Network security vulnerability detection method, device, terminal equipment and medium based on knowledge graph

Abstract

The present application discloses a network security vulnerability detection method, device, terminal device and medium based on knowledge graph, including: obtaining a time series knowledge graph of a vulnerability; determining the security level corresponding to the vulnerability according to a pre-trained vulnerability detection model and a time series knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the time series knowledge graph of the sample vulnerability, the pre-trained vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a time series decoder, and the pre-trained vulnerability detection model is determined according to the correlation and dependency of the entity and relationship nodes of the time series knowledge graph of the vulnerability. The present application more effectively captures the correlation of entities and relationship nodes and long-term time dependencies, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and in particular, relates to a network security vulnerability detection method, device, terminal equipment and medium based on knowledge graph. Background Art

[0002] As the complexity of software systems increases, software vulnerabilities have become a major threat to network security, which may lead to data leakage, system crashes, and service interruptions. Traditional vulnerability assessment methods usually focus on the analysis of single vulnerabilities, ignoring the temporal correlation between vulnerabilities and the possibility of coordinated attacks. In actual security attack and defense scenarios, attackers often use a combination of multiple vulnerabilities to carry out complex attacks, that is, joint exploitation behavior. The closest existing technologies include the following:

[0003] 1. Knowledge graph: Knowledge graph constructs entity, attribute and relationship triples to show the correlation between vulnerabilities, providing support for vulnerability correlation analysis and collaborative protection. However, existing network security vulnerability analysis methods based on knowledge graphs have problems such as incomplete knowledge representation, limitation of relational reasoning and insufficient time perception.

[0004] 2. Temporal Knowledge Graph (TKG): TKG integrates the time dimension to represent the static relationship between vulnerabilities and the dynamic process that evolves over time, providing the possibility for a deep understanding of the correlation and coordinated attack mechanism of vulnerabilities. However, existing TKG methods are insufficient in capturing the correlation and long-term temporal dependencies between entity and relationship nodes.

[0005] 3. Transformer model: The Transformer model processes sequence data through the self-attention mechanism and has been successful in many fields. It is used to process images, videos, and time series data, but its application in the field of network security, especially in processing nodes with long history, has not yet fully utilized its capabilities.

[0006] Existing technologies have the following main shortcomings and problems in network security knowledge graph reasoning and vulnerability assessment:

[0007] 1. Single vulnerability analysis: Traditional vulnerability assessment methods often focus only on the analysis of a single vulnerability, ignoring the temporal correlation between vulnerabilities and the possibility of coordinated attacks. This limitation is because these methods do not take into account the actual situation that attackers may exploit multiple vulnerabilities to carry out complex attacks.

[0008] 2. Incomplete knowledge representation: Existing network security vulnerability analysis methods based on knowledge graphs have incomplete knowledge representation and cannot fully capture the correlation between vulnerabilities. This is due to the incomplete information when constructing the knowledge graph or the limitations of the data source.

[0009] 3. Limitations of relational reasoning: Existing methods have limitations in relational reasoning, making it difficult to capture and analyze deep connections between vulnerabilities. This may be because these methods lack effective mechanisms to model and reason about complex relationships between vulnerabilities.

[0010] 4. Insufficient time perception: Although the temporal knowledge graph (TKG) takes the time dimension into account, existing methods are still insufficient in terms of time perception and fail to effectively capture the dynamic process of vulnerability evolution over time. This may be due to the lack of ability of these methods to effectively process time series data.

[0011] 5. Insufficient capture of entity and relationship node correlation: Existing methods are insufficient in capturing the correlation between entity and relationship nodes and fail to fully utilize the interaction information between nodes. This may be because these methods lack effective algorithms to process and analyze these complex interaction relationships.

[0012] 6. Inadequate processing of long-term temporal dependencies: When dealing with long-term historical interactions, existing methods face the problem of gradient vanishing or exploding, and have difficulty capturing long-term temporal dependencies. This may be due to the fact that these methods fail to fully consider the characteristics of time series data when designing.

[0013] 7. Transformer capabilities are not fully utilized: Although the Transformer model performs well in processing sequence data, its capabilities have not been fully utilized in the field of network security, especially in processing nodes with long history. This may be due to the lack of model customization and optimization for specific domain requirements.

[0014] These shortcomings and problems are mainly caused by the fact that the algorithms and model designs of existing technologies fail to fully consider the specific needs of the network security field, as well as the limitations in processing complex, dynamic and large-scale data. As network attack methods continue to evolve, existing technologies need to be further improved to adapt to new challenges. Therefore, how to improve the accuracy and efficiency of vulnerability detection is an urgent problem to be solved. Summary of the invention

[0015] The present application aims to provide a network security vulnerability detection method, apparatus, terminal device and storage medium based on knowledge graph to solve the deficiencies in the prior art. The technical problem to be solved by the present application is achieved through the following technical solution.

