Knowledge graph reasoning model training method, knowledge graph-based threat intelligence reasoning method, medium, equipment and product

Abstract

The invention relates to the technical field of network security, and particularly provides a knowledge graph inference model training method, a knowledge graph-based threat intelligence inference method, a medium, equipment and a product, and the knowledge graph inference model training method can comprise the following steps: aggregating a time sequence knowledge graph corresponding to threat intelligence data, obtaining a multi-granularity knowledge graph; performing related processing on the multi-granularity knowledge graph by utilizing an initial knowledge graph inference model to obtain multiple types of evaluation scores; optimizing the initial knowledge graph inference model by using the multi-class evaluation scores and a loss value determined by a loss function, and obtaining a trained target knowledge graph inference model; wherein the target knowledge graph reasoning model is used for performing reasoning prediction on any entity in a tetrad of threat intelligence. According to some embodiments of the application, the knowledge graph reasoning accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and specifically, to a method, medium, device and product for training a knowledge graph reasoning model and threat intelligence reasoning based on a knowledge graph. Background Art

[0002] With the rapid development of Internet technology, the security issues in cyberspace are becoming increasingly prominent. In order to improve network security, seeking effective threat detection and response mechanisms remains an important research direction.

[0003] At present, threat intelligence has become an indispensable part of the field of network security. Threat intelligence can identify and prevent security risks in advance by collecting, processing, analyzing and sharing information about existing or potential threats. However, the threat intelligence information collected in traditional threat intelligence analysis methods is not comprehensive, which easily forms data islands, and lacks in-depth correlation analysis of threat intelligence information, making it impossible to achieve accurate reasoning of threat intelligence.

[0004] Therefore, how to provide a technical solution for a method of knowledge graph reasoning of threat intelligence with higher accuracy has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a method, medium, device and product for training a knowledge graph reasoning model and threat intelligence reasoning based on a knowledge graph. Through the technical solutions of the embodiments of the present application, accurate reasoning of threat intelligence can be achieved through the trained knowledge graph reasoning model.

[0006] In a first aspect, some embodiments of the present application provide a method for training a knowledge graph reasoning model, including: aggregating the time series knowledge graphs corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph; performing relevant processing on the multi-granularity knowledge graph using the initial knowledge graph reasoning model to obtain multi-category evaluation scores; wherein the relevant processing includes: vectorization, fusion and scoring; optimizing the initial knowledge graph reasoning model using the multi-category evaluation scores and the loss value determined by the loss function to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to perform inference and prediction on any entity in the quadruple of threat intelligence.

[0007] Some embodiments of the present application process the multi-granularity knowledge graph corresponding to the threat intelligence data through the initial knowledge graph reasoning model to obtain multiple evaluation scores; then use the loss function to calculate the loss value to optimize the initial knowledge graph reasoning model to obtain the target knowledge graph reasoning model. Some embodiments of the present application can obtain a target knowledge graph reasoning model with higher accuracy through training, thereby improving the accuracy of subsequent threat intelligence reasoning.

[0008] In some embodiments, the time series knowledge graph corresponding to the threat intelligence data is aggregating to obtain a multi-granularity knowledge graph, including: constructing the threat intelligence data collected according to time into the time series knowledge graph, wherein the knowledge graph at each moment in the time series knowledge graph is a quadruple, and the quadruple includes: a head entity, a tail entity, a relationship between entities, and an event occurrence time; aggregating the time series knowledge graph according to multiple granularities to obtain the multi-granularity knowledge graph, wherein the multiple granularities include yearly granularity, monthly granularity, and daily granularity, and the multi-granularity knowledge graph includes: yearly granularity knowledge graph, monthly granularity knowledge graph, and daily granularity knowledge graph.

[0009] Some embodiments of the present application obtain a multi-granularity knowledge graph by aggregating the time-series knowledge graph constructed by threat intelligence data at multiple granularities, which can provide rich data information support for model training.

[0010] In some embodiments, the use of the initial knowledge graph inference model to perform relevant processing on the multi-granularity knowledge graph to obtain multi-category evaluation scores includes: vectorizing each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector, wherein the structure vector includes: an entity vector and an entity relationship vector; fusing the structure vectors corresponding to each knowledge graph in knowledge graphs of different granularities to obtain fused structure information, wherein the fused structure information includes: a fused entity vector and a fused entity relationship vector; and using a multi-category scoring function to respectively score the fused structure information, time information, and external correlation data to obtain the multi-category evaluation scores.

