Network space-oriented key terrain rule mining method

Abstract

The invention belongs to the field of computer application, and discloses a key terrain rule mining method for network space. The method comprises the following steps: (10) defining a network space model, and constructing data of each layer of a network space; and (20) converting nodes and relational data in the network space mode into a graph structure mode. And (30) converting network space model data into node low-dimensional embedded vector representation. And (40) carrying out association rule mining on the embedded vectors of the nodes. And (50) evaluating the accuracy of the mined rule according to the support degree and the confidence coefficient. The method has the advantages that low-dimensional vector representation, association rule mining and a network space model are combined, potential key network terrain rules can be mined from a complex network space, and the rules reveal which resources are crucial to operation and safety of a network; the key node and connectivity path which are most likely to become an attack target or influence the network stability are provided, and an important basis is provided for subsequent deeper reasoning and decision making.

Description

Technical Field

[0001] The invention belongs to the field of computer application and discloses a key terrain rule mining method oriented to network space. Background Art

[0002] With the rapid development of information technology, cyberspace has become the fifth dimension after "land, sea, air and space". Cyberspace is not only a carrier of information flow, but also an operating platform for various businesses and services. Therefore, the requirements for its security and stability are becoming increasingly important. In this context, identifying and protecting key network terrain has become one of the core tasks of ensuring network security.

[0003] Key network terrain refers to locations, resources or elements of great significance in cyberspace, which have a significant impact on network operation, information flow and security. For example, key nodes, important systems, core network equipment and data centers in the network. Once these key terrains are attacked or fail, they may lead to the paralysis of the entire network or serious security incidents. Therefore, accurately identifying and protecting these key terrains is of great significance to improving network security protection capabilities.

[0004] Key network terrain rules refer to the patterns and regularities that describe the relationships between key network terrain elements in cyberspace. These rules help identify and understand the importance of key nodes and elements in the network and their interactions, providing guidance for network optimization and security protection. Key network terrain rules can reveal potential threats, performance bottlenecks, and optimization opportunities in the network.

[0005] Traditional identification of key network terrain rules mainly relies on expert experience and static analysis methods, which have certain limitations. Expert experience is subjective and easily limited by personal knowledge and experience. In the face of complex network space, it is difficult to fully cover all potential key terrain rules.

[0006] Rule mining provides a new approach to identifying key network terrain rules. By mining and analyzing massive data in cyberspace, potential key terrain rules can be automatically identified. This method can not only improve the accuracy of identification, but also dynamically adapt to changes in the network environment. It has broad application prospects and important research value. Summary of the invention

[0007] In view of the problems that traditional key network terrain identification relies on expert experience, is inefficient, and is difficult to fully cover all potential key terrain rules, the present invention proposes a key terrain rule mining method for cyberspace, which is used to mine potential network key terrain rules to reveal which specific nodes, devices, platforms or applications in cyberspace are highly correlated with threats, attacks or security incidents. For example, certain types of devices or software are more likely to become targets of attacks, or devices on certain platforms have a critical impact on network security. These rules help identify nodes or connections in the network topology that are critical to operation and security, and clarify which locations, resources or relationships are potential vulnerabilities or key points in the network.

[0008] The specific steps are as follows:

[0009] (10) Define the cyberspace model and construct data for each layer of the cyberspace.

[0010] (11) Define the cyberspace model and divide the cyberspace terrain data into four layers according to the platform layer, device layer, software layer, and threat layer.

[0011] (12) The nodes on the platform layer are some units in the actual geographical location, such as research institutes, data centers, etc.; the nodes on the device layer are routers, servers, host terminals and other equipment; the nodes on the software layer are communication software, protection software, database software and other application programs; the nodes on the threat layer are threat factors such as network attack events, vulnerabilities, and viruses.

[0012] (13) Add required fields to the nodes of each layer: set the unit number for the platform layer nodes, set the IP address for the device layer nodes, set the port number for the software layer nodes, and set the threat number for the threat layer nodes. This ensures uniqueness and achieves the purpose of data preprocessing.

[0013] (14) Construct the inter-layer relationship between each layer node and other layer nodes, for example, the device node of the device layer is located on a certain platform layer unit node, and the software node of the software layer is installed on a certain device layer device node; construct the intra-layer relationship of the nodes of the same layer, such as the connectivity relationship between the devices on the device layer.