[0016] In a first aspect, an embodiment of the present application provides a network security vulnerability detection method based on a knowledge graph, the method comprising:

[0017] Obtain the time series knowledge graph of vulnerabilities;

[0018] According to a pre-trained vulnerability detection model and the temporal knowledge graph of the vulnerability, the security level corresponding to the vulnerability is determined, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the temporal knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder, and the pre-trained vulnerability detection model is determined based on the correlation and dependency between the entity and relationship nodes of the temporal knowledge graph of the vulnerability.

[0019] Optionally, the pre-trained vulnerability detection model is obtained in the following manner:

[0020] Obtain the time series knowledge graph of sample vulnerabilities;

[0021] Based on the entity encoding module, encode the entities in the temporal knowledge graph of the sample vulnerability to obtain weighted entity information;

[0022] Based on the relationship encoding module, the relationship in the temporal knowledge graph of the sample vulnerability is encoded to obtain relationship representation information;

[0023] Based on the joint sequence encoding module, the weighted entity information and the relationship representation information are encoded to obtain time-aware entity and relationship representation data;

[0024] According to the time-aware entity and relationship representation data, the parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module are trained to obtain the vulnerability detection model.

[0025] Optionally, encoding entities in the temporal knowledge graph of the sample vulnerability based on the entity encoding module to obtain weighted entity information includes:

[0026] Determine a fusion reward and a frequency reward based on the distance and frequency information between entities in the knowledge graph of the sample vulnerability;

[0027] According to the fusion reward and the frequency reward, the attention weight is adjusted to obtain an adjusted multi-head attention mechanism;

[0028] According to the adjusted multi-head attention mechanism, entities in the temporal knowledge graph of the sample vulnerability are encoded to obtain weighted entity information.

[0029] Optionally, the distance reward includes: assigning a higher weight to neighbors closer to the target entity through an attention decay mechanism to capture the proximity between entities;

[0030] The frequency reward includes weighting frequently appearing neighbor nodes through a frequency compensation mechanism to avoid interference from high-frequency irrelevant nodes.

[0031] Optionally, encoding the relationship in the temporal knowledge graph of the sample vulnerability based on the relationship encoding module to obtain relationship representation information includes:

[0032] Through the relationship graph of the pre-established topological pattern, the relationship in the temporal knowledge graph of the sample vulnerability is encoded to obtain relationship representation information.

[0033] Optionally, encoding the weighted entity information and the relationship representation information based on the joint sequence encoding module to obtain time-aware entity and relationship representation data includes:

[0034] The weighted entity information and the relationship representation information are encoded using a Transformer architecture to obtain time-aware entity and relationship representation data, wherein the Transformer architecture includes: multi-head self-attention and a feedforward network.

[0035] Optionally, the training of parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module according to the time-aware entity and relationship representation data to obtain the vulnerability detection model includes:

[0036] Calculating loss functions corresponding to the entity encoding module, the relationship encoding module and the joint sequence encoding module respectively;

[0037] According to the loss function, updating parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module;

[0038] If the loss function meets the preset requirements, the vulnerability detection model is obtained.

[0039] In a second aspect, an embodiment of the present application provides a network security vulnerability detection device based on a knowledge graph, the device comprising:

[0040] The acquisition module is used to obtain the time series knowledge graph of vulnerabilities;

[0041] A detection module is used to determine the security level corresponding to the vulnerability based on a pre-trained vulnerability detection model and the temporal knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the temporal knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model at least includes an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder, and the pre-trained vulnerability detection model is determined based on the correlation and dependency between the entity and relationship nodes of the temporal knowledge graph of the vulnerability.

[0042] Optionally, the device further comprises an establishing module, wherein the establishing module is configured to:

[0043] Obtain the time series knowledge graph of sample vulnerabilities;

[0044] Based on the entity encoding module, encode the entities in the temporal knowledge graph of the sample vulnerability to obtain weighted entity information;

[0045] Based on the relationship encoding module, the relationship in the temporal knowledge graph of the sample vulnerability is encoded to obtain relationship representation information;

[0046] Based on the joint sequence encoding module, the weighted entity information and the relationship representation information are encoded to obtain time-aware entity and relationship representation data;

[0047] According to the time-aware entity and relationship representation data, the parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module are trained to obtain the vulnerability detection model.

[0048] Optionally, the establishing module is used to:

[0049] Determine a fusion reward and a frequency reward based on the distance and frequency information between entities in the knowledge graph of the sample vulnerability;

[0050] According to the fusion reward and the frequency reward, the attention weight is adjusted to obtain an adjusted multi-head attention mechanism;

[0051] According to the adjusted multi-head attention mechanism, entities in the temporal knowledge graph of the sample vulnerability are encoded to obtain weighted entity information.

