Methods, media, equipment, and products for training knowledge graph reasoning models and for knowledge graph-based threat intelligence reasoning.

Abstract

This application relates to the field of cybersecurity technology, specifically providing a method, medium, device, and product for training a knowledge graph reasoning model and for knowledge graph-based threat intelligence reasoning. The method for training the knowledge graph reasoning model may include: aggregating a time-series knowledge graph corresponding to threat intelligence data to obtain a multi-granularity knowledge graph; performing relevant processing on the multi-granularity knowledge graph using an initial knowledge graph reasoning model to obtain multiple evaluation scores; optimizing the initial knowledge graph reasoning model using the multiple evaluation scores and a loss value determined by a loss function to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to reason and predict any entity in the four-tuple of threat intelligence. Some embodiments of this application can improve the accuracy of knowledge graph reasoning.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and more specifically, to a method, medium, device, and product for training a knowledge graph reasoning model and for threat intelligence reasoning based on knowledge graphs. Background Technology

[0002] With the rapid development of internet technology, cybersecurity issues have become increasingly prominent. To improve network security, seeking effective threat detection and response mechanisms remains an important research direction.

[0003] Threat intelligence has become an indispensable part of cybersecurity. By collecting, processing, analyzing, and sharing information about existing or potential threats, threat intelligence can proactively identify and mitigate security risks. However, traditional threat intelligence analysis methods often collect incomplete information, leading to data silos, and lack in-depth correlation analysis, hindering accurate reasoning based on threat intelligence.

[0004] Therefore, how to provide a technical solution for knowledge graph reasoning of threat intelligence with high accuracy has become an urgent technical problem to be solved. Summary of the Invention

[0005] The purpose of some embodiments of this application is to provide a method, medium, device and product for training a knowledge graph reasoning model and for reasoning about threat intelligence based on a knowledge graph. The technical solutions of the embodiments of this application can achieve accurate reasoning of threat intelligence through a trained knowledge graph reasoning model.

[0006] In a first aspect, some embodiments of this application provide a method for training a knowledge graph reasoning model, comprising: aggregating a temporal knowledge graph corresponding to threat intelligence data to obtain a multi-granularity knowledge graph; performing relevant processing on the multi-granularity knowledge graph using an initial knowledge graph reasoning model to obtain multiple evaluation scores; wherein the relevant processing includes: vectorization, fusion, and scoring; optimizing the initial knowledge graph reasoning model using the multiple evaluation scores and a loss value determined by a loss function to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to reason and predict any entity in the four-tuple of threat intelligence.

[0007] Some embodiments of this application process the multi-granularity knowledge graph corresponding to threat intelligence data using an initial knowledge graph inference model to obtain multiple evaluation scores. Then, a loss function is used to calculate the loss value and optimize the initial knowledge graph inference model to obtain the target knowledge graph inference model. Some embodiments of this application can obtain a highly accurate target knowledge graph inference model through training, thereby improving the accuracy of subsequent threat intelligence inference.

[0008] In some embodiments, the aggregation of the temporal knowledge graph corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph includes: constructing the temporal knowledge graph from the threat intelligence data collected over time, wherein the knowledge graph at each moment in the temporal knowledge graph is a quadruple, the quadruple including: head entity, tail entity, inter-entity relationship, and event occurrence time; and aggregating the temporal knowledge graph according to multiple granularities to obtain the multi-granularity knowledge graph, wherein the multiple granularities include yearly granularity, monthly granularity, and daily granularity, and the multi-granularity knowledge graph includes: annual granularity knowledge graph, monthly granularity knowledge graph, and daily granularity knowledge graph.

[0009] Some embodiments of this application obtain multi-granularity knowledge graphs by aggregating the temporal knowledge graphs constructed from threat intelligence data at multiple granularities, which can provide rich data information support for model training.

[0010] In some embodiments, the step of using an initial knowledge graph reasoning model to perform relevant processing on the multi-granularity knowledge graph to obtain multiple evaluation scores includes: vectorizing each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector, wherein the structure vector includes an entity vector and an entity relation vector; fusing the structure vectors corresponding to each knowledge graph in different granularity knowledge graphs to obtain fused structure information, wherein the fused structure information includes a fused entity vector and a fused entity relation vector; and using multiple scoring functions to score the fused structure information, time information, and external related data respectively to obtain the multiple evaluation scores.