[0011] Some embodiments of the present application process multi-granularity knowledge graphs through an initial knowledge graph reasoning model to obtain multiple categories of evaluation scores, thereby providing support for the optimization of subsequent models and obtaining a target knowledge graph model with higher accuracy.

[0012] In some embodiments, the vectorization processing of each knowledge graph in the multi-granularity knowledge graph to obtain a structural vector includes: initializing each entity in each knowledge graph to obtain an initialized entity vector; and converting the event occurrence time into timestamp information and then encoding it to obtain an initial relationship vector; using the adjacent entity nodes and entity relationship information of each entity, updating the initialized entity vector and the initial relationship vector to obtain the entity vector and the entity relationship vector.

[0013] Some embodiments of the present application can improve the accuracy of model reasoning by performing vector processing on each entity and encoding static timestamp information in the initial knowledge graph reasoning model.

[0014] In some embodiments, the structural vectors corresponding to each knowledge graph in knowledge graphs of different granularities are fused to obtain fused structural information, including: based on the target vector, obtaining a multi-granularity vector matrix for each entity in each knowledge graph; obtaining the attention scores of the multi-granularity vector matrix at different granularities; calculating the attention scores at different granularities to obtain calculation results; wherein the target vector is the entity vector, the multi-granularity vector matrix is ​​the fused entity vector, and the calculation result is the fused entity vector; or, the target vector is the entity relationship vector, the multi-granularity vector matrix is ​​the fused entity relationship vector, and the calculation result is the fused entity relationship vector.

[0015] Some embodiments of the present application fuse entity-related vectors at different granularities to obtain fused entity vectors, thereby providing support for subsequent improvement of the accuracy of model reasoning.

[0016] In some embodiments, the time information is obtained by the following method: processing the relationship between the entities at the time when the event occurs to obtain the time information.

[0017] Some embodiments of the present application obtain time information by processing the time of event occurrence, thereby providing data support for subsequent model training.

[0018] In some embodiments, the multiple categories of scoring functions include: a structural information scoring function, a time scoring function, and a correlation information scoring function; the multiple categories of evaluation scores include: a structural score, a time score, and a correlation score.

[0019] Some embodiments of the present application improve the accuracy of model training by evaluating relevant information from multiple aspects.

[0020] In some embodiments, the use of a multi-category scoring function to score the fused structural information, temporal information, and external associated data respectively to obtain the multi-category evaluation scores includes: using the structural information scoring function to score the fused entity vector and the fused entity relationship vector to obtain the structural score; using the time scoring function to score the temporal information to obtain the time score; using the associated information scoring function to score the external associated data to obtain the associated score.

[0021] Some embodiments of the present application score different information through different scoring functions to obtain different scores, which can improve the accuracy of model training.

[0022] In some embodiments, the external related data is obtained by the following method: using the known entity names and the known entity relationships in any quadruple in the training set as search keywords, obtaining text information from a database; converting the keywords in the text information into vectors to obtain a keyword vector matrix, wherein the keyword vector matrix is ​​the external related data.

[0023] Some embodiments of the present application provide richer information support for the model by searching for relevant external associated data and integrating it into the model.

[0024] In a second aspect, some embodiments of the present application provide a method for threat intelligence reasoning based on a knowledge graph, comprising: based on the known information in a quadruple of threat intelligence, searching for all candidate entities or candidate relationships related to the known information in the time series knowledge graph; combining the candidate entities or the candidate relationships with the known information into candidate quadruple groups, wherein the candidate quadruple is one or more; inputting the candidate quadruple into a target knowledge graph reasoning model, and outputting a reasoning result, wherein the reasoning result includes at least one quadruple in the candidate quadruple whose score meets a preset condition.

[0025] Some embodiments of the present application use the target knowledge graph reasoning model trained by the first aspect embodiment to infer threat intelligence, which is both efficient and accurate.

[0026] On the third aspect, some embodiments of the present application provide a device for training a knowledge graph reasoning model, including: an aggregation module, used to aggregate the time series knowledge graph corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph; a model processing module, used to use the initial knowledge graph reasoning model to perform relevant processing on the multi-granularity knowledge graph to obtain multiple categories of evaluation scores; wherein the relevant processing includes: vectorization, fusion and scoring; an optimization module, used to optimize the initial knowledge graph reasoning model using the multiple categories of evaluation scores and the loss value determined by the loss function, to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to perform inference and prediction on any entity in the quadruple of threat intelligence.

