Method, device and storage medium for constructing self-feedback network security knowledge graph

Abstract

The present application discloses a method, device and storage medium for constructing a self-feedback network security knowledge graph, which relates to the field of network security technology, including: obtaining historical network security data of a target network; constructing an initial network security knowledge graph based on the historical network security data, wherein the initial network security knowledge graph includes multiple node attribute information and multiple edge attribute information; performing a simulation test on the target network at each preset test time interval to obtain test security data; updating the edge attribute information based on the test security data at each preset test time interval to obtain an enhanced network security knowledge graph; performing denoising on the edge attribute information in the enhanced network security knowledge graph based on the edge attribute information before the update at each preset test time interval to obtain an optimized network security knowledge graph. The present application can improve the dynamic adaptability of the network security knowledge graph.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and storage medium for constructing a self-feedback network security knowledge graph. Background Art

[0002] The network security knowledge graph is a knowledge representation model that can structurally associate massive, heterogeneous data such as threat intelligence, network attack events, vulnerability information, and attack methods to form a knowledge base in the field of cyberspace security, helping technical personnel to more clearly understand complex threat relationships and potential attack paths. Currently, the network security knowledge graph has been widely used in network security defense, threat detection, and threat intelligence analysis.

[0003] Currently, most cybersecurity knowledge graphs are constructed by the system through data collected at a certain moment. However, the cybersecurity environment changes rapidly, and information such as attack methods and vulnerability exploitation techniques will evolve rapidly over time. The static structure of the cybersecurity knowledge graph cannot effectively adapt to such changes in the cybersecurity environment, which will greatly affect the system's response speed to emerging threats and decision-making accuracy, reducing network security. Based on this, how to improve the dynamic adaptability of the cybersecurity knowledge graph is an issue that needs to be discussed and solved urgently. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a method, device and storage medium for constructing a self-feedback network security knowledge graph, which can improve the dynamic adaptability of the network security knowledge graph.

[0005] In order to solve the above technical problems, this application proposes the following technical solutions:

[0006] The first aspect of the present application provides a method for constructing a self-feedback network security knowledge graph, including:

[0007] Obtain historical network security data of the target network;

[0008] Constructing an initial network security knowledge graph based on the historical network security data, wherein the initial network security knowledge graph includes a plurality of node attribute information and a plurality of edge attribute information, wherein the node attribute information is used to indicate each entity in the target network, and the edge attribute information is used to indicate the degree of association between different entities in the target network;

[0009] Performing simulation test on the target network at each preset test time interval to obtain test safety data;

[0010] At each preset test time interval, the edge attribute information is updated based on the test security data to obtain an enhanced network security knowledge graph;

[0011] At each preset test time interval, the edge attribute information in the enhanced network security knowledge graph is denoised based on the edge attribute information before updating to obtain an optimized network security knowledge graph.

[0012] According to the method for constructing a self-feedback network security knowledge graph according to the first aspect of the present application, there are at least the following beneficial effects: First, the present application obtains the historical network security data of the target network and constructs a static initial network security knowledge graph based on the historical network security data. On this basis, the present application will perform a simulation test on the target network at each preset test time interval to obtain test security data that can reflect the environment of the target network, and update the edge attribute information in the initial network security knowledge graph based on the test security data to obtain an enhanced network security knowledge graph. Compared with the prior art that obtains a static network security knowledge graph by constructing data collected at a certain moment, the present application uses the collected test security data to update the edge attribute information at each test time interval, realizing the self-feedback optimization of the network security knowledge graph, so that the network security knowledge graph effectively adapts to changes in the network security environment and improves the dynamic adaptability of the network security knowledge graph. Finally, the present application will also perform denoising on the edge attribute information in the enhanced network security knowledge graph based on the edge attribute information before the update to obtain an optimized network security knowledge graph, which can further improve its accuracy on the basis of the enhanced network security knowledge graph.

[0013] According to some embodiments of the first aspect of the present application, obtaining historical network security data of the target network includes:

[0014] Extracting network traffic logs, attack event records, user behavior data, and vulnerability data from the backend server of the target network;

[0015] Standardizing the network traffic log, the attack event record, the user behavior data, and the vulnerability data to obtain first network security data corresponding to the network traffic log, second network security data corresponding to the attack event record, third network security data corresponding to the user behavior data, and fourth network security data corresponding to the vulnerability data;

[0016] The first network security data, the second network security data, the third network security data and the fourth network security data are integrated to obtain the historical network security data.

[0017] According to some embodiments of the first aspect of the present application, constructing an initial network security knowledge graph based on the historical network security data includes:

[0018] Determine node attribute information and node association information based on the historical network security data, wherein the node association information is used to indicate an association relationship between entities in the target network;

[0019] Mapping the node attribute information and the node association information into a preset graph structure to obtain a graph model;

[0020] Acquire historical annotation information and determine edge attribute information of the graph model based on the historical annotation information;

[0021] The graph model annotated with the edge attribute information is determined as the initial network security knowledge graph.

[0022] According to some embodiments of the first aspect of the present application, determining the node attribute information and the node association information based on the historical network security data includes:

[0023] Extracting the node attribute information from the historical network security data using natural language processing technology;

[0024] Using a named entity recognition algorithm to identify and classify each entity in the node attribute information to obtain a plurality of entity categories and a plurality of entities corresponding to the entity categories;

[0025] The relationship extraction technology is used to identify the association between entities in each of the entity categories to obtain the node association information.

