Intelligent content recommendation method and system for network attack and defense knowledge graph based on reinforcement and completion

Abstract

The invention relates to the technical field of network security, in particular to a network attack and defense knowledge graph intelligent content recommendation method and system based on reinforcement and complementation, and aims to solve the problems of numerous entities and complex relationships in the network attack and defense field, the related knowledge and technologies can be structured and correlated by constructing a network attack and defense knowledge graph, and the network attack and defense knowledge graph intelligent content recommendation method and system can be used for solving the problem of network attack and defense. Therefore, related knowledge and technologies as well as the relationship between the knowledge and the technologies can be better stored and understood; aiming at the problems of incomplete data and inaccurate association in the network attack and defense knowledge graph, the corresponding problems are solved by researching a reinforcement completion method, so that the research and application efficiency and accuracy in the network attack and defense field can be improved; the association recommendation of the network attack and defense knowledge graph is utilized to help security personnel to better understand entities and corresponding strategies in the network attack and defense field and help the security personnel to quickly find related attack chains and defense strategies, so that the capability and the level of security defense are improved, and the method has a better application prospect in the network security protection field.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for intelligent content recommendation of network attack and defense knowledge graph based on enhanced completion. Background Art

[0002] In recent years, global cybersecurity incidents have occurred frequently, and cyberattacks have also involved all walks of life. Faced with the rapid evolution of cyberspace attack and defense methods in today's world, the incomplete knowledge base of cyber attack and defense has seriously affected the monitoring and defense response of cyber attacks. At present, in cyber attack and defense security incidents, massive threat intelligence data is mainly analyzed manually, which is a lot of work. Therefore, it is increasingly important to build a more complete and intelligent cyber attack and defense knowledge base to help security personnel better understand the entities and corresponding strategies in the field of cyber attack and defense. Summary of the invention

[0003] To this end, the present invention provides a method and system for intelligent content recommendation of a network attack and defense knowledge graph based on enhanced completion, which solves the problem of large workload of manual analysis of existing massive threat intelligence data, and analyzes and recommends the relationship between entities in the network attack and defense knowledge graph, which can help security personnel quickly find relevant attack chains and defense strategies, thereby improving the ability and level of security defense.

[0004] According to the design scheme provided by the present invention, on the one hand, a network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion is provided, comprising:

[0005] Determine the attack and defense entity type and the attack and defense entity relationship according to the attack and defense entity attributes in the network attack and defense scenario, establish a network attack and defense entity relationship model according to the attack and defense entity type and the attack and defense entity relationship, and store the attack and defense entity nodes, attack and defense entity node attributes and attack and defense entity relationship in the network attack and defense entity relationship model in the form of a network attack and defense knowledge graph;

[0006] Utilize node intimacy to mine implicit relationships between network attack and defense entity nodes and strengthen and complete the network attack and defense knowledge graph based on implicit relationships, where the implicit relationships between nodes are the intimacy between non-adjacent nodes;

[0007] For the indicator content to be retrieved by the user, the target entity corresponding to the indicator content to be retrieved is located in the network attack and defense knowledge graph and the attack and defense recommended content data related to the target entity is obtained to make related recommendations to the user.

[0008] As a network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion of the present invention, further, the attack and defense entity type and the attack and defense entity relationship are determined according to the attack and defense entity attributes in the network attack and defense scenario, and a network attack and defense entity relationship model is established according to the attack and defense entity type and the attack and defense entity relationship, including:

[0009] Acquire attack dimension data according to a public knowledge base of attack behaviors, wherein the attack dimension data includes an attack entity data set and attack entity attributes;

[0010] The network attack and defense entity relationship data is obtained according to the relationship between different entities in the attack dimension data, and a network attack and defense entity relationship model is constructed. The network attack and defense entity relationship model is used to represent the logical relationship between network attack and defense entities.

[0011] As the network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion of the present invention, further, the attack and defense entity nodes, attack and defense entity node attributes and attack and defense entity relationships in the network attack and defense entity relationship model are stored in the form of a network attack and defense knowledge graph, including:

[0012] Preprocessing the data in the network attack and defense entity relationship model, the preprocessing includes: entity linking, relationship classification and data cleaning, the entity linking is used to map the entities in the model relationship text to the entity list to realize the linking operation on the model relationship text;

[0013] The Neo4j graph database is used to construct a network attack and defense knowledge graph. Each node in the network attack and defense knowledge graph represents a network attack and defense entity. The edge between the nodes represents the relationship between two types of entities. The arrow indicates the direction of the relationship between the entities, and the color indicates the different types of entities or relationships.

[0014] As the network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion of the present invention, further, the implicit relationship between network attack and defense entity nodes is mined by using node intimacy, including:

[0015] Take each entity in the network attack and defense knowledge graph as a node and calculate the intimacy between adjacent nodes in the network attack and defense knowledge graph;

[0016] The intimacy between non-adjacent nodes is obtained based on the intimacy between adjacent nodes and the number of common neighbor nodes between non-adjacent nodes, and the intimacy between non-adjacent nodes is used as the implicit relationship between network attack and defense entity nodes.

[0017] As the network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion of the present invention, further, the intimacy calculation formula between non-adjacent nodes is expressed as: NEdge_ID(i,j)=CN_NUM ij +CNID ij , where NEdge_ID(i,j) represents the intimacy between non-adjacent nodes i and j, CN_NUM ij Indicates the number of common neighbor nodes between node i and node j, CNID ij =∑ x∈N(i)∩N(j)(ID(i,x)+ID(j,x)), ID(i,x) represents the intimacy between adjacent nodes i and x, and degree i 、degree x Represent the degree values ​​of nodes i and x respectively.