[0014] (20) Convert the node and relationship data in the network space model into a graph structure model.

[0015] (21) Clarify the meaning of nodes and edges in the graph structure. Nodes are nodes on the four layers in the network space, and edges are the intra-layer and inter-layer relationships between nodes.

[0016] (22) Import the prepared cyberspace data into the Neo4j graph data.

[0017] (30) Convert the network space model data into low-dimensional embedding vector representation of nodes.

[0018] (31) The Node2Vec algorithm is used to generate random walk sequences for network model data. The relevant parameters of the Node2Vec algorithm are reasonably set, including the length of the random walk (walk_length), the number of walks for each node (num_walks), the dimension of the embedding vector (embedding_dim), and the parameters p and q that control the walk behavior. The parameter p is the return probability, which controls the possibility of the walk returning to the previous node. Smaller p values ​​tend to return, and larger p values ​​tend to move away. The parameter q is the exploration probability, which controls the possibility of the walk exploring new nodes. Smaller q values ​​tend to favor depth-first search, and larger q values ​​tend to favor breadth-first search.

[0019] (32) Based on the set parameters, a random walk is performed on the network space model. The present invention adopts a biased random walk strategy to generate a series of random walk sequences. During the random walk, the depth and breadth of the walk are adjusted according to the values ​​of parameters p and q to capture the local and global structural information in the network.

[0020] (33) The generated random walk sequence is converted into a Skip-Gram model training data pair and provided to the model for training.

[0021] (34) Initialize the Skip-Gram model and train it using training data pairs so that the vectors of similar network nodes are closer in the low-dimensional space.

[0022] (35) After training is completed, the embedded vector representation of each network node is extracted from the model.

[0023] (40) Perform association rule mining on the node embedding vectors.

[0024] (41) The FP-Growth algorithm is used to mine association rules. First, the continuous node embedding vector representation is discretized to obtain the discretized features of the node embedding vector representation.

[0025] (42) Based on the discretized node embedding vector, a transaction database is constructed. The discretized features of each node are regarded as a transaction, each transaction contains multiple items, and each item represents a feature interval.

[0026] (43) Scan the transaction database, filter out frequent items, and construct a frequent pattern tree (FP tree).

[0027] (44) Using the constructed FP tree, frequent itemsets are mined by recursively constructing a conditional FP tree.

[0028] (45) Generate association rules based on the mined frequent item sets.

[0029] (50) The accuracy of the mined rules is evaluated based on support and confidence.

[0030] (51) The mined rules are evaluated using support and confidence as evaluation indicators.

[0031] (52) Support refers to the ratio of the number of transactions containing a certain item set to the total number of transactions. Support measures the frequency of occurrence of a certain item set in the entire transaction database. The formula is as follows:

[0032]

[0033] Where A∪B represents transactions containing item sets A and B, and |T| represents the total number of transactions in the transaction database. When the support is high, the network key terrain rules appear more frequently and have a larger coverage. The more common the rule is, the more likely it is to have practical significance. Otherwise, when the support is low, the network key terrain rules appear less frequently and may be noise or accidental phenomena and are usually ignored.

[0034] (53) Confidence refers to the proportion of transactions that contain item set B among transactions that contain item set A. Confidence measures the reliability or certainty of the rule. The formula is as follows:

[0035]

[0036] Among them, A∪B represents a transaction containing item sets A and B, and A represents a transaction containing item set A. When the confidence is high, the reliability of the network key terrain rule is high, indicating that when item set A appears, item set B may also appear soon. Otherwise, when the confidence is low, the reliability of the network key terrain rule is low, indicating that when item set A appears, item set B may not appear.