[0026] According to some embodiments of the first aspect of the present application, the performing simulation test on the target network to obtain test security data includes:

[0027] Acquire multiple simulation test modes, and perform simulation tests on the target network based on the simulation test modes;

[0028] During the simulation test, attack behavior data, defense behavior data and path selection data are collected;

[0029] The attack behavior data, the defense behavior data and the path selection data are integrated into the test safety data.

[0030] According to some embodiments of the first aspect of the present application, the updating of the edge attribute information based on the test security data to obtain an enhanced network security knowledge graph includes:

[0031] Preprocessing the test safety data to obtain test feedback information;

[0032] If the test security data is test security data obtained by performing a first round of simulation test on the target network, the edge attribute information of the initial network security knowledge graph is updated based on the test feedback information to obtain updated edge attribute information;

[0033] The edge attribute information before the update in the initial network security knowledge graph is replaced by the updated edge attribute information to obtain the enhanced network security knowledge graph.

[0034] According to some embodiments of the first aspect of the present application, the updating of the edge attribute information based on the test security data to obtain an enhanced network security knowledge graph further includes:

[0035] Preprocessing the test safety data to obtain test feedback information;

[0036] If the test security data is not the test security data obtained by performing a first round of simulation test on the target network, updating the edge attribute information of the optimized network security knowledge graph based on the test feedback information to obtain updated edge attribute information;

[0037] The edge attribute information before the update in the optimized network security knowledge graph is replaced by the updated edge attribute information to obtain the enhanced network security knowledge graph.

[0038] According to some embodiments of the first aspect of the present application, the test feedback information is an attack path and a number of successful attacks corresponding to the attack path, and the preprocessing of the test security data to obtain the test feedback information includes:

[0039] Extracting each entity in the target network from the test security data;

[0040] Performing matching processing on the entity extracted from the test security data and the node attribute information in the initial network security knowledge graph to obtain a matching node;

[0041] An attack path between different matching nodes and the number of successful attacks corresponding to the attack path are determined based on the test security data.

[0042] According to some embodiments of the first aspect of the present application, the edge attribute information is an edge weight value, and the updating of the edge attribute information of the initial network security knowledge graph based on the test feedback information to obtain the updated edge attribute information includes:

[0043] Based on each of the attack paths, the difference between the number of successful attacks corresponding to the attack path and the preset expected number of attacks is used as the attack number difference;

[0044] The product of the attack number difference and a preset learning rate is used as an adjustment amount, and the updated edge weight value is determined based on the adjustment amount and the edge weight value before updating.

[0045] According to some embodiments of the first aspect of the present application, the denoising of the edge attribute information in the enhanced network security knowledge graph based on the edge attribute information before updating to obtain an optimized network security knowledge graph includes:

[0046] If the edge attribute information before the update is the same as the edge attribute information in the enhanced network security knowledge graph, determining the enhanced network security knowledge graph as the optimized network security knowledge graph;

[0047] If the edge attribute information before updating is different from the edge attribute information in the enhanced network security knowledge graph, the enhanced network security knowledge graph is denoised using graph neural network technology to obtain an optimized network security knowledge graph.

[0048] According to some embodiments of the first aspect of the present application, the method of performing denoising on the enhanced network security knowledge graph using graph neural network technology to obtain an optimized network security knowledge graph includes:

[0049] Calculate and aggregate the node attribute information of the enhanced network security knowledge graph through a message passing mechanism to obtain node feature information corresponding to each node attribute information in the enhanced network security knowledge graph;

[0050] The enhanced network security knowledge graph is subjected to edge denoising processing based on the node feature information to obtain the optimized network security knowledge graph.

[0051] A second aspect of the present application provides an electronic device, including:

[0052] at least one memory;

[0053] at least one processor;

[0054] at least one program;

[0055] The program is stored in the memory, and the processor executes at least one of the programs to implement:

[0056] A method for constructing a self-feedback network security knowledge graph as described in any one of the first aspects of the present application.

[0057] A third aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer-executable signal, and the computer-executable signal is used to execute:

[0058] A method for constructing a self-feedback network security knowledge graph as described in any one of the first aspects of the present application.

[0059] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0061] Figure 1 A main flow chart of a method for constructing a self-feedback network security knowledge graph provided in some embodiments of the present application;

[0062] Figure 2 A flowchart of obtaining historical network security data of a target network provided by some embodiments of the present application;

[0063] Figure 3 A flowchart of constructing an initial network security knowledge graph based on historical network security data provided in some embodiments of the present application;

[0064] Figure 4 A flowchart of determining node attribute information and node association information based on historical network security data provided by some embodiments of the present application;

[0065] Figure 5 A flowchart of performing simulation testing on a target network provided in some embodiments of the present application;

[0066] Figure 6 A flowchart of updating edge attribute information based on test security data to obtain an enhanced network security knowledge graph provided in some embodiments of the present application;

[0067] Figure 7 A flowchart of updating edge attribute information based on test security data to obtain an enhanced network security knowledge graph provided in some other embodiments of the present application;

[0068] Figure 8 A flowchart of preprocessing test safety data provided in some embodiments of the present application;

[0069] Fig. 9 A flowchart of updating edge attribute information of an initial network security knowledge graph based on test feedback information provided in some embodiments of the present application;

[0070] Fig.10 A flowchart of using graph neural network technology to denoise the enhanced network security knowledge graph provided in some embodiments of the present application;

[0071] Fig.11 A module block diagram of an electronic device provided for some embodiments of the present application. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0073] It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than in the flowchart. Terms in the specification, claims and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0074] In the description of this application, if there is a description of first or second, it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0075] In the description of this application, unless otherwise clearly defined, terms such as setting, installing, connecting, etc. should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in this application based on the specific content of the technical solution.