[0027] In a fourth aspect, some embodiments of the present application provide a device for threat intelligence reasoning based on a knowledge graph, comprising: a search module, used to search for all candidate entities or candidate relationships related to the known information in the time series knowledge graph based on the known information in the threat intelligence quadruple; a composition module, used to combine the candidate entities or the candidate relationships with the known information into candidate quadruple, wherein the candidate quadruple is one or more; and an inference module, used to input the candidate quadruple into a target knowledge graph inference model, and output an inference result, wherein the inference result includes at least one quadruple in the candidate quadruple whose score meets a preset condition.

[0028] In a fifth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0029] In a sixth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a method as described in any embodiment of the first aspect.

[0030] In a seventh aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 A system diagram of threat intelligence reasoning based on knowledge graphs provided for some embodiments of the present application;

[0033] Figure 2 A flow chart of a method for training a knowledge graph reasoning model provided for some embodiments of the present application;

[0034] Figure 3 A schematic diagram of knowledge graph aggregation provided for some embodiments of the present application;

[0035] Figure 4 One of the flow charts of the method for threat intelligence reasoning based on knowledge graph provided in some embodiments of the present application;

[0036] Figure 5 A second flowchart of a method for threat intelligence reasoning based on knowledge graph provided for some embodiments of the present application;

[0037] Figure 6 A block diagram of the apparatus for training a knowledge graph reasoning model provided in some embodiments of the present application;

[0038] Figure 7 A block diagram of a device for threat intelligence reasoning based on knowledge graphs provided in some embodiments of the present application;

[0039] Figure 8 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0041] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0042] With the rapid development of Internet technology, the means of cyber attacks are constantly being updated. Attackers usually use complex strategies to attack important information systems in scenarios such as individuals and enterprises, resulting in serious economic losses and social impacts. In order to effectively deal with these threats, security experts have been seeking more effective threat detection and response mechanisms. The current existing technology proposes to infer the associated information of threat intelligence by constructing a knowledge graph. However, the data in the knowledge graph in the existing technology is sparse, and the amount of information available at certain moments is small, which greatly affects the accuracy of reasoning. Moreover, the existing technology is accustomed to using gated recurrent neural networks to capture time evolution knowledge using graph changes at adjacent moments, ignoring the static timestamp information in the time series knowledge graph, which may also lead to a low accuracy rate in the final reasoning.

[0043] In view of this, some embodiments of the present application provide a method for threat intelligence reasoning based on a knowledge graph, in which a time-series knowledge graph related to threat intelligence is constructed to integrate threat intelligence data from different sources, and the structured representation of the time-series knowledge graph is used to train a model to mine the hidden correlation information in the threat intelligence, thereby assisting security analysts in making more accurate judgments.

[0044] The following is combined with Figure 1The overall composition structure of the system for threat intelligence reasoning based on knowledge graph provided by some embodiments of the present application is exemplified.

[0045] like Figure 1 As shown, some embodiments of the present application provide a system for threat intelligence reasoning based on a knowledge graph, and the system for threat intelligence reasoning based on a knowledge graph may include: a terminal 100 and an inference server 200. Specifically, the terminal 100 may send the known information in the associated quadruple of the threat intelligence to be inferred to the inference server 200. The inference server 200 may obtain a candidate quadruple through search and composition operations based on the known information; finally, the candidate quadruple is input into the trained target knowledge graph reasoning model, and at least one quadruple inferred that meets the preset conditions is output.

[0046] In some embodiments of the present application, the trained target knowledge graph reasoning model is obtained by training with threat intelligence-related data, which may be pre-deployed in the reasoning server 200. In addition, the terminal 100 may be a mobile terminal or a non-portable computer terminal, which is not specifically limited in the embodiments of the present application.

[0047] In order to achieve accurate reasoning of threat intelligence related data, we first need to obtain a trained target knowledge graph reasoning model. Figure 2 The implementation process of training the knowledge graph reasoning model performed by the inference server 200 provided in some embodiments of the present application is exemplified.

[0048] Please see attached Figure 2 , Figure 2 A flow chart of a method for training a knowledge graph reasoning model provided for some embodiments of the present application, the method for training a knowledge graph reasoning model may include:

[0049] S210, aggregate the time series knowledge graph corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph.

[0050] For example, in some embodiments of the present application, in order to capture knowledge of different granularities, it is necessary to aggregate the time-series knowledge graphs corresponding to the threat intelligence data to obtain knowledge graphs at different granularities.