[0011] Some embodiments of this application process multi-granularity knowledge graphs through an initial knowledge graph reasoning model to obtain multiple evaluation scores, which provides support for subsequent model optimization and obtaining a target knowledge graph model with higher accuracy.

[0012] In some embodiments, the step of vectorizing each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector includes: initializing each entity in each knowledge graph to obtain an initial entity vector; and encoding the event occurrence time into timestamp information to obtain an initial relation vector; and updating the initial entity vector and the initial relation vector using the entity nodes adjacent to each entity and entity relation information to obtain the entity vector and the entity relation vector.

[0013] Some embodiments of this application can improve the accuracy of model reasoning by performing vector processing on each entity and encoding static timestamp information in the initial knowledge graph reasoning model.

[0014] In some embodiments, fusing the structural vectors corresponding to each knowledge graph in knowledge graphs of different granularities to obtain fused structural information includes: obtaining a multi-granularity vector matrix for each entity in each knowledge graph based on a target vector; obtaining attention scores of the multi-granularity vector matrix at different granularities; calculating the attention scores at different granularities to obtain a calculation result; wherein the target vector is the entity vector, the multi-granularity vector matrix is ​​the fused entity vector, and the calculation result is the fused entity vector; or, the target vector is the entity relation vector, the multi-granularity vector matrix is ​​the fused entity relation vector, and the calculation result is the fused entity relation vector.

[0015] Some embodiments of this application fuse entity-related vectors at different granularities to obtain fused entity vectors, which provides support for improving the accuracy of subsequent model inference.

[0016] In some embodiments, the time information is obtained by processing the inter-entity relationships at the time the event occurred to obtain the time information.

[0017] Some embodiments of this application obtain time information by processing the time of event occurrence, providing data support for subsequent model training.

[0018] In some embodiments, the multiple scoring functions include: a structural information scoring function, a time scoring function, and a correlation information scoring function; the multiple evaluation scores include: a structural score, a time score, and a correlation score.

[0019] Some embodiments of this application improve the accuracy of model training by evaluating relevant information from multiple perspectives.

[0020] In some embodiments, the step of using multiple scoring functions to score the fused structural information, temporal information, and externally related data to obtain the multiple evaluation scores includes: using the structural information scoring function to score the fused entity vector and the fused entity relationship vector to obtain the structural score; using the temporal scoring function to score the temporal information to obtain the temporal score; and using the related information scoring function to score the externally related data to obtain the related score.

[0021] Some embodiments of this application use different scoring functions to score different information and obtain different scores, which can improve the accuracy of model training.

[0022] In some embodiments, the external related data is obtained by the following method: using the known entity names and known relationships between entities in any quadruple in the training set as search keywords, text information is obtained from the database; the keywords in the text information are converted into vectors to obtain a keyword vector matrix, wherein the keyword vector matrix is ​​the external related data.

[0023] Some embodiments of this application integrate relevant external data into the model, providing richer information support for the model.

[0024] Secondly, some embodiments of this application provide a method for threat intelligence reasoning based on a knowledge graph, comprising: searching for all candidate entities or candidate relationships related to the known information in a time-series knowledge graph based on known information in a four-tuple of threat intelligence; forming candidate four-tuples with the known information, wherein the candidate four-tuples may be one or more; inputting the candidate four-tuples into a target knowledge graph reasoning model and outputting a reasoning result, wherein the reasoning result includes at least one four-tuple whose score satisfies a preset condition.

[0025] Some embodiments of this application use the target knowledge graph reasoning model trained by the first aspect embodiment to reason about threat intelligence, which is both efficient and accurate.