[0018] As the intelligent content recommendation method of the network attack and defense knowledge graph based on enhanced completion of the present invention, further, the network attack and defense knowledge graph is enhanced and completed according to the implicit relationship, including:

[0019] When the intimacy of non-adjacent nodes is greater than a specified threshold, the network attack and defense entities corresponding to the non-adjacent nodes are combined into entity pairs, and entity pairs with the same entity type are taken as entity pairs to be strengthened and completed;

[0020] The network attack and defense knowledge graph is enhanced and completed using the entities to be enhanced and completed.

[0021] As a network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion of the present invention, further, locating the target entity corresponding to the index content to be retrieved in the network attack and defense knowledge graph and obtaining the attack and defense recommended content data related to the target entity includes:

[0022] Taking the target entity as the central entity, the content filtering association recommendation algorithm is used to obtain the multilateral related entities in the network attack and defense knowledge graph;

[0023] Based on the multilateral associated entities and according to the specified entity hop count threshold, attack and defense recommended content data related to the target entity is obtained, so as to use the attack and defense recommended content data to make associated recommendations to users.

[0024] As the network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion of the present invention, further, the multilateral associated entities in the network attack and defense knowledge graph are obtained through the content filtering association recommendation algorithm, which also includes:

[0025] The amount of network attack and defense knowledge graph data is obtained. If the amount of network attack and defense knowledge graph data is less than the threshold, the multilaterally associated candidate entities are obtained based on the Apriori algorithm, and the multilaterally associated entities in the network attack and defense knowledge graph are obtained using the promotion ranking.

[0026] Or if the data volume of the network attack and defense knowledge graph is not less than the threshold, the multilaterally associated candidate entities are obtained based on the FP-Tree algorithm, and the multilaterally associated entities in the network attack and defense knowledge graph are obtained using the promotion ranking.

[0027] On the other hand, the present invention also provides a network attack and defense knowledge graph intelligent content recommendation system based on enhanced completion, comprising: a graph construction module, an enhanced completion module and an associated recommendation module, wherein:

[0028] A graph construction module is used to determine the attack and defense entity type and the attack and defense entity relationship based on the attack and defense entity attributes in the network attack and defense scenario, establish a network attack and defense entity relationship model based on the attack and defense entity type and the attack and defense entity relationship, and store the attack and defense entity nodes, attack and defense entity node attributes and attack and defense entity relationships in the network attack and defense entity relationship model in the form of a network attack and defense knowledge graph;

[0029] The enhanced completion module is used to mine the implicit relationship between network attack and defense entity nodes using node intimacy and enhance the completion of the network attack and defense knowledge graph based on the implicit relationship, where the implicit relationship between nodes is the intimacy between non-adjacent nodes;

[0030] The association recommendation module is used to locate the target entity corresponding to the index content to be retrieved in the network attack and defense knowledge graph and obtain the attack and defense recommended content data related to the target entity for the purpose of making association recommendations to the user.

[0031] Beneficial effects of the present invention:

[0032] The present invention uses a knowledge graph to store network attack and defense related knowledge to strengthen the completion and association recommendation of network attack and defense entity relationships. In view of the large number of entities and complex relationships in the field of network attack and defense, by constructing a network attack and defense knowledge graph, the relevant knowledge and technology can be structured and associated, so as to better store and understand the relevant knowledge and technology and the relationship between them; in view of the problems of incomplete data and inaccurate association in the network attack and defense knowledge graph, the efficiency and accuracy of research and application in the field of network attack and defense can be improved by studying the strengthening and completion method to solve the corresponding problems, so as to use the association recommendation of the network attack and defense knowledge graph to help security personnel better understand the entities and corresponding strategies in the field of network attack and defense, and help security personnel quickly find relevant attack chains and defense strategies, so as to improve the ability and level of security defense, and have good application prospects in the field of network protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a schematic diagram of the intelligent content recommendation process of the network attack and defense knowledge graph based on enhanced completion in the embodiment;

[0034] Figure 2 An example of a public knowledge base for attack behaviors in the embodiment;

[0035] Figure 3 This is an example of a network attack and defense entity relationship model in the embodiment;

[0036] Figure 4 This is a schematic diagram of some network attack and defense knowledge graphs in the embodiment;

[0037] Figure 5 This is a schematic diagram of the network attack and defense knowledge graph before enhanced completion of "cloud service discovery" in the embodiment;

[0038] Figure 6 This is a schematic diagram of the network attack and defense knowledge graph after enhanced completion of "cloud service discovery" in the embodiment;

[0039] Figure 7 Schematic diagram of the associated recommendation result based on content filtering in the embodiment;

[0040] Figure 8 This is a schematic diagram of the Apriori algorithm principle in the embodiment;

[0041] Fig. 9 The figure is a schematic diagram of the FP-Tree algorithm principle in the embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0043] In view of the defect that the existing network attack and defense knowledge base is incomplete and has seriously affected the monitoring and defense response to network attacks, the embodiments of the present invention refer to Figure 1 As shown, a network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion is provided, including:

[0044] S101. Determine the attack and defense entity type and the attack and defense entity relationship based on the attack and defense entity attributes in the network attack and defense scenario, establish a network attack and defense entity relationship model based on the attack and defense entity type and the attack and defense entity relationship, and store the attack and defense entity nodes, attack and defense entity node attributes, and attack and defense entity relationships in the network attack and defense entity relationship model in the form of a network attack and defense knowledge graph.