[0052] Optionally, the distance reward includes: assigning a higher weight to neighbors closer to the target entity through an attention decay mechanism to capture the proximity between entities;

[0053] The frequency reward includes weighting frequently appearing neighbor nodes through a frequency compensation mechanism to avoid interference from high-frequency irrelevant nodes.

[0054] Optionally, the establishing module is used to:

[0055] Through the relationship graph of the pre-established topological pattern, the relationship in the temporal knowledge graph of the sample vulnerability is encoded to obtain relationship representation information.

[0056] Optionally, the establishing module is used to:

[0057] The weighted entity information and the relationship representation information are encoded using a Transformer architecture to obtain time-aware entity and relationship representation data, wherein the Transformer architecture includes: multi-head self-attention and a feedforward network.

[0058] Optionally, the establishing module is used to:

[0059] Calculating loss functions corresponding to the entity encoding module, the relationship encoding module and the joint sequence encoding module respectively;

[0060] According to the loss function, updating parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module;

[0061] If the loss function meets the preset requirements, the vulnerability detection model is obtained.

[0062] In a third aspect, an embodiment of the present application provides a terminal device, including: at least one processor and a memory;

[0063] The memory stores a computer program; the at least one processor executes the computer program stored in the memory to implement the knowledge graph-based network security vulnerability detection method provided in the first aspect.

[0064] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed, the knowledge graph-based network security vulnerability detection method provided in the first aspect is implemented.

[0065] The embodiments of the present application include the following advantages:

[0066] The knowledge graph-based network security vulnerability detection method, apparatus, terminal device and medium provided in the embodiments of the present application obtain a time series knowledge graph of the vulnerability; determine the security level corresponding to the vulnerability according to a pre-trained vulnerability detection model and the time series knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the time series knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity coding module, a relationship coding module, a joint sequence coding module and a time series decoder, and the pre-trained vulnerability detection model is determined according to the correlation and dependency between the entities and relationship nodes of the time series knowledge graph of the vulnerability. The embodiments of the present application provide an entity coding module tBGAT, a relationship coding module REN, a joint sequence coding module Former and a time series decoder to more effectively capture the correlation between entities and relationship nodes and long-term time dependencies, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present application or the existing technical solutions, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0068] Figure 1 This is a flow chart of a network security vulnerability detection method based on a knowledge graph in one embodiment of the present application;

[0069] Figure 2 This is an example of a common use behavior in an embodiment of the present application;

[0070] Figure 3 This is a TCGFormer model framework diagram in one embodiment of the present application;

[0071] Figure 4 This is a sample of the VulKG dataset in one embodiment of this application;

[0072] Figure 5 The impact of the number of tBGAT attention heads in different classifiers on the accuracy performance in the VulKG dataset in one embodiment of the present application;

[0073] Figure 6 It is a structural block diagram of an embodiment of a network security vulnerability detection device based on a knowledge graph of the present application;

[0074] Figure 7 It is a structural diagram of a terminal device of the present application. DETAILED DESCRIPTION

[0075] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0076] An embodiment of the present application provides a network security vulnerability detection method based on a knowledge graph, which is used to process vulnerabilities. The execution subject of this embodiment is a network security vulnerability detection device based on a knowledge graph, which is set on a terminal device, for example, the terminal device at least includes a computer terminal, etc.

[0077] Reference Figure 1 , shows a flowchart of a method for detecting network vulnerability based on a knowledge graph in accordance with an embodiment of the present invention, which method may specifically include the following steps:

[0078] S101, obtain the time series knowledge graph of the vulnerability;

[0079] The terminal device obtains components of various projects from various platforms, and obtains vulnerability information of the components, and generates a time-series knowledge graph of the vulnerabilities based on the vulnerability information.

[0080] S102. Determine the security level corresponding to the vulnerability based on a pre-trained vulnerability detection model and a temporal knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the temporal knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder, and the pre-trained vulnerability detection model is determined based on the correlation and dependency between the entity and relationship nodes of the temporal knowledge graph of the vulnerability.

[0081] A vulnerability detection model is pre-trained on the terminal device, that is, the vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder. Specifically, in the entity encoding module, a multi-head attention mechanism is used to encode entities, and the distance and frequency information between entities are considered, and the attention weights are adjusted by distance rewards and frequency rewards; in the relationship encoding module, the semantic relevance of the relationship is learned by constructing a topological relationship graph and a relationship encoding network; in the joint sequence encoding module: a Transformer architecture is used, including multi-head self-attention and a feedforward network, to encode the sequence of entities and relationships to capture time dependencies; in the parameter learning module, the model parameters are updated through loss functions and optimization algorithms to improve prediction accuracy.