[0037] Compared with the traditional rule mining method, the beneficial effects of the present invention are as follows: the key network terrain rule mining method proposed by the present invention combines the Node2Vec algorithm to optimize the performance of the FP-Growth algorithm, processes the network space model, and can efficiently mine potential key network terrain rules from complex network space. By constructing a four-layer network space model, the originally chaotic network space data is clearly divided into layers; before mining, the network space model data is converted into a low-dimensional vector representation using the Node2Vec algorithm, effectively retaining the network structure characteristics, while optimizing the input of the FP-Growth algorithm and improving the mining efficiency: by mining association rules on low-dimensional vectors using the FP-Growth algorithm, the potential association relationship between nodes can be discovered, and the mined rules are evaluated by support and confidence to improve the accuracy and reliability of the rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a step diagram of the method of the present invention;

[0039] Figure 2 This is a four-layer model diagram of cyberspace;

[0040] Figure 3 Flowchart for low-dimensional embedding vector conversion;

[0041] Figure 4 Flowchart for association rule mining;

[0042] Figure 5 This is a comparison chart of terrain rule recognition methods; DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings.

[0044] The present invention is a method for mining key terrain rules in cyberspace. Figure 1 As shown, the specific steps are as follows:

[0045] (10) Define the cyberspace model and construct the data of each layer of the cyberspace, including the network nodes of the four layers of platform layer, device layer, software layer, and threat layer, as well as the intra-layer and inter-layer relationships of the network nodes. Furthermore, the specific method of (10) is as follows:

[0046] (11) Define the cyberspace model, such as Figure 2 As shown, the cyberspace terrain data is divided into four layers according to the platform layer, device layer, software layer, and threat layer.

[0047] (12) The nodes on the platform layer are some units in the actual geographical location, such as research institutes, data centers, etc.; the nodes on the device layer are routers, servers, host terminals and other equipment; the nodes on the software layer are communication software, protection software, database software and other application programs; the nodes on the threat layer are threat factors such as network attack events, vulnerabilities, and viruses.

[0048] (13) Add required fields to the nodes of each layer: set the unit number for the platform layer nodes, set the IP address for the device layer nodes, set the port number for the software layer nodes, and set the threat number for the threat layer nodes. This ensures uniqueness and achieves the purpose of data preprocessing.

[0049] (14) Construct the inter-layer relationship between each layer node and other layer nodes, for example, the device node of the device layer is located on a certain platform layer unit node, and the software node of the software layer is installed on a certain device layer device node; construct the intra-layer relationship of the nodes of the same layer, such as the connectivity relationship between the devices on the device layer.

[0050] (20) The node and relationship data in the network space model are converted into a graph structure model and stored in the Neo4j graph data. Further, the specific method of (20) is:

[0051] (21) Clarify the meaning of nodes and edges in the graph structure. The network data is represented as a graph G = (V, E), where V is the node set and E is the edge set. The nodes are nodes on the four layers in the network space, and the edges are the intra-layer and inter-layer relationships between nodes.

[0052] (22) Import the prepared cyberspace data into the Neo4j graph data.

[0053] (30) The network space model data is converted into a low-dimensional embedding vector representation of the node. Further, Figure 3 As shown, the specific method of (30) is:

[0054] (31) The Node2Vec algorithm is used to generate random walk sequences. Node2Vec is an algorithm for learning low-dimensional vector representations (node ​​embedding) of nodes in graph structures. Before mining rules in the network space model, the Node2Vec algorithm is used to map high-dimensional network data to low-dimensional space, which simplifies the data representation and reduces the computational complexity, making the subsequent mining process more efficient and better capturing the potential correlation between nodes.

[0055] Reasonably set the relevant parameters of the Node2Vec algorithm, including the length of the random walk (walk_length), the number of walks for each node (num_walks), the dimension of the embedding vector (embedding_dim), and the parameters p and q that control the walk behavior. The parameter p is the return probability, which controls the possibility of the walk returning to the previous node. Smaller p values ​​tend to return, and larger p values ​​tend to move away. The parameter q is the exploration probability, which controls the possibility of the walk exploring new nodes. Smaller q values ​​tend to favor depth-first search, and larger q values ​​tend to favor breadth-first search.

[0056] (32) Based on the set parameters, a random walk is performed on the network space model. Here, a biased random walk strategy is used to generate a series of random walk sequences. The biased random walk strategy adjusts the transition probability between nodes so that the generated node sequence can better capture the structural information of the graph. From the current node v to the candidate node x, the node transition probability formula is as follows:

[0057]

[0058] Where v represents the current node, x is the candidate node, t is the previous node, and w is the vxrepresents the weight of the edge (v, x), N(v) represents the set of neighbor nodes of node v, z represents any neighbor node of node v, and w vz represents the weight of edge (v, z), α pq (t, x) represents the offset, which is used to adjust the transition probability from each node to its adjacent nodes.