[0051] In some embodiments of the present application, S210 may include: constructing the threat intelligence data collected according to time into the time series knowledge graph, wherein the knowledge graph at each moment in the time series knowledge graph is a quadruple, and the quadruple includes: head entity, tail entity, relationship between entities and event occurrence time; aggregating the time series knowledge graph according to multiple granularities to obtain the multi-granularity knowledge graph, wherein the multiple granularities include annual granularity, monthly granularity and daily granularity, and the multi-granularity knowledge graph includes: annual granularity knowledge graph, monthly granularity knowledge graph and daily granularity knowledge graph.

[0052] For example, in some embodiments of the present application, threat intelligence data such as assets, intelligence, and vulnerabilities are collected according to time, and a time series knowledge graph G corresponding to the threat intelligence data is constructed, where G = {G (1) , G (2) , ..., G (t)}, G (t) Represents the knowledge graph at time t. Knowledge graph G (t) There is a quadruple<s,r,o,t> , where s is the head entity, o is the tail entity, r is the relationship between entities, and t is the time when the event occurs (i.e., time t).

[0053] Specifically, in order to capture knowledge of different granularities, the knowledge graph G (t) Aggregate by year, month, and day to get the knowledge graph G at year granularity (y) , monthly granularity knowledge graph G (m) , daily granularity knowledge graph G (d) The specific aggregation rules are as follows: Figure 3 As shown, the knowledge graph G on the left (t) There is a quadruple<s,r,o,t1> and<s,r,o,t2> , where time t1 and time t2 are different, if time t1 and time t2 are in the same year (such as Figure 3 The year is 2013), then the quadruple can be divided into<s,r,o,t1> and<s,r,o,t2> Merge into Figure 3 The knowledge graph shown on the right<s,r,o,year> The aggregated knowledge graph is the annual granularity knowledge graph G (y) Similarly, we can obtain monthly granularity knowledge graphs and daily granularity knowledge graphs.

[0054] S220, using the initial knowledge graph reasoning model to perform relevant processing on the multi-granularity knowledge graph to obtain multiple categories of evaluation scores; wherein the relevant processing includes: vectorization, fusion and scoring.

[0055] For example, in some embodiments of the present application, multi-granularity knowledge graph structural information is modeled, and CompGCN (as a specific example of the initial knowledge graph reasoning model) is used to capture the structured dependency information in the multi-granularity knowledge graph, and finally obtain multiple categories of evaluation scores.

[0056] In some embodiments of the present application, S220 may include:

[0057] S221, vectorize each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector, wherein the structure vector includes: an entity vector and an entity relationship vector.

[0058] For example, in some embodiments of the present application, the structural information of the knowledge graphs of different granularities at time t (that is, entities and relationships between entities) is processed to obtain a structural vector.

[0059] In some embodiments of the present application, S221 may include: initializing each entity in each knowledge graph to obtain an initialized entity vector; and converting the event occurrence time into timestamp information and encoding it to obtain an initial relationship vector; using the adjacent entity nodes and entity relationship information of each entity, updating the initialized entity vector and the initial relationship vector to obtain the entity vector and the entity relationship vector.

[0060] For example, in some embodiments of the present application, a low-dimensional embedding vector is initialized for each entity in each knowledge graph to represent the entity and obtain an initial entity vector. Considering that in the time series knowledge graph, each entity relationship contains the time when the event occurred. The event time corresponding to each entity relationship is converted into a timestamp, and encoded into a vector using sine and cosine coding as the initial relationship vector of the entity relationship, static timestamp information is added to the model to improve the accuracy of model training.

[0061] Afterwards, the initial entity vector is updated according to the neighbor node information of each entity (as a specific example of adjacent entity nodes) and the entity relationship information. The update formula is as follows:

[0062]

[0063] In the formula, are the initial vectors of adjacent entities u and the relationship r between entities at time t, is the entity vector of the updated entity v, W λ(r) is a specific parameter of the relation type, and φ(·) is a combinatorial operation on vectors, such as addition, subtraction, etc.

[0064] The update formula of the initial relationship vector is as follows:

[0065]

[0066] Where W rel is a learnable transformation matrix, It is the entity relationship vector representation of the updated relationship r at time t.

[0067] S222, fusing the structural vectors corresponding to each knowledge graph in knowledge graphs of different granularities to obtain fused structural information, wherein the fused structural information includes: a fused entity vector and a fused entity relationship vector.

[0068] For example, in some embodiments of the present application, the structural vectors of knowledge graphs at different granularities are fused using an attention mechanism to obtain fused entity representations and relationship representations, namely, fused entity vectors and fused entity relationship vectors.