[0076] First, some terms used in this application are explained:

[0077] Cybersecurity knowledge graph: The cybersecurity knowledge graph is a structured database that visualizes entities in the cybersecurity field (such as attackers, vulnerabilities, malware, etc.) and their relationships. This graph can help technical maintenance personnel better understand complex network attack patterns, identify potential threats, and develop effective defense strategies.

[0078] Graph Neural Networks (GNN): The basic concepts of graph neural networks include nodes (vertices) and edges (edges), where nodes represent entities and edges represent relationships between entities. A graph can be represented as a structure consisting of a set of nodes and a set of edges, usually represented by G=(V,E), where V is a set of nodes and E is a set of edges. The core idea of ​​GNN is to calculate and aggregate information on the graph through a message passing mechanism to achieve representation learning of nodes and graphs. The message passing process is the core operation of GNN. In this way, each node can receive information from its neighboring nodes and update its own state.

[0079] The network security knowledge graph is a knowledge representation model that can structurally associate massive, heterogeneous data such as threat intelligence, network attack events, vulnerability information, and attack methods to form a knowledge base in the field of cyberspace security, helping technical personnel to more clearly understand complex threat relationships and potential attack paths. At present, network security knowledge graphs have been widely used in network security defense, threat detection, and threat intelligence analysis. Most of the current network security knowledge graphs are constructed by the system through data collected at a certain moment. However, the network security environment changes rapidly, and information such as attack methods and vulnerability exploitation techniques will evolve rapidly over time. The static structure of the network security knowledge graph cannot effectively adapt to such changes in the network security environment, which will greatly affect the system's response speed to emerging threats and decision-making accuracy, reducing network security. Based on this, how to improve the dynamic adaptability of the network security knowledge graph is an issue that needs to be discussed and solved urgently.

[0080] Based on this, the method for constructing a self-feedback network security knowledge graph in this application can improve the dynamic adaptability of the network security knowledge graph.

[0081] Reference Figure 1 In the first aspect, an embodiment of the present application provides a method for constructing a self-feedback network security knowledge graph, and the construction method includes but is not limited to steps S110, S120, S130, S140, and S150.

[0082] S110, obtaining historical network security data of the target network;

[0083] S120, constructing an initial network security knowledge graph based on historical network security data, wherein the initial network security knowledge graph includes multiple node attribute information and multiple edge attribute information, the node attribute information is used to indicate each entity in the target network, and the edge attribute information is used to indicate the degree of association between different entities in the target network;

[0084] S130, performing simulation test on the target network at each preset test time interval to obtain test security data;

[0085] S140, at each preset test time interval, the edge attribute information is updated based on the test security data to obtain an enhanced network security knowledge graph;

[0086] S150. At each preset test time interval, the edge attribute information in the enhanced network security knowledge graph is denoised based on the edge attribute information before updating to obtain an optimized network security knowledge graph.

[0087] According to an embodiment of the present application, the target network refers to the network that needs to be maintained in the present application, and the historical network security data refers to the threat intelligence, network attack events, vulnerability information, attack methods and other data in the target network in the past time period. The initial network security knowledge graph constructed based on historical network security data is a static network security knowledge graph, and the initial network environment of the target network can be determined through the initial network security knowledge graph. Among them, the initial network security knowledge graph includes multiple node attribute information and multiple edge attribute information. The node attribute information is used to indicate each entity in the target network (including IP address, attacker, victim, malware, vulnerability, etc.), and the edge attribute information is used to indicate the degree of association between different entities in the target network (for example: the attacker launches an attack on the victim, the malware launches an attack on a server, etc.).

[0088] Further, on the basis of determining to obtain a static initial network security knowledge graph, the present application will also simulate the target network at each preset test time interval to collect test security data during the simulation test. Among them, the test time can be determined based on the complexity of the target network, and the test time can be 5 minutes or 10 minutes. The simulation test can be a "Capture The Flag" (CTF) competition, or an attack and defense drill, etc. This test usually includes a series of questions covering network security, vulnerability exploitation and other fields, and the server obtains the "flag" by solving these questions. The test security data is the data collected during the simulation test of the target network. The test security data includes the attacker's operation, the attack path selected by the attacker, the defender's operation, the defender's defense effect, etc. These test security data can reflect the real-time environment of the target network. The present application simulates the target network at each preset test time interval, and can determine the vulnerabilities in the target network in different time periods, the attack means that each server will take to attack the vulnerabilities, and the defense means that each server will take to defend against attacks. Based on this, we can not only understand the network security environment of the target network in the current time period in real time, but also obtain the network security environment of the target network in multiple different time periods in the past, so as to infer the changing trend of the network security environment of the target network and predict the changing trend of the network security environment of the target network in the future.

[0089] Furthermore, the present application can update the edge attribute information in the initial network security knowledge graph based on the collected test security data to obtain an enhanced network security knowledge graph. Compared with the prior art that obtains a static network security knowledge graph by constructing data collected at a certain moment, the present application performs a simulation test on the target network at each test interval, and uses the test security data collected during the simulation test to update the edge attribute information, realizing the self-feedback optimization of the network security knowledge graph, so that the network security knowledge graph is no longer a static and unchanging data structure, but a dynamic data structure that can effectively adapt to the ever-changing network security environment, thereby improving the dynamic adaptability of the network security knowledge graph.

