacks on the network path between different geographical positions within a preset historical time period is acquired; According to the direction of the network path, the starting point and the ending point in the different geographical positions are determined; According to the starting point and the ending point in the different geographical positions and the number of network attacks on the network path between the different geographical positions within a preset historical time period, a triple data is constructed; According to the triple data, the network path knowledge graph is generated. 8.A device for early warning of a network attack based on a knowledge graph, characterized in that, The method comprises the following steps: A first acquisition module is configured to acquire a preset network path knowledge graph; wherein the preset network path knowledge graph comprises a plurality of nodes, and the nodes in the preset network path knowledge graph represent geographical positions with network connections, and the connection relationship between different nodes represents the network path between different geographical positions; A second acquisition module is configured to determine the nodes in a preset path and acquire the historical attack number between different nodes in the preset path from the preset network path knowledge graph; wherein the historical attack number represents the number of network attacks on the network path within a preset historical time period; A determination module is configured to determine whether to perform early warning processing on the preset path according to the historical attack number between different nodes in the preset path.

9. An electronic device, comprising: The processor and the memory connected with the processor are included; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to realize the method in any one of claims 1 to 7. The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to realize the method in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer program is executed by the processor to realize the method in any one of claims 1 to 7.

11. A computer program product, characterised in that, ​

Images