[0069] In some embodiments of the present application, S222 may include: based on the target vector, obtaining a multi-granularity vector matrix for each entity in each knowledge graph; obtaining the attention scores of the multi-granularity vector matrix at different granularities; calculating the attention scores at the different granularities to obtain a calculation result; wherein the target vector is the entity vector, the multi-granularity vector matrix is ​​the multi-granularity entity vector matrix, and the calculation result is the fused entity vector; or, the target vector is the entity relationship vector, the multi-granularity vector matrix is ​​the multi-granularity relationship vector matrix, and the calculation result is the fused entity relationship vector.

[0070] For example, in some embodiments of the present application, the fusion process of entity vectors is taken as an example to illustrate the implementation process of obtaining the fused entity relationship vector. (y) , monthly granularity knowledge graph G (m) , daily granularity knowledge graph G (d) The entity vector of the corresponding entity v is expressed as and In this way, we get the multi-granularity vector matrix of entity v (As a specific example of a multi-granularity entity vector matrix). The scaled dot product attention is used to score the multi-granularity vector matrices corresponding to different granularities. The specific formula is as follows:

[0071]

[0072] In the formula, e (g,t) is the vector fraction of g granularity (i.e., year, month, and day granularity) at time t, W q and W k are the learnable parameter matrices, and d is the dimension of the vector.

[0073] For (g,t) Normalize it to get the attention score β of the entity vector at g granularity (g,t) , attention score β (g,t) The calculation formula is as follows:

[0074]

[0075] Finally, use the attention score to v t After weighted summation of the vectors in , the multi-granularity vector representation of the entity at time t after the final fusion is obtained, that is, the fused entity vector As shown below:

[0076]

[0077] Among them, W v is a learnable parameter matrix, and sum(·) is a matrix row summation function.

[0078] It should be noted that the fusion process of the entity relationship representation is the same as that of the entity v above, and will not be repeated here. Through the above fusion method, a multi-granular vector representation of the relationship r at time t can be finally obtained, that is, the fused entity relationship vector

[0079] In some embodiments of the present application, the time information is obtained by the following method: the relationship between the entities at the time when the event occurs is processed to obtain the time information.

[0080] For example, in some embodiments of the present application, GRU is used to model the time evolution pattern of event occurrence, and the time evolution representation of the relationship r at time t is obtained, that is, the time information The specific calculation formula is:

[0081]

[0082] S223, using a multi-category scoring function to score the fused structural information, time information and external associated data respectively, to obtain the multi-category evaluation scores. The multi-category scoring function includes: a structural information scoring function, a time scoring function and an associated information scoring function; the multi-category evaluation scores include: a structural score, a time score and an associated score.

[0083] For example, in some embodiments of the present application, each possible quadruple is scored from the perspectives of structural information (i.e., fused structural information), time evolution information (i.e., time information), external information (i.e., external associated data), etc. Specifically, multiple scoring functions are used to score the fused quadruple obtained above. As well as external related data, multiple evaluation scores are obtained to facilitate training of a target knowledge graph reasoning model with higher accuracy.

[0084] In some embodiments of the present application, S223 may include:

[0085] S2231, using the structural information scoring function to score the fused entity vector and the fused entity relationship vector to obtain the structural score.

[0086] For example, in some embodiments of the present application, DistMult is used to score the quaternary group of structural information, and the formula of the structural information scoring function is:

[0087]

[0088] In the formula, are the fused vectors corresponding to entity s, inter-entity relationship r, and entity o at time t, respectively. s Structural score.

[0089] S2232: Score the time information using the time scoring function to obtain the time score.

[0090] For example, in some embodiments of the present application, the time scoring function of the time evolution information is:

[0091]

[0092] Where W t is the learnable parameter matrix, is the time evolution representation of the relationship r between entities at time t, I t Structural score.

[0093] In some embodiments of the present application, external related data is obtained by the following method: using the known entity names and the known entity relationships in any quadruple in the training set as search keywords, obtaining text information from the database; converting the keywords in the text information into vectors to obtain a keyword vector matrix, wherein the keyword vector matrix is ​​the external related data.

[0094] For example, in some embodiments of the present application, considering that the knowledge graph may have the problem of data sparsity, less information is available at certain times. By searching for keywords in the database on the Internet, text information related to the knowledge graph is collected as external information. If the current reasoning task (as a specific example of any quadruple in the training set) is: knowing the head entity, the relationship between entities and the time t in the quadruple, the tail entity in the reasoning quadruple, then the search keyword (or retrieval keyword) is "head entity name + relationship name between entities", and relevant text information is searched. Then extract the keywords in the text information, use the BERT model to convert the keywords into vectors, and construct the keyword vector matrix W = {W 1 ,W 2 ...W l}.