[0090] Finally, limited by the complexity of the historical network security data of the target network, the initial network security knowledge graph and the enhanced network security knowledge graph may have redundant node attribute information and edge attribute information, which reduces the accuracy of the initial network security knowledge graph and the enhanced network security knowledge graph. Based on this, after determining that the enhanced network security knowledge graph is obtained, in order to improve the accuracy of the enhanced network security knowledge graph and reduce the redundant node attribute information and edge attribute information in the enhanced network security knowledge graph, this application will also denoise the edge attribute information in the enhanced network security knowledge graph based on the edge attribute information before the update to obtain an optimized network security knowledge graph. In the case where there is a gap between the edge attribute information before the update and the updated edge attribute information in the enhanced network security knowledge graph, the optimized network security knowledge graph obtained after denoising the enhanced network security knowledge graph can improve the accuracy of the network security knowledge graph.

[0091] In one embodiment, referring to Figure 2 , step 110 comprises:

[0092] Step 210: extract network traffic logs, attack event records, user behavior data, and vulnerability data from the backend server of the target network;

[0093] Step 220: Standardize the network traffic log, the attack event record, the user behavior data, and the vulnerability data to obtain first network security data corresponding to the network traffic log, second network security data corresponding to the attack event record, third network security data corresponding to the user behavior data, and fourth network security data corresponding to the vulnerability data;

[0094] Step 230: Integrate the first network security data, the second network security data, the third network security data and the fourth network security data to obtain historical network security data.

[0095] According to the embodiments of the present application, unlike the prior art of obtaining network data from a single data source, the present application can use the ETL (Extract, Transform, Load) process to extract network data such as network traffic logs, attack event records, user behavior data and vulnerability data from multiple data sources in the background server of the target network, thereby enriching the categories of network data and improving the universality of the present application.

[0096] Furthermore, because the text formats of network data extracted from different data sources are different, in order to facilitate subsequent data processing, this application will also standardize network traffic logs, attack event records, user behavior data and vulnerability data to obtain first network security data corresponding to network traffic logs, second network security data corresponding to attack event records, third network security data corresponding to user behavior data and fourth network security data corresponding to vulnerability data. Standardization refers to the process of storing, processing and analyzing network data from different data sources, formats and types in a consistent manner by formulating unified formats, rules and standards.

[0097] After standardizing the network data from different data sources, the present application integrates the first network security data, the second network security data, the third network security data, and the fourth network security data to obtain historical network security data. The historical network security data can also be understood as a collection of the first network security data, the second network security data, the third network security data, and the fourth network security data.

[0098] In one embodiment, referring to Figure 3 , step 120 comprises:

[0099] Step 310: determining node attribute information and node association information based on historical network security data, wherein the node association information is used to indicate association relationships between entities in the target network;

[0100] Step 320: Map the node attribute information and the node association information into a preset graph structure to obtain a graph model;

[0101] Step 330: Obtain historical annotation information and determine edge attribute information of the graph model based on the historical annotation information;

[0102] Step 340: Determine the graph model annotated with edge attribute information as the initial network security knowledge graph.

[0103] According to the embodiments of the present application, by analyzing historical network security data, it is possible to determine the entities such as attackers, victims, malware, vulnerabilities, etc. in the target network, as well as the association relationship between each entity (for example, the attacker uses a certain attack method to target a certain vulnerability). Then, the identified entities and the association relationship between each entity can be mapped to a preset graph structure to construct a graph model containing information such as attack paths and associated risks. Among them, the preset graph structure refers to the initial graph structure that does not record any data.

[0104] Finally, in order to obtain a complete network security knowledge graph, this application will also assign values ​​to the edge attribute information in the graph model based on historical annotation information. For example: assigning values ​​to edge weights, assigning values ​​to association probabilities, assigning values ​​to risk levels, etc. Among them, the historical annotation information can be determined based on historical threat intelligence, or it can be annotated by experts in the field of network security. After assigning values ​​to the edge attributes in the graph model, the graph model annotated with edge attribute information can be determined as the initial network security knowledge graph. The initial network security knowledge graph obtained here is determined based on historical network security data and is a static model.

[0105] In one embodiment, referring to Figure 4 , step 310 includes:

[0106] Step 410: extracting node attribute information from historical network security data using natural language processing technology;

[0107] Step 420: Classify each entity in the node attribute information using a named entity recognition algorithm to obtain multiple entity categories and multiple entities corresponding to the entity categories;

[0108] Step 430: Use relationship extraction technology to identify the associations between entities in each entity category to obtain node association information.

[0109] According to the embodiment of the present application, the detailed process of determining node attribute information and node association information based on historical network security data is described here: first, natural language processing technology is used to extract entities such as attackers, victims, malware, vulnerabilities, etc. in the target network from unstructured historical network security data, that is, node attribute information. Among them, natural language processing technology can extract various entities in historical network security data through means such as named entity recognition, semantic analysis, and machine translation.

[0110] Then, since there are multiple entities extracted in step 410 (for example, server A, server B and server C are all attackers, and server D, server E and server F are victims), in order to facilitate the subsequent determination of the association relationship between different entities, the named entity recognition algorithm can be used here to identify and classify each entity in the node attribute information to obtain multiple entity categories and multiple entities corresponding to the entity categories. For example: there are servers A, B, C and D in the target network, server A uses attack method H to attack server B, and server C uses attack method G to attack D. After classifying these multiple servers, the attacker category and the victim category can be obtained. The attacker category includes server A and server C, and the victim category includes server B and server D. Among them, the named entity recognition algorithm can identify entities with specific meanings from the text.