[0026] Thirdly, some embodiments of this application provide an apparatus for training a knowledge graph reasoning model, comprising: an aggregation module for aggregating a temporal knowledge graph corresponding to threat intelligence data to obtain a multi-granularity knowledge graph; a model processing module for performing relevant processing on the multi-granularity knowledge graph using an initial knowledge graph reasoning model to obtain multiple evaluation scores; wherein the relevant processing includes: vectorization, fusion, and scoring; and an optimization module for optimizing the initial knowledge graph reasoning model using the multiple evaluation scores and a loss value determined by a loss function to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to reason and predict any entity in the four-tuple of threat intelligence.

[0027] Fourthly, some embodiments of this application provide an apparatus for threat intelligence reasoning based on a knowledge graph, comprising: a search module for searching for all candidate entities or candidate relationships related to the known information in a time-series knowledge graph based on known information in a quadruple of threat intelligence; a composition module for composing candidate quadruples with the known information, wherein the candidate quadruples may be one or more; and a reasoning module for inputting the candidate quadruples into a target knowledge graph reasoning model and outputting a reasoning result, wherein the reasoning result includes at least one quadruple whose score satisfies a preset condition.

[0028] Fifthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0029] In a sixth aspect, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method as described in any embodiment of the first aspect.

[0030] In a seventh aspect, some embodiments of this application provide a computer program product comprising a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A system diagram for knowledge graph-based threat intelligence reasoning provided for some embodiments of this application;

[0033] Figure 2 Flowchart of a method for training a knowledge graph reasoning model provided for some embodiments of this application;

[0034] Figure 3 A schematic diagram of knowledge graph aggregation provided for some embodiments of this application;

[0035] Figure 4 One of the flowcharts for a knowledge graph-based threat intelligence reasoning method provided for some embodiments of this application;

[0036] Figure 5 A second flowchart of a knowledge graph-based threat intelligence reasoning method provided for some embodiments of this application;

[0037] Figure 6 Block diagram of the apparatus for training knowledge graph reasoning models provided for some embodiments of this application;

[0038] Figure 7 A block diagram of an apparatus for knowledge graph-based threat intelligence reasoning provided for some embodiments of this application;

[0039] Figure 8 A schematic diagram of an electronic device provided for some embodiments of this application. Detailed Implementation

[0040] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0041] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0042] With the rapid development of internet technology, cyberattack methods are constantly evolving. Attackers often employ complex strategies to attack critical information systems in individuals and businesses, leading to severe economic losses and social impact. To effectively address these threats, security experts have been seeking more effective threat detection and response mechanisms. Current technologies propose inferring correlations in threat intelligence by constructing knowledge graphs. However, the data in existing knowledge graphs is sparse, with limited information available at certain times, significantly impacting the accuracy of inference. Furthermore, current technologies typically use gated recurrent neural networks to capture temporal evolution knowledge through graph changes at adjacent times, ignoring the static timestamp information in temporal knowledge graphs, which may also lead to lower accuracy in the final inference.

[0043] In view of this, some embodiments of this application provide a method for threat intelligence reasoning based on knowledge graphs. In this method, threat intelligence data from different sources are integrated by constructing a temporal knowledge graph related to threat intelligence. The structured representation of the temporal knowledge graph is used to train a model to mine the hidden correlation information in the threat intelligence, thereby assisting security analysts in making more accurate judgments.

[0044] The following is in conjunction with the appendix Figure 1The overall structure of a knowledge graph-based threat intelligence reasoning system provided by some embodiments of this application is illustrated by way of example.

[0045] like Figure 1 As shown, some embodiments of this application provide a system for threat intelligence reasoning based on a knowledge graph. This system may include a terminal 100 and an inference server 200. Specifically, the terminal 100 can send known information within the associated quadruples of the threat intelligence to be inferred to the inference server 200. The inference server 200 can obtain candidate quadruples based on this known information through search and composition operations; finally, it inputs the candidate quadruples into a trained target knowledge graph inference model and outputs at least one inferred quadruple that meets preset conditions.

[0046] In some embodiments of this application, the trained target knowledge graph inference model is obtained by training with threat intelligence-related data, and it may be pre-deployed in the inference server 200. Additionally, the terminal 100 may be a mobile terminal or a non-portable computer terminal; this embodiment of the application does not specifically limit the type of terminal.