[0095] S2233: Score the external associated data using the associated information scoring function to obtain the associated score.

[0096] For example, in some embodiments of the present application, the formula of the association information scoring function is as follows:

[0097]

[0098] Where W w is a learnable parameter matrix, avgpool(W) represents the average pooling of the keyword vector matrix W, I w is the association score.

[0099] S230, using the multi-category evaluation scores and the loss value determined by the loss function, optimize the initial knowledge graph reasoning model to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to perform inference and prediction on any entity in the quadruple of threat intelligence.

[0100] For example, in some embodiments of the present application, the loss value of the multi-class scoring scores obtained above is calculated by the following loss function, and the initial knowledge graph reasoning model is optimized after the loss value is obtained, until the loss value meets the set conditions, and the target knowledge graph reasoning model is output; or the target knowledge graph reasoning model is output after the number of iterations is reached. The specific formula of the loss function is:

[0101]

[0102] In the formula, I * is the I calculated above s ,I t ,I w .

[0103] After obtaining the target knowledge graph reasoning model through the above embodiment, the reasoning operation can be performed on the relevant threat intelligence reasoning task. Figure 4 The specific process of threat intelligence reasoning based on knowledge graph provided by some embodiments of the present application is exemplified.

[0104] Please see attached Figure 4 , Figure 4 A flowchart of a method for threat intelligence reasoning based on a knowledge graph is provided for some embodiments of the present application. The method for threat intelligence reasoning based on a knowledge graph may include:

[0105] S410, based on the known information in the quadruple of threat intelligence, search for all candidate entities or candidate relationships related to the known information in the temporal knowledge graph.

[0106] For example, in some embodiments of the present application, the head entity s, the relationship between entities r, and the time t in the known quadruple (as a specific example of known information) are inferred.<s,r,?,t> The tail entity in the temporal knowledge graph. Search for all possible tail entities from the temporal knowledge graph and construct a set of candidate tail entities (as a specific example of candidate entities). Specifically, count the entity type of the head entity and the entity type TAIL of the tail entity of all relations r in the knowledge graph, and construct a rule set RULE = {(HEAD, r, TAIL)}. Put the entity type HEAD of the head entity, which is the same as the entity type of the head entity s, and the tail entity type TAIL of the relationship r into the candidate tail entity type set TA. Traverse the temporal knowledge graph, search for all entities whose entity types are in the candidate tail entity type set TA, as candidate tail entities, and put them into the candidate tail entity set candidate. Alternatively, in another embodiment, a set of candidate relations that have a relationship with the known information entity s, the relationship r between entities, and the time t can also be selected.

[0107] S420, combining the candidate entity or the candidate relationship with the known information into a candidate quadruple, wherein the candidate quadruple is one or more.

[0108] For example, in some embodiments of the present application, the candidate tail entity set candidate is traversed, and a candidate quadruple is constructed using the candidate tail entity and the head entity s, the relationship between entities r and the time t, or the candidate quadruple is constructed through the candidate relationship.

[0109] S430, input the candidate quadruple into the target knowledge graph reasoning model, and output the reasoning result, wherein the reasoning result includes at least one quadruple among the candidate quadruple whose score meets a preset condition.

[0110] For example, in some embodiments of the present application, subsequent quadruple groups are input into the target knowledge graph inference model obtained through the above training, and the candidate quadruple groups are scored respectively using the multi-class scoring functions in the target knowledge graph inference model, and the sum of the function values ​​of the three scoring functions is the score of each candidate quadruple group. The top k quadruple groups with the highest scores (as a specific example of the preset condition) are taken as the inference results; or the quadruple groups with scores greater than the preset threshold (as another specific example of the preset condition) are taken as the inference results.

[0111] The following is combined with Figure 5 The specific process of threat intelligence reasoning based on knowledge graph provided by some embodiments of the present application is exemplified.

[0112] Please see attached Figure 5 , Figure 5 A flowchart of a method for threat intelligence reasoning based on a knowledge graph is provided for some embodiments of the present application.

[0113] The above process is explained below as an example.

[0114] S510, constructs the threat intelligence data collected according to time into a time series knowledge graph.

[0115] S520, aggregate the temporal knowledge graph according to multiple granularities to obtain a multi-granularity knowledge graph.

[0116] S530, use the initial knowledge graph reasoning model to vectorize each knowledge graph in the multi-granularity knowledge graph to obtain a structural vector.