[0082] In this way, in actual applications, the terminal device inputs the temporal knowledge graph of the vulnerability into the pre-trained vulnerability detection model to obtain the security level corresponding to the vulnerability. By proposing a time-aware network security knowledge graph reasoning method (TCGFormer), the relationship between vulnerabilities is dynamically analyzed and collaborative attack patterns are mined. The technical problem that traditional vulnerability assessment methods ignore the temporal correlation between vulnerabilities and the possibility of collaborative attacks is solved, the early warning and response capabilities to potential security threats are improved, and the effect of vulnerability assessment and protection is enhanced. It has important theoretical significance and practical application value.

[0083] The knowledge graph-based network security vulnerability detection method provided in the embodiment of the present application obtains the time series knowledge graph of the vulnerability; determines the security level corresponding to the vulnerability according to the pre-trained vulnerability detection model and the time series knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the time series knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a time series decoder. The pre-trained vulnerability detection model is determined according to the correlation and dependency between the entities and relationship nodes of the time series knowledge graph of the vulnerability. The embodiment of the present application provides an entity encoding module tBGAT, a relationship encoding module REN, a joint sequence encoding module Former and a time series decoder to more effectively capture the correlation between entities and relationship nodes and long-term time dependencies, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection.

[0084] Another embodiment of the present application further supplements the network security vulnerability detection method based on knowledge graph provided in the above embodiment.

[0085] Optionally, a pre-trained vulnerability detection model is obtained by:

[0086] Obtain the time series knowledge graph of sample vulnerabilities;

[0087] Based on the entity encoding module, encode the entities in the temporal knowledge graph of the sample vulnerability to obtain weighted entity information;

[0088] Based on the relation encoding module, the relations in the temporal knowledge graph of the sample vulnerability are encoded to obtain relation representation information;

[0089] Based on the joint sequence encoding module, the weighted entity information and relationship representation information are encoded to obtain time-aware entity and relationship representation data;

[0090] According to the time-aware entity and relation representation data, the parameters in the entity encoding module, the relation encoding module and the joint sequence encoding module are trained to obtain a vulnerability detection model.

[0091] Specifically, the entity encoding module first encodes the input temporal knowledge graph, and then obtains the weighted entity representation by fusing the distance and frequency rewards. Secondly, the relationship encoding module performs relationship learning on the constructed topological relationship graph to obtain the relationship representation. After that, the joint sequence encoding module aligns and concatenates the entity and relationship representations, and processes them through the Transformer encoder to obtain time-aware entity and relationship representations. Finally, the parameter learning module guides the update of model parameters by calculating the loss function to optimize the prediction performance.

[0092] Optionally, based on the entity encoding module, the entities in the temporal knowledge graph of the sample vulnerability are encoded to obtain weighted entity information, including:

[0093] Determine the fusion reward and frequency reward based on the distance and frequency information between entities in the knowledge graph of the sample vulnerability;

[0094] According to the fusion reward and frequency reward, the attention weight is adjusted to obtain the adjusted multi-head attention mechanism;

[0095] According to the adjusted multi-head attention mechanism, the entities in the temporal knowledge graph of the sample vulnerabilities are encoded to obtain weighted entity information.

[0096] Optionally, the distance reward includes: giving higher weights to neighbors closer to the target entity through an attention decay mechanism to capture the proximity between entities;

[0097] Frequency rewards include weighting frequently appearing neighbor nodes through a frequency compensation mechanism to avoid interference from high-frequency irrelevant nodes.

[0098] Specifically, in terms of principles, it includes distance rewards (through the attention decay mechanism, higher weights are given to neighbors closer to the target entity to capture the proximity between entities), frequency rewards (through the frequency compensation mechanism, frequently appearing neighbor nodes are weighted to avoid interference from high-frequency irrelevant nodes), topological relationship graphs (relationship graphs are constructed through six topological patterns to explore potential associations at the edge level), and Transformer encoding (through the multi-head self-attention mechanism, long-term dependencies in entity and relationship sequences are captured).

[0099] Optionally, based on the relationship encoding module, the relationship in the temporal knowledge graph of the sample vulnerability is encoded to obtain relationship representation information, including:

[0100] Through the relationship graph of the pre-established topological pattern, the relationships in the temporal knowledge graph of the sample vulnerability are encoded to obtain the relationship representation information.

[0101] Optionally, based on a joint sequence encoding module, the weighted entity information and the relationship representation information are encoded to obtain time-aware entity and relationship representation data, including:

[0102] The Transformer architecture is used to encode weighted entity information and relationship representation information to obtain time-aware entity and relationship representation data. The Transformer architecture includes: multi-head self-attention and feedforward network.

[0103] Optionally, according to the time-aware entity and relationship representation data, parameters in the entity encoding module, the relationship encoding module, and the joint sequence encoding module are trained to obtain a vulnerability detection model, including:

[0104] Calculate the loss functions corresponding to the entity encoding module, the relation encoding module, and the joint sequence encoding module respectively;

[0105] According to the loss function, the parameters in the entity encoding module, the relation encoding module and the joint sequence encoding module are updated;

[0106] If the loss function meets the preset requirements, the vulnerability detection model is obtained.