[0111] Finally, in order to identify the associations between different entities, the historical network security data can be analyzed using relationship extraction technology to identify the associations between entities in each entity category, identify the associations between each entity (for example, server A uses a certain attack method to attack server B), and determine the node association information. Among them, the relationship extraction technology can extract the connection between each entity based on the identified entities by analyzing the text semantics and context information of the historical network security data to form a structured knowledge representation.

[0112] In one embodiment, referring to Figure 5 , step 130 comprises:

[0113] Step 510: Acquire multiple simulation test modes, and perform simulation tests on the target network based on the simulation test modes;

[0114] Step 520: During the simulation test, collect attack behavior data, defense behavior data and path selection data;

[0115] Step 530: Integrate the attack behavior data, defense behavior data, and path selection data into test security data.

[0116] According to the embodiments of the present application, the simulation test modes include "Capture The Flag" (CTF) competition, attack and defense drill (AWD), attack and defense enhancement, automated vulnerability mining, etc. The present application performs simulation tests on the target network based on these simulation test modes to obtain the network security environment of the current target network from multiple angles.

[0117] During the simulation test, the present application can collect attack behavior data, defense behavior data, path selection data, etc. in a controlled environment, providing practical operational basis and data support for the dynamic feedback of the network security knowledge graph.

[0118] Finally, to facilitate the subsequent analysis and processing of the attack behavior data, defense behavior data, and path selection data, the present application can also classify and integrate the attack behavior data, defense behavior data, and path selection data to obtain test security data.

[0119] In one embodiment, referring to Figure 6 , step 140 comprises:

[0120] Step 610: pre-process the test safety data to obtain test feedback information;

[0121] Step 620: If the test security data is the test security data obtained by performing a first round of simulation test on the target network, the edge attribute information of the initial network security knowledge graph is updated based on the test feedback information to obtain updated edge attribute information;

[0122] Step 630: Use the updated edge attribute information to replace the edge attribute information before the update in the initial network security knowledge graph to obtain an enhanced network security knowledge graph.

[0123] According to the embodiments of the present application, since there is some redundant information in the test security data, it may interfere with the edge attribute information and node attribute information in the network security knowledge graph, so it is also necessary to pre-process the test security data to extract meaningful information, namely, test feedback information. The test feedback information includes information such as the attack path, the number of successful attacks corresponding to the attack path, and invalid defense strategies, which can provide a basis for the subsequent update of edge attribute information.

[0124] It is understandable that when the test security data is the test security data obtained by the first round of simulation test on the target network, it means that the network security knowledge graph at this time is the initial network security knowledge graph, that is, the current network security knowledge graph is based on historical network security data, and the edge attribute information has not been updated. At this time, the edge attribute information of the initial network security knowledge graph can be updated based on the test feedback information to obtain the updated edge attribute information. Among them, the updated edge attribute information can reflect the degree of association between different entities in the network security environment of the current target network.

[0125] Then, after determining that the updated edge attribute information is obtained, the updated edge attribute information can be used to replace the edge attribute information before the update in the initial network security knowledge graph to obtain an enhanced network security knowledge graph to improve the dynamic adaptability of the network security knowledge graph.

[0126] It can be understood that after performing simulation tests on the target network at preset test time intervals and obtaining test security data, the method for constructing a self-feedback network security knowledge graph further includes:

[0127] Access historical test safety data;

[0128] Build a network environment change model corresponding to the target network based on historical test safety data and test safety data;

[0129] The network environment change model is used to predict the network security environment of the target network and obtain the predicted network environment data;

[0130] Update edge attribute information based on predicted network environment data and test security data to strengthen the network security knowledge graph.

[0131] According to the embodiments of the present application, historical test security data refers to all test security data collected before the current time. Because the target network is simulated and tested at every preset test time in the present application, the historical test security data can also be understood as the test security data collected in multiple time periods in the past. The historical test security data reflects the network security environment of the target network in multiple different time periods in the past.

[0132] It is understandable that the network environment change model refers to a large model that can predict the changing trend of the network security environment of the target target network. The present application constructs a network environment change model corresponding to the target network based on historical test security data and test security data, and uses the network environment change model to predict the network security environment of the target network to obtain predicted network environment data. The predicted network environment data is data used to represent the network security environment in a short period of time in the future. The predicted network environment data is similar to the test security data, including information such as the attack path, the number of successful attacks corresponding to the attack path, and invalid defense strategies. Based on the predicted network environment data, it can help prevent vulnerabilities in the target network and improve the security of the target network.

[0133] Furthermore, the present application can also update the edge attribute information based on the predicted network environment data and the test security data to strengthen the network security knowledge graph. The enhanced network security knowledge graph updated in this way integrates the data of the predicted network security environment in the short term in the future, which can not only improve the dynamic adaptability of the network security knowledge graph, but also help prevent vulnerabilities and other information in the target network, thereby improving the security of the target network.

[0134] In one embodiment, referring to Figure 7 , step 140 further includes:

[0135] Step 710: pre-process the test safety data to obtain test feedback information;

[0136] Step 720: If the test security data is not the test security data obtained by performing the first round of simulation test on the target network, the edge attribute information of the optimized network security knowledge graph is updated based on the test feedback information to obtain updated edge attribute information;

[0137] Step 730: Use the updated edge attribute information to replace the edge attribute information before the update in the optimized network security knowledge graph to obtain an enhanced network security knowledge graph.

[0138] It is understandable that the specific implementation of step 710 is similar to the specific implementation of step 610, and will not be described in detail here.