[0045] Specifically, attack dimension data can be obtained based on a public knowledge base of attack behaviors, and the attack dimension data includes an attack entity data set and attack entity attributes; network attack and defense entity relationship data is obtained based on the relationship between different entities in the attack dimension data, and a network attack and defense entity relationship model is constructed. The network attack and defense entity relationship model is used to represent the logical relationship between network attack and defense entities.

[0046] Cybersecurity data is usually stored in a semi-structured format on open and shared Internet websites. According to the cybersecurity dimensions in which it is located, it can be roughly divided into attack, asset, and vulnerability dimensions. Figure 2As shown in the figure, taking the attack behavior knowledge base ATT&CK as an example, the basic attribute information of the attack software entity AADInternals and its relationship information with other entities such as Cloud Service Discovery are displayed. The basic attribute information of the entity includes the entity ID number, type, and applicable platform, while the relationship information with other entities includes: the attack techniques that AADInternals can use.

[0047] For the entity data set under the ATT&CK framework, different entities have different entity attribute key information. In order to avoid the entity attribute key being too redundant, while retaining its key attribute key information, in the embodiment of this case, corresponding attribute key values ​​can be selected according to different entity characteristics, as shown in Table 1:

[0048] Table 1 Entity attribute key values

[0049]

[0050] The meanings of the different attribute keys are as follows:

[0051] (1) Name: The Chinese name of the entity obtained by translating the English name defined in the ATT&CK framework, but for attack software and hacker organizations, their inherent English names are retained. For example, Account Use Policies in the defense strategy is translated as "Account Use Policies", while the attack software SILENTTRINITY retains its English name.

[0052] (2) Attack ID: The organization retains the IDs of different entities in the ATT&CK framework and stores them as entity attribute key information.

[0053] (3) Attack Link: This link retains the entity’s link in the ATT&CK framework, making it easier to query the entity’s detailed information.

[0054] (4) Attack Type: Attack types on entities are mainly divided into three categories: Enterprise, Mobile, and ICS. These three types correspond to the three technical fields under the ATT&CK framework.

[0055] (5) Applicable Platforms: All platforms that the entity is applicable to, such as Windows, Linux, and macOS. By storing applicable platforms, it is possible to match corresponding attack and defense strategies according to different attack scenarios.

[0056] (6) Software Alias / Tactical Alias / Organization Alias: The English name, English abbreviation or professional name of the entity in other contexts. By storing professional names in different contexts, it is possible to achieve the role of entity linking during search.

[0057] (7) Privilege Escalation, Attack Effect, Attack Route, Confidentiality Impact, Integrity Impact, Availability Impact: Description and introduction of vulnerability-related features of this entity in the CVE vulnerability database. By storing the above features, we can understand the vulnerability-related situation in detail and carry out targeted defense.

[0058] (8) Data Sources: Data sources of information related to the data source entity, such as OSINT for open source network intelligence, Cloud Control Plane for cloud control plane, etc.

[0059] Eight types of entities can be selected from the entity data set under the ATT&CK framework, and different entities have different relationships. According to the characteristics of the relationship between different entities, the following eight types of relationships can be selected, including "defense response", "attack", "detection", "adoption", "use", "application", "possession" and "possession strategy". The specific entities and their corresponding relationships are shown in Table 2:

[0060] Table 2 Entity relationship rules

[0061]

[0062] After completing the attribute definition of eight types of network attack and defense entities and extracting the relationships between the eight types of entities, in order to more intuitively reflect the logical relationship between network attack and defense entities and to make the information expression in the network attack and defense knowledge graph clearer, a network attack and defense entity relationship model was established. Figure 3 As shown in the figure. In the network attack and defense entity relationship model, the core part is the attack strategy entity. The data source has a data component, which can detect the enemy's attack strategy in cyberspace in real time. The attack strategy, attack organization and attack software have a strong relationship in this model, which is also in line with the cognition of actual network security issues, that is, a certain attack organization will have a common attack strategy and attack software. For different attack strategies, the attack vulnerabilities and related attack tactics are also different, and the final defense strategy must also change with the change of the attack strategy.

[0063] Specifically, the network attack and defense knowledge graph can be designed to include:

[0064] Preprocessing the data in the network attack and defense entity relationship model, the preprocessing includes: entity linking, relationship classification and data cleaning, the entity linking is used to map the entities in the model relationship text to the entity list to realize the linking operation on the model relationship text;

[0065] The Neo4j graph database is used to construct a network attack and defense knowledge graph. Each node in the network attack and defense knowledge graph represents a network attack and defense entity. The edge between the nodes represents the relationship between two types of entities. The arrow indicates the direction of the relationship between the entities, and the color indicates the different types of entities or relationships.