[0059] α pq The definition of (t, x) is as follows:

[0060]

[0061] Among them, d tx is the shortest path distance between node t and node x. p and q are the parameters for controlling the walking behavior introduced above.

[0062] During the random walk, the depth and breadth of the walk are adjusted according to the values ​​of parameters p and q to capture local and global structural information in the network.

[0063] (33) Convert the generated random walk sequence into Skip-Gram model training data pairs. Set a window size k to represent the context range of each node in the Skip-Gram model. For each node v in the random walk sequence i , take k nodes before and after it as its context nodes, and replace node v i and its context node to form a training data pair.

[0064] (34) Initialize the Skip-Gram model and train it using the training data pairs. The Skip-Gram model is a neural network model used for word vector representation learning and is also widely used in graph data processing and node embedding learning.

[0065] The Skip-Gram model learns the embedding vectors of network nodes by maximizing the objective function. The formula is as follows:

[0066]

[0067] Among them, V represents the set of all network nodes, N(v) represents the set of context nodes of network node v, and P(u|v) represents the conditional probability of the context node v appearing after a given network node v.

[0068] The conditional probability P(u|v) can be expressed by the softmax function:

[0069]

[0070] Among them, v represents the embedding vector of network node v, u represents the embedding vector of context network node u, and w represents the embedding vector of any network node w.

[0071] The Skip-Gram model is trained using the training data pairs and the embedding vectors are adjusted so that similar network nodes are close to each other in the vector space.

[0072] (35) After training is completed, the embedding vector representation of each node is extracted from the model.

[0073] (40) Perform association rule mining on the embedded vectors of the nodes. Further, the specific method of (40) is:

[0074] (41) The FP-Growth algorithm is used to mine association rules. First, the continuous node embedding vector representation is discretized to obtain the discretized features of the node embedding vector representation.

[0075] FP-Growth algorithm is an efficient frequent itemset mining algorithm. By constructing FP-Trce, it avoids the candidate itemset generation step in the traditional mining algorithm, thereby greatly improving the computational efficiency and is suitable for efficient processing of large-scale data.

[0076] In order to further improve the efficiency of the algorithm, it is necessary to discretize the continuous network space node embedding vector representation trained above, simplifying the complex continuous data into discrete categories that are easier to handle, which helps to reduce the complexity of the data and make the data analysis and mining process more intuitive and efficient.

[0077] The node embedding vector representation needs to be normalized first to ensure that the data in each dimension is on the same scale. The processing method is as follows:

[0078]

[0079] Among them, x represents the value of a certain original data, μ represents the mean of the original data set, σ represents the standard deviation of the original data set, and x′ represents the data after standardization.

[0080] The present invention uses an equal-width discretization method for discretization, dividing the data range into a number of equal-width intervals, and a data point in each interval is assigned a discrete value.

[0081] (42) Based on the discretized node embedding vector, a transaction database is constructed. The discretized features of each node are regarded as a transaction, each transaction contains multiple items, and each item represents a feature interval.

[0082] A transaction database is a type of database used to store and process transaction data in data mining. A transaction database consists of multiple transactions, each of which represents a set of related data items or events. It is usually used for data mining tasks such as association rule mining and frequent item set mining.

[0083] In the present invention, the transaction database stores transactions composed of the discrete features of nodes in the network space model. Each transaction represents the discrete features of a network node. Through these transactions, the association rules in the network space can be subsequently mined.

[0084] (43) Scan the transaction database, filter out frequent items, and construct a frequent pattern tree (FP tree).

[0085] Frequent items refer to individual items that appear frequently in a transaction database in data mining. The discovery of frequent items is the basis of association rule mining and helps to reveal common patterns and relationships in data. When screening frequent items, you need to set a threshold to confirm whether the item is frequent.

[0086] Frequent pattern tree is a data structure used to efficiently mine frequent item sets. It compresses the transaction database into a tree, retains the association information between items, and avoids repeated scanning of the database.