[0139] According to an embodiment of the present disclosure, when the test security data is not the test security data obtained by the first round of simulation test of the target network, it means that the network security knowledge graph at this time is the optimized network security knowledge graph determined based on the test security data obtained by the previous round of simulation test, that is, the current network security knowledge graph has updated the edge attribute information multiple times and has performed multiple denoising processes. At this time, the edge attribute information of the optimized network security knowledge graph can be updated based on the test feedback information to obtain the updated edge attribute information. Among them, the updated edge attribute information can reflect the degree of association between different entities in the network security environment of the current target network.

[0140] Then, after determining that the updated edge attribute information is obtained, the updated edge attribute information can be used to replace the edge attribute information before the update in the optimized network security knowledge graph to obtain an enhanced network security knowledge graph to improve the dynamic adaptability of the network security knowledge graph.

[0141] In one embodiment, the test feedback information is the attack path and the number of successful attacks corresponding to the attack path. Figure 8 , step 710 includes:

[0142] Step 810: extracting each entity in the target network from the test security data;

[0143] Step 820: Match the entity extracted from the test security data with the node attribute information in the initial network security knowledge graph to obtain a matching node;

[0144] Step 830: Determine attack paths between different matching nodes and the number of successful attacks corresponding to the attack paths based on the test security data.

[0145] According to the embodiments of the present application, in order to facilitate the subsequent analysis of the test security data, it is first necessary to extract the various entities in the target network from the test security data to clarify the various execution subjects in the network security environment. For example, there is test security data: server A uses attack method B to attack vulnerability C. At this time, server A and vulnerability C can be extracted from the test security data.

[0146] It is understandable that after extracting each entity in the target network from the test security data, it is necessary to match the entities extracted from the test security data with the node attribute information in the initial network security knowledge graph to obtain matching nodes in the initial network security knowledge graph that match the entities in the test security data, so as to facilitate the subsequent comparison of the performance of each attack path in the network security knowledge graph in the actual network security environment. Then, the attack path between different matching nodes and the number of successful attacks corresponding to the attack path can be determined based on the test security data, where the number of successful attacks corresponding to the attack path refers to the number of times a node uses this attack path to attack another node and the attack is successful. The number of successful attacks corresponding to the attack path can effectively quantify the effect of using a certain attack path to attack.

[0147] In one embodiment, the edge attribute information is the edge weight value, referring to Fig. 9 , step 620 includes:

[0148] Step 910: Based on each attack path, the difference between the number of successful attacks corresponding to the attack path and the preset expected number of attacks is used as the attack number difference;

[0149] Step 920: taking the product of the difference in the number of attacks and the preset learning rate as an adjustment amount, and determining an updated edge weight value based on the adjustment amount and the edge weight value before updating.

[0150] According to an embodiment of the present application, based on each attack path, the number of successful attacks corresponding to the attack path can be and the expected number of attacks difference As the difference in the number of attacks, the expected number of attacks can be determined based on historical network security data of the target network.

[0151] It can be understood that the edge weight value refers to the strength of the interaction between two nodes in the network security knowledge graph, and the edge weight value can also be understood as a parameter used to measure the importance of the attack path between two nodes. and the preset learning rate Product As the adjustment amount of the edge weight value, the edge weight value is adjusted based on the current network security environment. Among them, the learning rate is a preset constant and can also be determined based on historical network security data.

[0152] Then, the adjustment amount can be and the edge weight value before update Determine the updated edge weight value , in order to achieve real-time feedback adjustment of edge weight values ​​and improve the dynamic adaptability of the network security knowledge graph. Specifically, the formula for determining the updated edge weight value based on the adjustment amount and the edge weight value before the update can be expressed as: ;in, Represents the updated edge weight value; Represents the edge weight value before updating; Indicates the preset learning rate; represents the expected number of attacks; Indicates the number of successful attacks corresponding to the attack path.

[0153] According to the embodiments of the present application, if a certain attack path is frequently used and successfully by the attacker in the simulation test, the edge weight value corresponding to the attack path will be increased to prompt the defender to strengthen the protection. By adjusting the edge weight value in real time through the method of the present application, not only can the current network security environment be reflected in real time, but also the network security knowledge graph can be quickly adapted to emerging threats and attack modes.

[0154] It can be understood that the edge attribute information in the enhanced network security knowledge graph is denoised based on the edge attribute information before the update to obtain an optimized network security knowledge graph, including: if the edge attribute information before the update is the same as the edge attribute information in the enhanced network security knowledge graph, the enhanced network security knowledge graph is determined as the optimized network security knowledge graph; if the edge attribute information before the update is different from the edge attribute information in the enhanced network security knowledge graph, the enhanced network security knowledge graph is denoised using graph neural network technology to obtain an optimized network security knowledge graph.

[0155] According to an embodiment of the present application, if the edge attribute information before the update is the same as the edge attribute information in the enhanced network security knowledge graph, or the difference is very small, it means that the edge attribute information obtained at this time has tended to be stable, and there is no redundant edge attribute information in the enhanced network security knowledge graph. The enhanced network security knowledge graph can be determined as the optimized network security knowledge graph.

[0156] If the edge attribute information before the update is very different from the edge attribute information in the enhanced network security knowledge graph, it means that the edge attribute information obtained at this time is still in an unstable state, and there is redundant edge attribute information in the enhanced network security knowledge graph. At this time, it is also necessary to use graph neural network technology to denoise the enhanced network security knowledge graph to obtain an optimized network security knowledge graph that does not contain redundant edge attribute information.

[0157] In one embodiment, referring to Fig.10 , step 150 comprises:

[0158] Step 1010: Calculate and aggregate the node attribute information of the enhanced network security knowledge graph through a message passing mechanism to obtain node feature information corresponding to each node attribute information in the enhanced network security knowledge graph;

[0159] Step 1020: Perform edge denoising on the enhanced network security knowledge graph based on node feature information to obtain an optimized network security knowledge graph.