[0107] First, the time series knowledge graph is input and preliminarily encoded through the entity encoding module. Then the relationship is encoded using the relationship encoding module to obtain the relationship representation. Secondly, the entity and relationship representations are input into the joint sequence encoding module and deep learning is performed through the Transformer architecture. Finally, in the parameter learning module, the model performance is optimized through loss function calculation and parameter update.

[0108] Among them, time-aware entity encoding (Entity Encoding):

[0109] The multi-head attention mechanism is used to encode entities in combination with distance rewards and frequency rewards to capture the temporal correlation and interaction frequency between entities.

[0110] Topology Graph Construction:

[0111] A relational graph is constructed through six topological patterns to explore potential associations at the edge level and enhance the semantic relevance of relational encoding.

[0112] Relation Encoding Network (REN):

[0113] The features of the topological relationship graph are aggregated through the relationship encoding network, the semantic relevance of the relationship is learned, and the accuracy of relationship prediction is improved.

[0114] Joint Encoding Module:

[0115] We use a Transformer architecture, including multi-head self-attention and feed-forward networks, to encode sequences of entities and relations to capture temporal dependencies.

[0116] Temporal Decoder:

[0117] The entity and relationship prediction tasks are implemented through the time series decoder, improving the understanding and prediction capabilities of time series data.

[0118] Multi-task Learning Framework:

[0119] In the multi-task learning framework, entity prediction and relationship prediction are performed simultaneously to optimize model performance.

[0120] Parameter Learning and Optimization:

[0121] Through loss function calculation and parameter update, the model performance is optimized and the prediction accuracy is improved.

[0122] Co-Exploitation Behavior Discovery:

[0123] By analyzing historical knowledge graph sequences, common exploit behaviors can be effectively discovered and complex attacks that may occur in the future can be predicted.

[0124] The embodiments of the present application can also be implemented by using the following technical solutions:

[0125] For example, the graph convolutional network (GCN) based on deep learning:

[0126] Use graph convolutional networks to capture local structural information between entities and enhance the model's understanding of complex relationships between entities.

[0127] Recurrent Neural Networks (RNN) or Long Short-Term Memory Networks (LSTM):

[0128] Using RNN or LSTM to process time series data to capture time dependencies can better process and analyze time series data and solve the problem of gradient disappearance or explosion.

[0129] Extensions of Graph Attention Network (GAT):

[0130] The graph attention network is extended to include the time dimension to form a time-series graph attention network. By combining the graph structure and time series characteristics, the ability to capture dynamic changes is improved.

[0131] Rule-based reasoning systems:

[0132] Design rule-based systems to identify potential correlations between vulnerabilities and identify coordinated attack patterns through rules defined by expert knowledge.

[0133] The embodiments of the present application can improve prediction accuracy. By comprehensively considering the distance and frequency information between entities and the semantic relevance of relationships, TCGFormer can predict entities and relationships more accurately; and enhance time series perception capabilities. Through the Transformer architecture, the model can better capture dynamic changes in time series and improve the understanding and prediction capabilities of time series data; and enhance the ability to identify complex attacks. By deeply exploring the correlation between vulnerabilities, TCGFormer can effectively identify and predict complex network attack behaviors and provide more comprehensive protection for network security.

[0134] The embodiment of the present application uses the entity coding module tBGAT, the relationship coding module REN, the joint sequence coding module Former and the timing decoder to more effectively capture the correlation and long-term time dependency between entity and relationship nodes, thereby improving the early warning and response capabilities to potential security threats.

[0135] The present invention solves the shortcomings and problems existing in the prior art by the following means and brings corresponding beneficial technical effects:

[0136] 1. Single vulnerability analysis problem:

[0137] Solution: The present invention uses the TCGFormer method to comprehensively consider the temporal correlation between vulnerabilities and the possibility of coordinated attacks, and realizes joint analysis of multiple vulnerabilities.

[0138] Technical effect: Improved the ability to identify complex attack strategies and enhanced the comprehensiveness of network security protection.

[0139] 2. Incomplete knowledge representation:

[0140] Solution: TCGFormer constructs a temporal knowledge graph (TKG) to more comprehensively represent the static and dynamic relationships between vulnerabilities.

[0141] Technical effect: Improved the in-depth application of knowledge graphs in vulnerability assessment and protection, and enhanced the integrity of knowledge representation.

[0142] 3. Limitations of relational reasoning:

[0143] Solution: The embodiment of the present application provides a relation encoding module REN, which learns the deep associations between vulnerabilities through a topological relationship graph and a relational correlation network.