[0066] The total amount of initial data of model relationships obtained based on web pages is 21,737, including 18,944 relationship data and 2,793 entity data. The entity data mainly involves 8 entity types, including "defense strategy", "attack strategy", "attack software", "attack tactics", "attack organization", "vulnerability", "data source", and "data component". The relationship data mainly involves 8 relationship types, including "defense response", "attack", "detection", "ownership", "ownership strategy", "ownership sub-technology", "use" and blank entries. The specific data volume distribution of 8 entity types and 8 relationship types is shown in Table 3:

[0067] Table 3. Distribution of entity and relationship data volume

[0068]

[0069] Through the quantitative statistics of entity types and relationship types, it can be seen that the amount of data for the "use" relationship is much larger than that for other relationship types. Therefore, a separate analysis was conducted on the data of the "use" relationship type, and it was found that it actually includes three corresponding relationships, namely, the "adoption" relationship between "attack organization" and "attack strategy" mentioned in the network attack and defense entity relationship, the "use" relationship between "attack organization" and "attack software", and the "application" relationship between "attack software" and "attack strategy".

[0070] Entity linking generally refers to the task of associating entity mentions that appear in the natural language text to be processed with the corresponding knowledge graph entity. Since eight entity types have been provided, in this embodiment, it is only necessary to map the representation of the entity in the relational text to the entity list to implement the linking operation of the entity in the relational text. The specific algorithm steps of entity linking can be summarized as follows:

[0071] (1) First, use x and y to store the two types of entity codes involved in the relationship respectively.

[0072] (2) Use the match function to compare the known entity list and use m to store the comparison results.

[0073] (3) If the entity code is not found in the entity list, jump to the next entity and repeat operation (2); if the entity code is found, store the entity name and related information through save, and then jump to the next entity and repeat operation (2).

[0074] The "use" type of relational data in data preparation contains three corresponding relationships. Therefore, further statistical analysis can be performed on these 12,500 data, recording the specific number of each of the three corresponding relationships, and further classifying these three corresponding relationships. During classification, the following problems were found: some entities were not matched to the corresponding entities in the entity list after entity linking. For these unlinked entities, there are also the following three situations: two types of entities in the same relationship do not exist in the entity list, one type of entity in the same relationship exists in the entity list and there is a description of this type of relationship in the relationship list, and one type of entity in the same relationship exists in the entity list but there is no description of this type of relationship in the relationship list. The three situations are shown in Table 4:

[0075] Table 4 Three cases where the "use" relationship does not link entities

[0076]

[0077] For the above three situations, corresponding solutions can be formulated according to their specific characteristics:

[0078] (1) Both entities do not exist in the entity list

[0079] When both entity 1 and entity 2 do not exist in the entity list, although there may be a description of the relationship and it is possible to infer the type of one of the entities, it is impossible to guarantee the precise types of the two entities. Therefore, for this type of situation, direct deletion is chosen.

[0080] (2) A type of entity exists in the entity list and is described in the relationship list

[0081] Taking ② in the above table as an example, the relationship type of entity 2 "spear phishing connection" is "attack strategy". In the description, we can see that there is a field "groups" in its URL and the attack number behind it is "G0086", which means that one of the two entities is of type "hacker organization". Therefore, we can infer that the type of entity 1 is "hacker organization" and the relationship between the two entities is "adoption", that is, "hacker organization-adoption-attack strategy". In addition, by querying the entity list, we can find that the "organization alias" of "Kimsuky" is "Stolen Pencil", so the entity link for entity 1 can also be achieved.

[0082] (3) A type of entity exists in the entity list but is not described in the relationship list

[0083] When entity 1 or entity 2 exists in the entity list but has no description in the relationship list, the entity relationship type cannot be inferred based on the description, but can be inferred based on the characteristics of entity 1 and entity 2. Among the three types of relationships, "adopt", "apply", and "use", when "attack software" is in the position of entity 1, it must be an "apply" relationship, and when "attack software" is in the position of entity 2, it must be a "use" relationship. Other situations cannot be judged.

[0084] According to the classification standards of the three types of relationships and the above solutions, Python code was written to classify and analyze the data of 12,500 "use" relationship types. In the end, 361 relationships could not be judged as they did not meet the conditions. For the other 12,139 data that can be judged, 8,402 are "application" relationships, 2,942 are "adoption" relationships, and 795 are "use" relationships.

[0085] For invalid data in the original data, and for data that is meaningless under existing rules after the entity attributes and relationships are defined, a unified review and verification can be performed, specifically:

[0086] (1) Blank relations: There are 48 blank relations in the data preparation. After entity linking, it is found that the entities in the blank relation list cannot be found in the entity list. At the same time, there is no corresponding description statement for the blank relation entry. Therefore, the blank relation entry can be deleted as a whole.

[0087] (2) "Owns sub-technology" relationship: The purpose of introducing the sub-technology concept into the ATT&CK framework is to make the technical abstraction level of the entire knowledge base belong to the same level, control the number of technologies to a manageable level, and avoid explosive growth. In this embodiment, the 386 "Owns sub-technology" relationships can be deleted.

[0088] (3) “Use” relationships: Among the “use” relationships mentioned in the individual data processing, 361 relationships did not meet the conditions and could not be determined as specific relationship types, so they were deleted.

[0089] (4) Entity linking failed relationship entries. In the entity linking, the Chinese name links involving garbled entities in all relationship entries are completed. After entity linking, it is found that there are 588 relationships involving some entities that cannot be found in the entity list. Therefore, these relationship entries involved can be defined as entity linking failed relationship entries, and they are deleted as a whole.

[0090] After completing entity linking, data classification and the above-mentioned data cleaning operations, there is still some duplicate data. However, since the data volume is not large and the Neo4j graph database is used to import data, the merging operation in the network attack and defense map can be achieved by writing Python code.