[0087] Constructing a frequent pattern tree requires scanning the transaction database twice. The first scan of the transaction database is used to count the frequency of occurrence of each item. The frequent items are filtered out by the set minimum threshold, and the frequent items are sorted in descending order of frequency to create a frequent item header table. The frequent item header table is used to record each frequent item and its occurrence position in the FP-Tree, which is convenient for subsequent frequent pattern mining. The second scan of the transaction database is to insert the sorted transactions into the FP-Tree in sequence. Initialize an empty root node as the starting point of the FP-Tree. For each transaction, start from the root node and insert the items in the transaction into the FP-Tree in sequence. If the item already exists in the current path, update the count of the item; if the item does not exist in the current path, create a new node and update the linked list in the header table to point to the new node.

[0088] (44) Using the constructed FP tree, frequent itemsets are mined by recursively constructing a conditional FP tree.

[0089] Recursively constructing a conditional FP tree can avoid frequent database scanning operations and efficiently mine frequent item sets.

[0090] Frequent itemsets refer to a collection of frequent items, which can be used to discover valuable patterns and association rules.

[0091] (45) Generate association rules based on the mined frequent item sets.

[0092] For each frequent item set F, generate all non-empty subsets S. For a frequent item set F, each of its non-empty subsets can be used to generate a candidate rule S→(FS). Where (FS) represents the item set, the remaining part after removing the subset S.

[0093] (50) The accuracy of the mined rules is evaluated based on support and confidence. Further, the specific method of (50) is:

[0094] (51) The mined rules are evaluated using support and confidence as evaluation indicators.

[0095] (52) Support refers to the ratio of the number of transactions containing a certain item set to the total number of transactions. Support measures the frequency of occurrence of a certain item set in the entire transaction database. The formula is as follows:

[0096]

[0097] Where A∪B represents transactions containing item sets A and B, and |T| represents the total number of transactions in the transaction database. When the support is high, the rule appears more frequently and has a larger coverage. The more common the rule is, the more likely it is to have practical significance. Otherwise, when the support is low, the rule appears less frequently and may be noise or accidental phenomenon, and is usually ignored.

[0098] (53) Confidence refers to the proportion of transactions that contain item set B among transactions that contain item set A. Confidence measures the reliability or certainty of the rule. The formula is as follows:

[0099]

[0100] Among them, A∪B represents a transaction containing item sets A and B, and A represents a transaction containing item set A. When the confidence is high, the reliability of the rule is high, indicating that when item set A appears, item set B may also appear soon. Otherwise, when the confidence is low, the reliability of the rule is low, indicating that when item set A appears, item set B may not appear.

[0101] Finally, if Figure 5 As shown in the figure, the rules identified by the traditional terrain rule recognition method rely on expert experience, have great limitations, and are prone to ignoring hidden rules in the cyberspace. The terrain rule mining algorithm proposed in this paper can mine more complex and potential rule relationships and has stronger adaptability. For example, through mining, it is found that most devices installed with software A have been attacked by threat B, so it can be concluded that software A has a vulnerability targeted by threat B. This type of rule is mined in a complex cyberspace and cannot be directly detected by experience.

[0102] The above is only a preferred embodiment of the present invention, and the invention is not limited to the above embodiment. Anyone should know that any technical solution that is the same or similar to the present invention made under the inspiration of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for mining key terrain rules for cyberspace, characterized in that: The steps of the method are as follows: (10) Define the cyberspace model and construct data for each layer of the cyberspace. (20) Convert the node and relationship data in the network space model into a graph structure model. (30) Convert the network space model data into low-dimensional embedding vector representation of nodes. (40) Perform association rule mining on the node embedding vectors. (50) The accuracy of the mined rules is evaluated based on support and confidence.