[0144] Technical effect: Improved the ability of relationship reasoning, making the correlation analysis between vulnerabilities more accurate.

[0145] 4. Insufficient perception of time:

[0146] Solution: TCGFormer introduces the time dimension and captures the dynamic process of vulnerability evolution over time through a timing decoder.

[0147] Technical effect: Enhanced understanding of vulnerability temporal evolution and improved time perception capabilities.

[0148] 5. Insufficient capture of entity and relationship node correlation:

[0149] Solution: Use the entity encoding module tBGAT to integrate entities and relationships into subgraphs and learn the location and frequency information of neighborhood nodes.

[0150] Technical effect: It can more accurately capture the correlation between entities and relationship nodes, and improve the accuracy of vulnerability association analysis.

[0151] 6. Inadequate handling of long-term time dependencies:

[0152] Solution: TCGFormer's joint sequence encoding module Former effectively processes long-term historical interaction data through the Transformer architecture.

[0153] Technical effect: It solves the problem of gradient disappearance or explosion and improves the ability to handle long-term time dependencies.

[0154] 7. Transformer capabilities are not fully utilized:

[0155] Solution: This paper specially designs a Former module, which is optimized for dynamic graph learning and fully utilizes the Transformer's ability to process sequence data.

[0156] Technical effect: Improved the accuracy of entity and relationship predictions, and enhanced the ability to warn and respond to complex network threats.

[0157] Through the above solution, the present invention not only solves the shortcomings and problems in the prior art, but also improves the overall effectiveness of network security protection and provides new ideas and methods for vulnerability assessment and protection.

[0158] The knowledge graph-based network security vulnerability detection method provided in the embodiment of the present application obtains the time series knowledge graph of the vulnerability; determines the security level corresponding to the vulnerability according to the pre-trained vulnerability detection model and the time series knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the time series knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a time series decoder. The pre-trained vulnerability detection model is determined according to the correlation and dependency between the entities and relationship nodes of the time series knowledge graph of the vulnerability. The embodiment of the present application provides an entity encoding module tBGAT, a relationship encoding module REN, a joint sequence encoding module Former and a time series decoder to more effectively capture the correlation between entities and relationship nodes and long-term time dependencies, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection.

[0159] Another embodiment of the present application provides a knowledge graph-based network security vulnerability detection device, which is used to execute the knowledge graph-based network security vulnerability detection method provided in the above embodiment.

[0160] Reference Figure 6 , shows a structural block diagram of an embodiment of a network security vulnerability detection device based on a knowledge graph of the present application, the device may specifically include the following modules: an acquisition module 601 and a detection module 602, wherein:

[0161] The acquisition module 601 is used to obtain the time series knowledge graph of the vulnerability;

[0162] The detection module 602 is used to determine the security level corresponding to the vulnerability based on a pre-trained vulnerability detection model and the temporal knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the temporal knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder, and the pre-trained vulnerability detection model is determined based on the correlation and dependency between the entities and relationship nodes of the temporal knowledge graph of the vulnerability.

[0163] The knowledge graph-based network security vulnerability detection device provided in the embodiment of the present application obtains the time series knowledge graph of the vulnerability; determines the security level corresponding to the vulnerability according to the pre-trained vulnerability detection model and the time series knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the time series knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity coding module, a relationship coding module, a joint sequence coding module and a time series decoder. The pre-trained vulnerability detection model is determined according to the correlation and dependency between the entity and relationship nodes of the time series knowledge graph of the vulnerability. The embodiment of the present application provides an entity coding module tBGAT, a relationship coding module REN, a joint sequence coding module Former and a time series decoder to more effectively capture the correlation between entities and relationship nodes and long-term time dependencies, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection.

[0164] Another embodiment of the present application further supplements the network security vulnerability detection device based on knowledge graph provided in the above embodiment.

[0165] Optionally, the device further comprises an establishing module, the establishing module being configured to:

[0166] Obtain the time series knowledge graph of sample vulnerabilities;

[0167] Based on the entity encoding module, encode the entities in the temporal knowledge graph of the sample vulnerability to obtain weighted entity information;

[0168] Based on the relation encoding module, the relations in the temporal knowledge graph of the sample vulnerability are encoded to obtain relation representation information;

[0169] Based on the joint sequence encoding module, the weighted entity information and relationship representation information are encoded to obtain time-aware entity and relationship representation data;

[0170] According to the time-aware entity and relation representation data, the parameters in the entity encoding module, the relation encoding module and the joint sequence encoding module are trained to obtain a vulnerability detection model.

[0171] Optionally, build modules for:

[0172] Determine the fusion reward and frequency reward based on the distance and frequency information between entities in the knowledge graph of the sample vulnerability;

[0173] According to the fusion reward and frequency reward, the attention weight is adjusted to obtain the adjusted multi-head attention mechanism;

[0174] According to the adjusted multi-head attention mechanism, the entities in the temporal knowledge graph of the sample vulnerabilities are encoded to obtain weighted entity information.