[0091] Neo4j graph database is an open source NoSQL database implemented by Java. It is a graph database built from the bottom up. Its architecture well realizes the rapid management, storage and traversal of nodes and their relationships in the optimized graph database. It successfully converts the exponential performance degradation caused by the connection operation of "relationship" between different tables into a linear degradation, and realizes the storage of professional graph data models. The knowledge storage in the network attack and defense knowledge graph in the form of triples ensures its storage and management of entity data based on relationships. When importing data, the embodiment of this case generally adopts the form of triples. There are three main commonly used ways to import knowledge into Neo4j: one-by-one import based on Cypher statements; LOADCSV statements based on Cypher statements; neo4j-import method based on Python statements. Due to the existence of a large number of nodes and complex relationships, the third method can be selected, by calling the py2neo library, in the form of {start_node, relation, end_node} triples, to complete the import of nodes and their relationships in the database.

[0092] Since there are too many nodes in the network attack and defense graph and the relationships between the nodes are too complex, we can choose to extract some of the nodes and relationships to reflect the established network attack and defense entity relationship model, so as to avoid the excessive degree of node aggregation when all nodes and relationships are presented, which affects the observation and analysis of the network attack and defense graph. 65 nodes and 78 relationships can be selected to reflect the established network attack and defense entity relationship model. The selected network attack and defense knowledge graph is as follows: Figure 4As shown in the figure, each node represents a network attack and defense entity, the line between the nodes represents the relationship between the two types of entities, the arrow indicates that the relationship is directed, and different colors represent different types of entities or relationships. The correspondence between specific colors and entities or relationships is shown in the legend in the figure above. It can be seen from the figure that the entities and their relationships in the graph are very complex, but the purpose of constructing a network attack and defense entity relationship model and establishing a network attack and defense knowledge graph is not to view the entire graph, but to make the relationship between each network attack and defense entity and its relationship clearer, and to provide a framework for analysis and query when facing network threat scenarios. When using the Neo4j graph database to store entities, the attributes of the entities can also be stored and queried separately.

[0093] By building a network attack and defense knowledge graph, relevant security personnel and users can efficiently analyze the network security threats they face. When using the Cypher language in the Neo4j graph database for querying, the network attack and defense entity relationship model is fully utilized to analyze the network attack links suffered by users, including attack software, hacker organizations, and data sources, so as to use targeted defense strategies for defense response, reduce the losses caused by network security threats, and achieve the purpose of protecting user network security.

[0094] S102. Utilize node intimacy to mine implicit relationships between network attack and defense entity nodes and enhance and complete the network attack and defense knowledge graph based on the implicit relationships, wherein the implicit relationships between nodes are the intimacy between non-adjacent nodes.

[0095] Specifically, each entity in the network attack and defense knowledge graph can be regarded as a node, and the intimacy between adjacent nodes in the network attack and defense knowledge graph can be calculated; the intimacy between non-adjacent nodes can be obtained based on the intimacy between adjacent nodes and the number of common neighbor nodes between non-adjacent nodes, and the intimacy between non-adjacent nodes can be used as the implicit relationship between network attack and defense entity nodes.

[0096] According to network science theory, the more common neighbors a node has, the greater the possibility that there is a connection between the nodes. Based on this, node intimacy can be positioned as: the number of common neighbors between non-adjacent nodes in the same network. The larger the node intimacy value, the greater the degree of closeness, and the greater the probability that there is a connection between the two. In addition, the larger the degree value of a node, the smaller the intimacy between the node and its neighboring nodes tends to be. For this reason, in the embodiment of this case, when calculating the node intimacy, the influence of the degree value of its neighboring nodes is also considered, and the node intimacy calculation method is used to mine the implicit relationship between nodes in the network, so as to achieve the purpose of strengthening and completing the graph.

[0097] Assuming that the defense strategy entity "locking the boot loader" and the attack strategy entity "modifying the operating system kernel or boot partition" are adjacent nodes in the network, although there is an explicit "defense response" relationship between the two, there is no need to reason about their implicit relationship to complete the enhanced completion of the graph. However, since the calculation of the intimacy of non-adjacent nodes involves the calculation of the intimacy of adjacent nodes, the calculation formula for the intimacy of adjacent nodes can be expressed as follows:

[0098]

[0099] In the above formula, ID(i,x) represents the intimacy value between node i and node x, and the specific calculation expression means the ratio of the number of common neighbor nodes to the product of their respective degree values. The purpose of adding "1" to the number of common neighbor nodes in the calculation formula is to avoid the appearance of the value "0", because from the macro perspective of network attack and defense, it can only be said that the relationship between the two types of network attack and defense entities is not close, and it is difficult to judge them as having no connection. The purpose of taking the square root of the degree values ​​of the two nodes is to weaken the influence of the degree values ​​on the calculation, because the degree values ​​of some nodes are relatively large. If the square root is not taken, these nodes will be at the end of the final intimacy ranking. In this case, the importance of degree values ​​to nodes in the network will be considered in the implementation example.