[0160] According to an embodiment of the present application, the node attributes of the enhanced network security knowledge graph can be calculated and aggregated through a message passing mechanism to obtain node feature information corresponding to the attribute information of each node in the enhanced network security knowledge graph. In the process of message passing, each node in the enhanced network security knowledge graph extracts features from its adjacent nodes and collects messages from neighboring nodes to update the node feature message of the node itself. Among them, the node feature information is used to describe the characteristics or features of the node.

[0161] Specifically, the node feature information corresponding to each node attribute information in the enhanced network security knowledge graph can be expressed as:

[0162] ;

[0163] in, Indicates the first The node performs the Node feature information during the message transmission; Indicates the first The node performs the Node feature information during the message transmission; represents the activation function; Indicates the first The degree of each node; Represents the degree of the jth node in the enhanced network security knowledge graph; Indicates the first The set of neighbor nodes of a node; Represents the weight matrix corresponding to each node in the enhanced network security knowledge graph.

[0164] Furthermore, after determining the node feature information corresponding to each node attribute information in the enhanced network security knowledge graph, the graph neural network can determine the edge feature information corresponding to the edge attribute information based on the node feature information. Then, the enhanced network security knowledge graph can be subjected to edge denoising based on the node feature information and the edge feature information to remove redundant edge attribute information and redundant node attribute information in the enhanced network security knowledge graph, thereby obtaining a more accurate optimized network security knowledge graph.

[0165] Second, refer to Fig.11 , an embodiment of the present application provides an electronic device, including:

[0166] at least one memory 200;

[0167] at least one processor 100;

[0168] at least one program;

[0169] The program is stored in the memory 200, and the processor 100 executes at least one program to implement:

[0170] A method for constructing a self-feedback network security knowledge graph as in any embodiment of the first aspect of the present application.

[0171] The processor 100 and the memory 200 may be connected via a bus or in other ways.

[0172] The memory 200, as a non-transitory readable storage medium, can be used to store non-transitory software instructions and non-transitory instructables. In addition, the memory 200 may include a high-speed random access memory 200, and may also include a non-transitory memory 200, such as at least one disk storage device 200, a flash memory device, or other non-transitory solid-state storage device 200. It is understood that the memory 200 may optionally include a memory 200 remotely arranged relative to the processor 100, and these remote memories 200 may be connected to the processor 100 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0173] The processor 100 executes non-transitory software instructions, instructions and signals stored in the memory 200, thereby performing various functional applications and data processing, thereby realizing the method for constructing a self-feedback network security knowledge graph of the first aspect embodiment described above.

[0174] The non-transient software instructions and instructions required to implement the method for constructing the self-feedback network security knowledge graph of the above embodiment are stored in the memory 200. When executed by the processor 100, the method for constructing the self-feedback network security knowledge graph of the first aspect of the present application is executed, for example, the above-described Figure 1 Steps S110 to S150 of the method, Figure 2 Steps S210 to S230 of the method, Figure 3 Steps S310 to S340, Figure 4 Steps S410 to S430, Figure 5 Steps S510 to S530, Figure 6 Steps S610 to S630, Figure 7 Steps S710 to S730, Figure 8 Steps S810 to S830, Fig. 9 Steps S910 to S920, Fig.10 Steps S1010 to S1020 in .

[0175] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer-executable signal, and the computer-executable signal is used to execute:

[0176] A method for constructing a self-feedback network security knowledge graph as described in any embodiment of the first aspect of the application.

[0177] For example, executing the above description Figure 1 Steps S110 to S150 of the method, Figure 2 Steps S210 to S230 of the method, Figure 3 Steps S310 to S340, Figure 4 Steps S410 to S430, Figure 5 Steps S510 to S530, Figure 6 Steps S610 to S630, Figure 7 Steps S710 to S730, Figure 8 Steps S810 to S830, Fig. 9 Steps S910 to S920 in Fig.10 Steps S1010 to S1020 in .

[0178] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., may be located in one place, or may be distributed over multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0179] Through the description of the above embodiments, it can be understood by those skilled in the art that all or some steps and systems in the methods disclosed above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a readable medium, which can include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable signals, data structures, instruction modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media generally include computer readable signals, data structures, instruction modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0180] The embodiments of the present application are described in detail above in conjunction with the accompanying drawings, but the present application is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in the relevant technical field without departing from the purpose of the present application.

Claims

1. A method for constructing a self-feedback network security knowledge graph, characterized in that: include: Obtain historical network security data of the target network; Constructing an initial network security knowledge graph based on the historical network security data, wherein the initial network security knowledge graph includes a plurality of node attribute information and a plurality of edge attribute information, wherein the node attribute information is used to indicate each entity in the target network, and the edge attribute information is used to indicate the degree of association between different entities in the target network; At each preset test time interval, the target network is simulated and tested to obtain test security data; the simulation test of the target network to obtain the test security data includes: obtaining multiple simulation test modes, and performing simulation tests on the target network based on the simulation test modes; during the simulation test, attack behavior data, defense behavior data and path selection data are collected; and the attack behavior data, the defense behavior data and the path selection data are integrated into the test security data; At each preset test time interval, the edge attribute information is updated based on the test security data to obtain an enhanced network security knowledge graph; At each preset test time interval, the edge attribute information in the enhanced network security knowledge graph is denoised based on the edge attribute information before the update to obtain an optimized network security knowledge graph; Among them, after the target network is simulated tested at each preset test time interval and the test safety data is obtained, the method for constructing the self-feedback network security knowledge graph also includes: obtaining historical test safety data; constructing a network environment change model corresponding to the target network based on the historical test safety data and the test safety data; predicting the network security environment of the target network using the network environment change model to obtain predicted network environment data; updating the edge attribute information based on the predicted network environment data and the test safety data to obtain an enhanced network security knowledge graph.