[0175] Optionally, the distance reward includes: giving higher weights to neighbors closer to the target entity through an attention decay mechanism to capture the proximity between entities;

[0176] Frequency rewards include weighting frequently appearing neighbor nodes through a frequency compensation mechanism to avoid interference from high-frequency irrelevant nodes.

[0177] Optionally, build modules for:

[0178] Through the relationship graph of the pre-established topological pattern, the relationships in the temporal knowledge graph of the sample vulnerability are encoded to obtain the relationship representation information.

[0179] Optionally, build modules for:

[0180] The Transformer architecture is used to encode weighted entity information and relationship representation information to obtain time-aware entity and relationship representation data. The Transformer architecture includes: multi-head self-attention and feedforward network.

[0181] Optionally, build modules for:

[0182] Calculate the loss functions corresponding to the entity encoding module, the relation encoding module, and the joint sequence encoding module respectively;

[0183] According to the loss function, the parameters in the entity encoding module, the relation encoding module and the joint sequence encoding module are updated;

[0184] If the loss function meets the preset requirements, a vulnerability detection model is obtained. As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment.

[0185] The knowledge graph-based network security vulnerability detection device provided in the embodiment of the present application obtains the time series knowledge graph of the vulnerability; determines the security level corresponding to the vulnerability according to the pre-trained vulnerability detection model and the time series knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the time series knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity coding module, a relationship coding module, a joint sequence coding module and a time series decoder. The pre-trained vulnerability detection model is determined according to the correlation and dependency between the entity and relationship nodes of the time series knowledge graph of the vulnerability. The embodiment of the present application provides an entity coding module tBGAT, a relationship coding module REN, a joint sequence coding module Former and a time series decoder to more effectively capture the correlation between entities and relationship nodes and long-term time dependencies, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection.

[0186] Another embodiment of the present application provides a terminal device for executing the knowledge graph-based network security vulnerability detection method provided in the above embodiment.

[0187] Figure 7 It is a schematic diagram of the structure of a terminal device of the present application, such as Figure 7 As shown, the terminal device includes: at least one processor 701 and a memory 702;

[0188] The memory stores a computer program; and at least one processor executes the computer program stored in the memory to implement the knowledge graph-based network security vulnerability detection method provided in the above embodiment.

[0189] The terminal device provided in this embodiment obtains the time series knowledge graph of the vulnerability; determines the security level corresponding to the vulnerability according to the pre-trained vulnerability detection model and the time series knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the time series knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model includes at least an entity coding module, a relationship coding module, a joint sequence coding module and a time series decoder. The pre-trained vulnerability detection model is determined according to the correlation and dependency between the entities and relationship nodes of the time series knowledge graph of the vulnerability. The embodiment of the present application provides an entity coding module tBGAT, a relationship coding module REN, a joint sequence coding module Former and a time series decoder to more effectively capture the correlation between entities and relationship nodes and long-term time dependencies, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection.

[0190] Another embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed, the knowledge graph-based network security vulnerability detection method provided in any of the above embodiments is implemented.

[0191] According to the computer-readable storage medium of the present embodiment, by obtaining a temporal knowledge graph of a vulnerability; determining a security level corresponding to the vulnerability according to a pre-trained vulnerability detection model and the temporal knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the temporal knowledge graph of a sample vulnerability, the pre-trained vulnerability detection model includes at least an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder, the pre-trained vulnerability detection model is determined based on the correlation and dependency between entities and relationship nodes of the temporal knowledge graph of the vulnerability, the embodiment of the present application more effectively captures the correlation between entities and relationship nodes and long-term time dependencies by providing an entity encoding module tBGAT, a relationship encoding module REN, a joint sequence encoding module Former and a temporal decoder, thereby improving the early warning and response capabilities to potential security threats and improving the accuracy and efficiency of vulnerability detection.

[0192] It should be noted that the above detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present application belongs.

[0193] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0194] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0195] In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0196] For ease of description, spatially relative terms, such as "above", "above", "on the upper surface of", "above", etc., may be used herein to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" may include both "above" and "below". The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatially relative descriptions used herein are interpreted accordingly.

[0197] In the above detailed description, reference is made to the accompanying drawings, which form a part of this document. In the accompanying drawings, similar symbols typically identify similar components unless the context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be used, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.