[0117] S540, using the initial knowledge graph reasoning model to fuse the structural vectors corresponding to each knowledge graph in knowledge graphs of different granularities to obtain fused structural information.

[0118] S550, using a multi-class scoring function to score the fused structural information, time information and external correlation data respectively, to obtain a multi-class evaluation score.

[0119] S560, using the multi-category evaluation scores and the loss value determined by the loss function, optimize the initial knowledge graph reasoning model to obtain the trained target knowledge graph reasoning model.

[0120] S570, based on the known information in the quadruple of threat intelligence, search for candidate entities related to the entity to be predicted in the time series knowledge graph.

[0121] For example, if the reasoning question is "Which asset did organization A control on November 1, 2024?", the threat intelligence queried quadruple is <organization A, control,?, November 1, 2024>. All possible candidate tail entities C (i.e., candidate entities) are searched in the temporal knowledge graph based on the query quadruple.

[0122] S580, combining the candidate entity and the known information into a candidate quadruple.

[0123] S590, input the candidate quadruple into the target knowledge graph reasoning model and output the reasoning result.

[0124] For example, the query quadruple is input into the target knowledge graph reasoning model, and the scoring function is used to score all candidate quadruple <Organization A, Control, C, November 1, 2024>, and the top k candidate tail entities with the highest scores are the reasoning results. The reasoning result can be a quadruple containing C, or it can only contain C, which is not specifically limited in the embodiments of the present application.

[0125] It should be understood that the specific implementation process of S510 to S590 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0126] Through some of the above embodiments of the present application, it can be seen that the present application provides more contextual information through static timestamps, and encoding static timestamp information into the target knowledge graph reasoning model can effectively improve the performance of the model. By introducing external related data, the model can capture more historical information, thereby improving the accuracy of reasoning.

[0127] Please refer to Figure 6 , Figure 6 The block diagram of the composition of the device for training the knowledge graph reasoning model provided by some embodiments of the present application is shown. It should be understood that the device for training the knowledge graph reasoning model corresponds to the above-mentioned method embodiment and can execute each step involved in the above-mentioned method embodiment. The specific functions of the device for training the knowledge graph reasoning model can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0128] Figure 6The device for training the knowledge graph reasoning model includes at least one software function module that can be stored in the memory in the form of software or firmware or solidified in the device for training the knowledge graph reasoning model. The device for training the knowledge graph reasoning model includes: an aggregation module 610, which is used to aggregate the time series knowledge graph corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph; a model processing module 620, which is used to use the initial knowledge graph reasoning model to perform relevant processing on the multi-granularity knowledge graph to obtain multiple categories of evaluation scores; wherein the relevant processing includes: vectorization, fusion and scoring; an optimization module 630, which is used to optimize the initial knowledge graph reasoning model using the multiple categories of evaluation scores and the loss value determined by the loss function to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to perform inference and prediction on any entity in the quadruple of threat intelligence.

[0129] Please refer to Figure 7 , Figure 7 The block diagram of the composition of threat intelligence reasoning based on knowledge graph provided by some embodiments of the present application is shown. It should be understood that the device for threat intelligence reasoning based on knowledge graph corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device for threat intelligence reasoning based on knowledge graph can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0130] Figure 7 The device for threat intelligence reasoning based on knowledge graph includes at least one software functional module that can be stored in a memory in the form of software or firmware or solidified in the device for threat intelligence reasoning based on knowledge graph, and the device for threat intelligence reasoning based on knowledge graph includes: a search module 710, which is used to search for all candidate entities or candidate relationships related to the known information in the time series knowledge graph based on the known information in the threat intelligence quadruple; a composition module 720, which is used to form a candidate quadruple with the candidate entity or the candidate relationship and the known information, and the candidate quadruple is one or more; an inference module 730, which is used to input the candidate quadruple into the target knowledge graph inference model and output the inference result, wherein the inference result includes at least one quadruple in the candidate quadruple whose score meets the preset conditions.

[0131] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0132] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0133] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0134] like Figure 8 As shown, some embodiments of the present application provide an electronic device 800, which includes: a memory 810, a processor 820, and a computer program stored in the memory 810 and executable on the processor 820, wherein the processor 820 can implement a method as described in any of the above embodiments when reading the program from the memory 810 through a bus 830 and executing the program.

[0135] Processor 820 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 820 can be a microprocessor.