2. According to claim 1, a method for mining key terrain rules for cyberspace is characterized in that: The division steps of (10) are specifically as follows: (11) Define the cyberspace model and divide the cyberspace terrain data into four layers according to the platform layer, device layer, software layer, and threat layer. (12) The nodes on the platform layer are some units in the actual geographical location, such as research institutes, data centers, etc.; the nodes on the device layer are routers, servers, host terminals and other equipment; the nodes on the software layer are communication software, protection software, database software and other application programs; the nodes on the threat layer are threat factors such as network attack events, vulnerabilities, and viruses. (13) Add required fields to the nodes of each layer: set the unit number for the platform layer nodes, set the IP address for the device layer nodes, set the port number for the software layer nodes, and set the threat number for the threat layer nodes. This ensures uniqueness and achieves the purpose of data preprocessing. (14) Construct the inter-layer relationship between each layer node and other layer nodes, for example, the device node of the device layer is located on a certain platform layer unit node, and the software node of the software layer is installed on a certain device layer device node; construct the intra-layer relationship of the nodes of the same layer, such as the connectivity relationship between the devices on the device layer.

3. The method for mining key terrain rules for cyberspace according to claim 1 is characterized in that The steps of (20) are specifically as follows: (21) Clarify the meaning of nodes and edges in the graph structure. Nodes are nodes on the four layers in the network space, and edges are the intra-layer and inter-layer relationships between nodes. (22) Import the prepared cyberspace data into the Neo4j graph data.

4. The method for mining key terrain rules for cyberspace according to claim 1, characterized in that The division steps of (30) are specifically as follows: (31) The Node2Vec algorithm is used to generate random walk sequences for network model data. The relevant parameters of the Node2Vec algorithm are reasonably set, including the length of the random walk (walk_length), the number of walks for each node (num_walks), the dimension of the embedding vector (embedding_dim), and the parameters p and q that control the walk behavior. The parameter p is the return probability, which controls the possibility of the walk returning to the previous node. Smaller p values ​​tend to return, and larger p values ​​tend to move away. The parameter q is the exploration probability, which controls the possibility of the walk exploring new nodes. Smaller q values ​​tend to favor depth-first search, and larger q values ​​tend to favor breadth-first search. (32) Based on the set parameters, a random walk is performed on the network space model. The present invention adopts a biased random walk strategy to generate a series of random walk sequences. During the random walk, the depth and breadth of the walk are adjusted according to the values ​​of parameters p and q to capture the local and global structural information in the network. (33) The generated random walk sequence is converted into a Skip-Gram model training data pair and provided to the model for training. (34) Initialize the Skip-Gram model and train it using training data pairs so that the vectors of similar network nodes are closer in the low-dimensional space. (35) After training is completed, the embedded vector representation of each network node is extracted from the model.

5. The method for mining key terrain rules for cyberspace according to claim 1, characterized in that The division steps of (40) are specifically as follows: (41) The FP-Growth algorithm is used to mine association rules. First, the continuous node embedding vector representation is discretized to obtain the discretized features of the node embedding vector representation. (42) Based on the discretized node embedding vector, a transaction database is constructed. The discretized features of each node are regarded as a transaction, each transaction contains multiple items, and each item represents a feature interval. (43) Scan the transaction database, filter out frequent items, and construct a frequent pattern tree (FP tree). (44) Using the constructed FP tree, frequent itemsets are mined by recursively constructing a conditional FP tree. (45) Generate association rules based on the mined frequent item sets.

6. The method for mining key terrain rules for cyberspace according to claim 1, characterized in that The division steps of (50) are specifically as follows: (51) The mined rules are evaluated using support and confidence as evaluation indicators. (52) Support refers to the ratio of the number of transactions containing a certain item set to the total number of transactions. Support measures the frequency of occurrence of a certain item set in the entire transaction database. The formula is as follows: Where A∪B represents transactions containing item sets A and B, and |T| represents the total number of transactions in the transaction database. When the support is high, the network key terrain rules appear more frequently and have a larger coverage. The more common the rule is, the more likely it is to have practical significance. Otherwise, when the support is low, the network key terrain rules appear less frequently and may be noise or accidental phenomena and are usually ignored. (53) Confidence refers to the proportion of transactions that contain item set B among transactions that contain item set A. Confidence measures the reliability or certainty of the rule. The formula is as follows: Among them, A∪B represents a transaction containing item sets A and B, and A represents a transaction containing item set A. When the confidence is high, the reliability of the network key terrain rule is high, indicating that when item set A appears, item set B may also appear soon. Otherwise, when the confidence is low, the reliability of the network key terrain rule is low, indicating that when item set A appears, item set B may not appear.

Images