[0198] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network security vulnerability detection method based on knowledge graph, characterized in that: The method comprises: Obtain the time series knowledge graph of vulnerabilities; Determine the security level corresponding to the vulnerability according to a pre-trained vulnerability detection model and the temporal knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the temporal knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model at least includes an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder, and the pre-trained vulnerability detection model is determined according to the correlation and dependency between the entity and relationship nodes of the temporal knowledge graph of the vulnerability; The pre-trained vulnerability detection model is obtained in the following way: Obtain the time series knowledge graph of sample vulnerabilities; Based on the entity encoding module, the entities in the temporal knowledge graph of the sample vulnerability are encoded to obtain weighted entity information, including: Determine a distance reward and a frequency reward based on the distance and frequency information between entities in the knowledge graph of the sample vulnerability; The attention weight is adjusted according to the distance reward and the frequency reward to obtain an adjusted multi-head attention mechanism; the distance reward includes: giving a higher weight to neighbors closer to the target entity through an attention decay mechanism to capture the proximity between entities; the frequency reward includes weighting frequently appearing neighbor nodes through a frequency compensation mechanism to avoid interference from high-frequency irrelevant nodes; According to the adjusted multi-head attention mechanism, encode the entities in the temporal knowledge graph of the sample vulnerability to obtain weighted entity information; Based on the relationship encoding module, encoding the relationship in the temporal knowledge graph of the sample vulnerability to obtain relationship representation information, including: encoding the relationship in the temporal knowledge graph of the sample vulnerability through a relationship graph of a pre-established topological pattern to obtain relationship representation information; Based on the joint sequence encoding module, the weighted entity information and the relationship representation information are encoded to obtain time-aware entity and relationship representation data, including: Using a Transformer architecture, the weighted entity information and the relationship representation information are encoded to obtain time-aware entity and relationship representation data; According to the time-aware entity and relationship representation data, the parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module are trained, and the model performance is optimized through loss function calculation and parameter updating to obtain the vulnerability detection model.

2. The network security vulnerability detection method based on knowledge graph according to claim 1 is characterized in that: The Transformer architecture includes: multi-head self-attention and feed-forward network.

3. The network security vulnerability detection method based on knowledge graph according to claim 1 is characterized in that: The training of parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module according to the time-aware entity and relationship representation data to obtain the vulnerability detection model includes: Calculating loss functions corresponding to the entity encoding module, the relationship encoding module and the joint sequence encoding module respectively; According to the loss function, updating parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module; If the loss function meets the preset requirements, the vulnerability detection model is obtained.

4. A network security vulnerability detection device based on knowledge graph, characterized in that: The device comprises: The acquisition module is used to obtain the time series knowledge graph of vulnerabilities; A detection module, used to determine the security level corresponding to the vulnerability according to a pre-trained vulnerability detection model and a temporal knowledge graph of the vulnerability, wherein the pre-trained vulnerability detection model is obtained by training the TCGFormer model using the temporal knowledge graph of the sample vulnerability, and the pre-trained vulnerability detection model at least includes an entity encoding module, a relationship encoding module, a joint sequence encoding module and a temporal decoder, and the pre-trained vulnerability detection model is determined according to the correlation and dependency between the entity and relationship nodes of the temporal knowledge graph of the vulnerability; The pre-trained vulnerability detection model is obtained in the following way: Obtain the time series knowledge graph of sample vulnerabilities; Based on the entity encoding module, the entities in the temporal knowledge graph of the sample vulnerability are encoded to obtain weighted entity information, including: Determine a distance reward and a frequency reward based on the distance and frequency information between entities in the knowledge graph of the sample vulnerability; The attention weight is adjusted according to the distance reward and the frequency reward to obtain an adjusted multi-head attention mechanism; the distance reward includes: giving a higher weight to neighbors closer to the target entity through an attention decay mechanism to capture the proximity between entities; the frequency reward includes weighting frequently appearing neighbor nodes through a frequency compensation mechanism to avoid interference from high-frequency irrelevant nodes; According to the adjusted multi-head attention mechanism, encode the entities in the temporal knowledge graph of the sample vulnerability to obtain weighted entity information; Based on the relationship encoding module, encoding the relationship in the temporal knowledge graph of the sample vulnerability to obtain relationship representation information, including: encoding the relationship in the temporal knowledge graph of the sample vulnerability through a relationship graph of a pre-established topological pattern to obtain relationship representation information; Based on the joint sequence encoding module, the weighted entity information and the relationship representation information are encoded to obtain time-aware entity and relationship representation data, including: Using a Transformer architecture, the weighted entity information and the relationship representation information are encoded to obtain time-aware entity and relationship representation data; According to the time-aware entity and relationship representation data, the parameters in the entity encoding module, the relationship encoding module and the joint sequence encoding module are trained, and the model performance is optimized through loss function calculation and parameter updating to obtain the vulnerability detection model.

5. A terminal device, characterized in that: include: at least one processor and memory; The memory stores a computer program; The at least one processor executes the computer program stored in the memory to implement the network security vulnerability detection method based on knowledge graph described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed, implements the network security vulnerability detection method based on knowledge graph described in any one of claims 1 to 3.

Images