[0136] The memory 810 may be used to store instructions executed by the processor 820 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 820 of the disclosed embodiment may be used to execute instructions in the memory 810 to implement the method shown above. The memory 810 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0137] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0138] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0139] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for training a knowledge graph reasoning model, characterized in that: include: Aggregate the time-series knowledge graph corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph; Using the initial knowledge graph inference model to perform relevant processing on the multi-granularity knowledge graph to obtain multiple categories of evaluation scores; wherein the relevant processing includes: vectorization, fusion and scoring; The initial knowledge graph reasoning model is optimized by using the multi-category evaluation scores and the loss value determined by the loss function to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to perform inference and prediction on any entity in the quadruple of threat intelligence.

2. The method according to claim 1, characterized in that The step of aggregating the time series knowledge graph corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph includes: The threat intelligence data collected according to time is constructed into the time series knowledge graph, wherein the knowledge graph at each moment in the time series knowledge graph is a quadruple, and the quadruple includes: a head entity, a tail entity, a relationship between entities, and an event occurrence time; The time series knowledge graph is aggregated according to multiple granularities to obtain the multi-granularity knowledge graph, wherein the multiple granularities include yearly granularity, monthly granularity and daily granularity, and the multi-granularity knowledge graph includes: yearly granularity knowledge graph, monthly granularity knowledge graph and daily granularity knowledge graph.

3. The method according to claim 2, characterized in that The using of the initial knowledge graph inference model to perform relevant processing on the multi-granularity knowledge graph to obtain multiple categories of evaluation scores includes: Performing vectorization processing on each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector, wherein the structure vector includes: an entity vector and an entity relationship vector; The structural vectors corresponding to each knowledge graph in the knowledge graphs of different granularities are fused to obtain fused structural information, wherein the fused structural information includes: a fused entity vector and a fused entity relationship vector; The fused structural information, time information and external correlation data are scored respectively using a multi-category scoring function to obtain the multi-category evaluation scores.

4. The method according to claim 3, characterized in that The vectorization process of each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector includes: Initialize each entity in each knowledge graph to obtain an initialized entity vector; and convert the event occurrence time into timestamp information and encode it to obtain an initial relationship vector; The entity nodes and entity relationship information adjacent to each entity are used to update the initialization entity vector and the initial relationship vector to obtain the entity vector and the entity relationship vector.

5. The method according to claim 3 or 4, characterized in that The step of fusing the structure vectors corresponding to each knowledge graph in the knowledge graphs of different granularities to obtain fused structure information includes: Based on the target vector, obtain the multi-granularity vector matrix of each entity in each knowledge graph; Get the attention scores of the multi-granularity vector matrix at different granularities; Calculating the attention scores at the different granularities to obtain calculation results; Among them, the target vector is the entity vector, the multi-granularity vector matrix is ​​the fused entity vector, and the calculation result is the fused entity vector; or, the target vector is the entity relationship vector, the multi-granularity vector matrix is ​​the fused entity relationship vector, and the calculation result is the fused entity relationship vector.

6. The method according to claim 3 or 4, characterized in that The time information is obtained by the following method: The relationship between the entities at the time when the event occurs is processed to obtain the time information.

7. The method according to claim 3 or 4, characterized in that The multiple categories of scoring functions include: a structural information scoring function, a time scoring function and a correlation information scoring function; the multiple categories of evaluation scores include: a structural score, a time score and a correlation score.

8. The method according to claim 7, characterized in that The method of using a multi-class scoring function to score the fused structural information, time information and external associated data respectively to obtain the multi-class evaluation scores includes: Scoring the fused entity vector and the fused entity relationship vector using the structural information scoring function to obtain the structural score; Scoring the time information using the time scoring function to obtain the time score; The external associated data is scored using the associated information scoring function to obtain the associated score.

9. The method according to any one of claims 3 to 4 and 8, characterized in that: The external associated data is obtained by the following method: Using the known entity names and known entity relationships in any quadruple in the training set as search keywords, obtain text information from the database; The keywords in the text information are converted into vectors to obtain a keyword vector matrix, wherein the keyword vector matrix is ​​the external association data.

10. A method for threat intelligence reasoning based on knowledge graph, characterized in that: include: Based on the known information in the quadruple of threat intelligence, all candidate entities or candidate relationships related to the known information are searched in the temporal knowledge graph; The candidate entity or the candidate relationship and the known information form a candidate quadruple, where the candidate quadruple is one or more; The candidate quadruple is input into the target knowledge graph reasoning model obtained by the method described in any one of claims 1 to 9, and an reasoning result is output, wherein the reasoning result includes at least one quadruple among the candidate quadruple whose score meets a preset condition.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 10 when executed by a processor.

12. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 10 when being run by the processor.

13. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 10 when executed by a processor.

Images