[0100] Assume that the attack strategy entity "Endpoint Denial of Service" has an "attack" relationship with the two vulnerability entities "CVE-2009-4017" and "CVE-2009-2054", that is, "Endpoint Denial of Service" is a common neighbor of the two vulnerability entities. For the calculation of intimacy between non-adjacent nodes such as two vulnerability entities, it is necessary to calculate their intimacy based on the number of their common neighbors and the characteristics of the corresponding neighbor nodes. The higher the intimacy, the closer the relationship between the two non-adjacent nodes, the more likely they are to have a corresponding implicit relationship, and the more likely they are to become the object of enhanced completion. The calculation formula for the intimacy of non-adjacent nodes can be expressed as follows:

[0101] NEdge_ID(i,j)=CD_NUM ij +CNID ij (2)

[0102]

[0103] In the above formula (2), NEdge_ID(i,j) represents the intimacy between non-adjacent nodes i and j, which mainly consists of two parts: one is the number of common neighbor nodes of nodes i and j, and the other is CNID ij From formula (3), we can see that CNID ijis the sum of all common neighbors of node i and node j and their respective intimacy. Not only the number of common neighbor nodes is taken into account, but also the characteristics of common neighbor nodes, that is, the intimacy between common neighbor nodes and corresponding nodes. This means that between two non-adjacent nodes, only when the number of common neighbor nodes is larger and the relationship with the neighbor nodes is closer, the two non-adjacent nodes are more likely to be connected, and are more likely to become the target of strengthening and completing the knowledge graph.

[0104] The enhanced completion algorithm based on node intimacy mainly uses the knowledge related to network science, regards each entity in the network attack and defense knowledge graph as a node, calculates the intimacy between nodes according to the corresponding rules, selects node pairs with higher intimacy, and realizes the enhanced completion of the network attack and defense knowledge graph. The relevant main code is shown in Code 1:

[0105]

[0106] The above enhanced completion algorithm based on node intimacy can be summarized as follows:

[0107] (1) First, use the adjacency matrix to store the relationships between corresponding nodes, and then build the network G based on these relationships.

[0108] (2) Find the number of common neighbor nodes of each node pair in the network G, and record the specific node codes of these common neighbors. The number of common neighbor nodes is stored in Neighbor_num, and the common neighbors are recorded in Neighbor_common.

[0109] (3) Calculate the intimacy of the corresponding node pairs according to the node intimacy calculation rules.

[0110] By calculating the intimacy of the nodes, when the intimacy of the nodes is greater than 40, the intimacy relationship is relatively high. 494 pairs of entities with close relationships are obtained, from which 10 representative entity pairs are selected for display analysis. The specific situation is shown in Table 6:

[0111] Table 6 Partially enhanced entity pairs

[0112]

[0113] By analyzing the above table, we know that among the entity pairs obtained by calculating the node intimacy, most of the entity pairs with higher intimacy are of the same type, such as "DLL side loading" and "service file permission weakness" are both "attack strategy" type entities, because the relationship between entities of the same type is more likely to be closer than that between entities of different types. However, there are also entity pairs composed of entities of the "attack tactics" type of "lateral movement" and the "data component" type of "under metadata". Although the relationship between the two is relatively close, one is that they do not belong to the eight types of relationships in the network attack and defense entity relationship model, and the other is that the amount of relationship data of this type is relatively small, which is of little significance to the completion of the graph and subsequent research. Therefore, in the embodiment of this case, such data and similar types of data are chosen to be ignored.

[0114] Through analysis, it can be found that by calculating the intimacy of node pairs, a large number of entity pairs with close relationships and the same entity type can be obtained, such as "Windows Management Specifications" and "Container Management Commands" are both entities of attack strategy type, which shows that these two types of attack strategies are very likely to appear together or have a large connection, which is of great significance for user query analysis. Therefore, in the embodiment of this case, after calculating the intimacy of node pairs, entity pairs with the same entity type are selected to complete the enhanced completion of the network attack and defense knowledge graph.

[0115] Taking the “Attack Strategy” entity of “Cloud Service Discovery” as an example, its relationship with the surrounding entity nodes before strengthening and completing the network attack and defense knowledge graph is as follows: Figure 5 As shown in the figure. After calculating the same type of entities with high intimacy with "Cloud Service Discovery" through the node intimacy-based enhanced completion algorithm, the relationship between them is imported and completed through the LOAD CSV method. In the graph, the enhanced completion relationship is defined as "same_as", which is represented by a bold green line. The relationship between "Cloud Service Discovery" and the surrounding entity nodes after the enhanced completion of the network attack and defense knowledge graph is shown in the figure. Figure 6 shown.

[0116] S103. For the index content to be retrieved by the user, locate the target entity corresponding to the index content to be retrieved in the network attack and defense knowledge graph and obtain the attack and defense recommended content data related to the target entity to make related recommendations to the user.

[0117] Specifically, the target entity can be used as the central entity, and the multilateral associated entities in the network attack and defense knowledge graph can be obtained through the content filtering association recommendation algorithm; based on the multilateral associated entities and according to the specified entity hop count threshold, the attack and defense recommended content data related to the target entity can be obtained, so as to use the attack and defense recommended content data to make association recommendations to users.

[0118] You can use the relevant commands in the Cypher statement in Neo4j. Taking the located entity as the central entity, the multilateral related entities of the central entity in the network attack and defense knowledge graph are obtained through the content filtering-based related recommendation method, and then related recommendations are made according to the hop limit. For example, through the content-based related recommendation method, the other entity relationship graphs that have related relationships within four hops of the "attack strategy" type entity "bit attack" are retrieved, and the related entity related recommendations are obtained as follows: Figure 7 As shown in the figure, it fully reflects the advantages of association recommendation based on the knowledge graph structure and is more in line with the network attack and defense entity relationship model.