2. The method for constructing a self-feedback network security knowledge graph according to claim 1, characterized in that: The obtaining of historical network security data of the target network includes: Extracting network traffic logs, attack event records, user behavior data, and vulnerability data from the backend server of the target network; Standardizing the network traffic log, the attack event record, the user behavior data, and the vulnerability data to obtain first network security data corresponding to the network traffic log, second network security data corresponding to the attack event record, third network security data corresponding to the user behavior data, and fourth network security data corresponding to the vulnerability data; The first network security data, the second network security data, the third network security data and the fourth network security data are integrated to obtain the historical network security data.

3. The method for constructing a self-feedback network security knowledge graph according to claim 1, characterized in that: The constructing an initial network security knowledge graph based on the historical network security data includes: Determine node attribute information and node association information based on the historical network security data, wherein the node association information is used to indicate an association relationship between entities in the target network; Mapping the node attribute information and the node association information into a preset graph structure to obtain a graph model; Acquire historical annotation information and determine edge attribute information of the graph model based on the historical annotation information; The graph model annotated with the edge attribute information is determined as the initial network security knowledge graph.

4. The method for constructing a self-feedback network security knowledge graph according to claim 3 is characterized in that: Determining node attribute information and node association information based on the historical network security data includes: Extracting the node attribute information from the historical network security data using natural language processing technology; Using a named entity recognition algorithm to identify and classify each entity in the node attribute information to obtain a plurality of entity categories and a plurality of entities corresponding to the entity categories; The relationship extraction technology is used to identify the association between entities in each of the entity categories to obtain the node association information.

5. The method for constructing a self-feedback network security knowledge graph according to claim 1, characterized in that: The updating of the edge attribute information based on the test security data to obtain an enhanced network security knowledge graph includes: Preprocessing the test safety data to obtain test feedback information; If the test security data is test security data obtained by performing a first round of simulation test on the target network, the edge attribute information of the initial network security knowledge graph is updated based on the test feedback information to obtain updated edge attribute information; The edge attribute information before the update in the initial network security knowledge graph is replaced by the updated edge attribute information to obtain the enhanced network security knowledge graph.

6. The method for constructing a self-feedback network security knowledge graph according to claim 1, characterized in that: The updating of the edge attribute information based on the test security data to obtain an enhanced network security knowledge graph further includes: Preprocessing the test safety data to obtain test feedback information; If the test security data is not the test security data obtained by performing a first round of simulation test on the target network, updating the edge attribute information of the optimized network security knowledge graph based on the test feedback information to obtain updated edge attribute information; The edge attribute information before the update in the optimized network security knowledge graph is replaced by the updated edge attribute information to obtain the enhanced network security knowledge graph.

7. The method for constructing a self-feedback network security knowledge graph according to claim 5, characterized in that: The test feedback information is an attack path and the number of successful attacks corresponding to the attack path. The preprocessing of the test security data to obtain the test feedback information includes: Extracting each entity in the target network from the test security data; Performing matching processing on the entity extracted from the test security data and the node attribute information in the initial network security knowledge graph to obtain a matching node; An attack path between different matching nodes and the number of successful attacks corresponding to the attack path are determined based on the test security data.

8. The method for constructing a self-feedback network security knowledge graph according to claim 7, characterized in that: The edge attribute information is an edge weight value, and the edge attribute information of the initial network security knowledge graph is updated based on the test feedback information to obtain updated edge attribute information, including: Based on each of the attack paths, the difference between the number of successful attacks corresponding to the attack path and the preset expected number of attacks is used as the attack number difference; The product of the attack number difference and a preset learning rate is used as an adjustment amount, and the updated edge weight value is determined based on the adjustment amount and the edge weight value before updating.

9. The method for constructing a self-feedback network security knowledge graph according to claim 8, characterized in that: The step of performing denoising on the edge attribute information in the enhanced network security knowledge graph based on the edge attribute information before updating to obtain an optimized network security knowledge graph includes: If the edge attribute information before the update is the same as the edge attribute information in the enhanced network security knowledge graph, determining the enhanced network security knowledge graph as the optimized network security knowledge graph; If the edge attribute information before updating is different from the edge attribute information in the enhanced network security knowledge graph, the enhanced network security knowledge graph is denoised using graph neural network technology to obtain an optimized network security knowledge graph.

10. The method for constructing a self-feedback network security knowledge graph according to claim 9, characterized in that: The method of using the graph neural network technology to denoise the enhanced network security knowledge graph to obtain an optimized network security knowledge graph includes: Calculate and aggregate the node attribute information of the enhanced network security knowledge graph through a message passing mechanism to obtain node feature information corresponding to each node attribute information in the enhanced network security knowledge graph; The enhanced network security knowledge graph is subjected to edge denoising processing based on the node feature information to obtain the optimized network security knowledge graph.

11. An electronic device, characterized in that: include: at least one memory; at least one processor; at least one program; The program is stored in the memory, and the processor executes at least one of the programs to implement: A method for constructing a self-feedback network security knowledge graph as described in any one of claims 1 to 10.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions for executing: A method for constructing a self-feedback network security knowledge graph as described in any one of claims 1 to 10.

Images