[0119] Among them, bit attacks usually refer to the attack organization taking advantage of loopholes or weaknesses in the computer system to attack the system through specific technical means in order to obtain illegal access rights, tamper with data or disrupt the normal operation of the system. This attack method can involve many aspects, including but not limited to data-driven attacks, forged information attacks, attacks on information protocol weaknesses, remote manipulation, etc.

[0120] Among them, obtaining multilateral related entities in the network attack and defense knowledge graph through content filtering and association recommendation algorithm can also include:

[0121] The amount of network attack and defense knowledge graph data is obtained. If the amount of network attack and defense knowledge graph data is less than the threshold, the multilaterally associated candidate entities are obtained based on the Apriori algorithm, and the multilaterally associated entities in the network attack and defense knowledge graph are obtained using the promotion ranking.

[0122] Or if the data volume of the network attack and defense knowledge graph is not less than the threshold, the multilaterally associated candidate entities are obtained based on the FP-Tree algorithm, and the multilaterally associated entities in the network attack and defense knowledge graph are obtained using the promotion ranking.

[0123] For network attack and defense knowledge graphs with small data volumes, the association recommendation method based on the Apriori algorithm is implemented. The algorithm is relatively simple to implement and has good association recommendation effects. It is very suitable for association recommendation sorting of small data volumes. The algorithm flow is as follows: Figure 8 As shown in the figure, its core principle is to connect and prune a large number of data item sets in the database through an iterative method of layer-by-layer search, so as to find the association between each data item set in the database. Among them, the frequency of the item set is defined by the number of things containing the item set. A data set containing K items is usually called a K-item set, and a data item set that meets the minimum support is generally called a frequent item set. Its main code is shown in Algorithm 2:

[0124]

[0125]

[0126] Through the association recommendation method based on the Apriori algorithm, the association recommendation results of the "menuPass" "attack organization" type entity and the "attack software" type entity with the "use" relationship are obtained. Some of the association recommendation results are ranked by the improvement degree as shown in Table 7:

[0127] Table 7. Association recommendation results of “menuPass” based on Apriori algorithm

[0128]

[0129] For network attack and defense knowledge graphs with large amounts of data, the associated recommendation algorithm based on the FP-Tree algorithm can be implemented. The implementation of this algorithm is relatively complex, but when the amount of data is large, the associated recommendation speed is faster and the effect is better. It is very suitable for the associated recommendation sorting of large amounts of data. The algorithm flow is as follows: Fig. 9 As shown in the figure, the FP-Tree algorithm is an association rule mining algorithm that uses a compact tree structure to store and query all the information of frequent item sets. Since in the process of FP-Tree construction, only two scans of the database are required and the database is directly compressed into a frequent item set tree, it makes up for the shortcomings of Apriori, so it is widely used in data association rule mining. The main code can be shown in Algorithm 3:

[0130]

[0131] Through the association recommendation method based on the FP-Tree algorithm, the association recommendation results of the "unsecured credentials" "attack strategy" entity for the "defense response" relationship "defense strategy" entity are obtained. Some of the association recommendation results are ranked by the degree of improvement as shown in Table 8:

[0132] Table 8: Association recommendation results of “unsecured vouchers” based on FP-Tree algorithm

[0133]

[0134]

[0135] Furthermore, based on the above method, an embodiment of the present invention also provides a network attack and defense knowledge graph intelligent content recommendation system based on enhanced completion, comprising: a graph construction module, an enhanced completion module and an associated recommendation module, wherein:

[0136] A graph construction module is used to determine the attack and defense entity type and the attack and defense entity relationship based on the attack and defense entity attributes in the network attack and defense scenario, establish a network attack and defense entity relationship model based on the attack and defense entity type and the attack and defense entity relationship, and store the attack and defense entity nodes, attack and defense entity node attributes and attack and defense entity relationships in the network attack and defense entity relationship model in the form of a network attack and defense knowledge graph;

[0137] The enhanced completion module is used to mine the implicit relationship between network attack and defense entity nodes using node intimacy and enhance the completion of the network attack and defense knowledge graph based on the implicit relationship, where the implicit relationship between nodes is the intimacy between non-adjacent nodes;

[0138] The association recommendation module is used to locate the target entity corresponding to the index content to be retrieved in the network attack and defense knowledge graph and obtain the attack and defense recommended content data related to the target entity for the purpose of making association recommendations to the user.

[0139] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0140] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0141] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0142] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0143] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion, characterized in that: Include: Determine the attack and defense entity type and the attack and defense entity relationship according to the attack and defense entity attributes in the network attack and defense scenario, establish a network attack and defense entity relationship model according to the attack and defense entity type and the attack and defense entity relationship, and store the attack and defense entity nodes, attack and defense entity node attributes and attack and defense entity relationship in the network attack and defense entity relationship model in the form of a network attack and defense knowledge graph; Utilize node intimacy to mine implicit relationships between network attack and defense entity nodes and strengthen and complete the network attack and defense knowledge graph based on implicit relationships, where the implicit relationships between nodes are the intimacy between non-adjacent nodes; For the indicator content to be retrieved by the user, the target entity corresponding to the indicator content to be retrieved is located in the network attack and defense knowledge graph and the attack and defense recommended content data related to the target entity is obtained to make related recommendations to the user.

2. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 1 is characterized in that: Determine the attack and defense entity type and the attack and defense entity relationship based on the attack and defense entity attributes in the network attack and defense scenario, and establish a network attack and defense entity relationship model based on the attack and defense entity type and the attack and defense entity relationship, including: Acquire attack dimension data according to a public knowledge base of attack behaviors, wherein the attack dimension data includes an attack entity data set and attack entity attributes; The network attack and defense entity relationship data is obtained according to the relationship between different entities in the attack dimension data, and a network attack and defense entity relationship model is constructed. The network attack and defense entity relationship model is used to represent the logical relationship between network attack and defense entities.

3. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 1 is characterized in that: The attack and defense entity nodes, attack and defense entity node attributes, and attack and defense entity relationships in the network attack and defense entity relationship model are stored in the form of a network attack and defense knowledge graph, including: Preprocessing the data in the network attack and defense entity relationship model, the preprocessing includes: entity linking, relationship classification and data cleaning, the entity linking is used to map the entities in the model relationship text to the entity list to realize the linking operation on the model relationship text; The Neo4j graph database is used to construct a network attack and defense knowledge graph. Each node in the network attack and defense knowledge graph represents a network attack and defense entity. The edge between the nodes represents the relationship between two types of entities. The arrow indicates the direction of the relationship between the entities, and the color indicates the different types of entities or relationships.

4. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 1 is characterized in that: Using node intimacy to mine implicit relationships between network attack and defense entity nodes, including: Take each entity in the network attack and defense knowledge graph as a node and calculate the intimacy between adjacent nodes in the network attack and defense knowledge graph; The intimacy between non-adjacent nodes is obtained based on the intimacy between adjacent nodes and the number of common neighbor nodes between non-adjacent nodes, and the intimacy between non-adjacent nodes is used as the implicit relationship between network attack and defense entity nodes.

5. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 1 or 4, characterized in that: The calculation formula for the intimacy between non-adjacent nodes is expressed as: NEdge_ID(i,j)=CN_NUM ij +CNID ij , where NEdge_ID(i,j) represents the intimacy between non-adjacent nodes i and j, CN_NUM ij Indicates the number of common neighbor nodes between node i and node j, CNID ij =∑ x∈N(i)∩N(j) (ID(i,x)+ID(j,x)), ID(i,x) represents the intimacy between adjacent nodes i and x, and degree i 、degree x Represent the degree values ​​of nodes i and x respectively.

6. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 1 or 4, characterized in that: Strengthen and complete the network attack and defense knowledge graph based on implicit relationships, including: When the intimacy of non-adjacent nodes is greater than a specified threshold, the network attack and defense entities corresponding to the non-adjacent nodes are combined into entity pairs, and entity pairs with the same entity type are taken as entity pairs to be strengthened and completed; The network attack and defense knowledge graph is enhanced and completed using the entities to be enhanced and completed.

7. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 1 is characterized in that: Locate the target entity corresponding to the index content to be retrieved in the network attack and defense knowledge graph and obtain the attack and defense recommended content data related to the target entity, including: Taking the target entity as the central entity, the content filtering association recommendation algorithm is used to obtain the multilateral related entities in the network attack and defense knowledge graph; Based on the multilateral associated entities and according to the specified entity hop count threshold, attack and defense recommended content data related to the target entity is obtained, so as to use the attack and defense recommended content data to make associated recommendations to users.

8. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 7 is characterized in that: The content filtering and association recommendation algorithm is used to obtain the multilateral association entities in the network attack and defense knowledge graph, which also includes: The amount of network attack and defense knowledge graph data is obtained. If the amount of network attack and defense knowledge graph data is less than the threshold, the multilaterally associated candidate entities are obtained based on the Apriori algorithm, and the multilaterally associated entities in the network attack and defense knowledge graph are obtained using the promotion ranking.

9. The network attack and defense knowledge graph intelligent content recommendation method based on enhanced completion according to claim 7 or 8, characterized in that: The content filtering and association recommendation algorithm is used to obtain the multilateral association entities in the network attack and defense knowledge graph, which also includes: The amount of network attack and defense knowledge graph data is obtained. If the amount of network attack and defense knowledge graph data is not less than the threshold, the multilaterally associated candidate entities are obtained based on the FP-Tree algorithm, and the multilaterally associated entities in the network attack and defense knowledge graph are obtained using the promotion ranking.

10. An intelligent content recommendation system for network attack and defense knowledge graph based on enhanced completion, characterized in that: It includes: graph construction module, enhanced completion module and related recommendation module, among which: A graph construction module is used to determine the attack and defense entity type and the attack and defense entity relationship based on the attack and defense entity attributes in the network attack and defense scenario, establish a network attack and defense entity relationship model based on the attack and defense entity type and the attack and defense entity relationship, and store the attack and defense entity nodes, attack and defense entity node attributes and attack and defense entity relationships in the network attack and defense entity relationship model in the form of a network attack and defense knowledge graph; The enhanced completion module is used to mine the implicit relationship between network attack and defense entity nodes using node intimacy and enhance the completion of the network attack and defense knowledge graph based on the implicit relationship, where the implicit relationship between nodes is the intimacy between non-adjacent nodes; The association recommendation module is used to locate the target entity corresponding to the index content to be retrieved in the network attack and defense knowledge graph and obtain the attack and defense recommended content data related to the target entity for the purpose of making association recommendations to the user.

Images