[0047] To achieve accurate reasoning about the correlation data of threat intelligence, a well-trained target knowledge graph reasoning model is first needed. Therefore, the following section combines the attached... Figure 2 The implementation process of training a knowledge graph inference model executed by an inference server 200, provided by some embodiments of this application, is illustrated by way of example.

[0048] Please see the appendix Figure 2 , Figure 2 A flowchart of a method for training a knowledge graph reasoning model is provided for some embodiments of this application. The method for training a knowledge graph reasoning model may include:

[0049] S210 aggregates the time-series knowledge graphs corresponding to threat intelligence data to obtain multi-granularity knowledge graphs.

[0050] For example, in some embodiments of this application, in order to capture knowledge at different granularities, it is necessary to aggregate the temporal knowledge graphs corresponding to threat intelligence data to obtain knowledge graphs at different granularities.

[0051] In some embodiments of this application, S210 may include: constructing the time-series knowledge graph from the threat intelligence data collected over time, wherein the knowledge graph at each moment in the time-series knowledge graph is a quadruple, the quadruple including: head entity, tail entity, inter-entity relationship and event occurrence time; aggregating the time-series knowledge graph according to multiple granularities to obtain the multi-granularity knowledge graph, wherein the multiple granularities include yearly granularity, monthly granularity and daily granularity, and the multi-granularity knowledge graph includes: annual granularity knowledge graph, monthly granularity knowledge graph and daily granularity knowledge graph.

[0052] For example, in some embodiments of this application, threat intelligence data such as assets, intelligence, and vulnerabilities are collected according to time, and a temporal knowledge graph G corresponding to the threat intelligence data is constructed, G = {G}. (1) , G (2) , ..., G (t)}, G (t) Let G represent the knowledge graph at time t. (t) There are quadruplets<s,r,o,t> Where s is the head entity, o is the tail entity, r is the relationship between entities, and t is the time when the event occurs (i.e., time t).

[0053] Specifically, in order to capture knowledge at different granularities, the knowledge graph G... (t) Aggregation was performed at three granularities: year, month, and day, resulting in the year-granularity knowledge graph G. (y) Monthly Granularity Knowledge Graph G (m) Daily Particle Size Knowledge Graph G (d) The specific aggregation rules are as follows: Figure 3 As shown, the knowledge graph G on the left (t) There are quadruplets<s,r,o,t1> and<s,r,o,t2> Where time t1 and time t2 are different, if time t1 and time t2 are in the same year (e.g. Figure 3 If all values ​​are from 2013, then the quaternions can be categorized by year.<s,r,o,t1> and<s,r,o,t2> merged into Figure 3 The knowledge graph shown on the right side of the middle section<s,r,o,year> The aggregated knowledge graph is the annual granularity knowledge graph G. (y) Similarly, monthly and daily granularity knowledge graphs can be obtained.

[0054] S220, the multi-granularity knowledge graph is processed using the initial knowledge graph reasoning model to obtain multiple evaluation scores; wherein, the processing includes vectorization, fusion and scoring.

[0055] For example, in some embodiments of this application, multi-granularity knowledge graph structural information is modeled. CompGCN (as a specific example of an initial knowledge graph reasoning model) is used to capture structured dependency information in the multi-granularity knowledge graph, ultimately obtaining multi-class evaluation scores.

[0056] In some embodiments of this application, S220 may include:

[0057] S221, each knowledge graph in the multi-granularity knowledge graph is vectorized to obtain a structure vector, wherein the structure vector includes: an entity vector and an entity relation vector.

[0058] For example, in some embodiments of this application, the structural information (i.e., entities and relationships between entities) of knowledge graphs at different granularities at time t is processed to obtain structural vectors.

[0059] In some embodiments of this application, S221 may include: initializing each entity in each knowledge graph to obtain an initial entity vector; and encoding the event occurrence time into timestamp information to obtain an initial relation vector; and updating the initial entity vector and the initial relation vector using the entity nodes adjacent to each entity and entity relation information to obtain the entity vector and the entity relation vector.

[0060] For example, in some embodiments of this application, a low-dimensional embedding vector is initialized for each entity in each knowledge graph to represent the entity, resulting in an initial entity vector. Considering that each entity relationship in a temporal knowledge graph contains the event occurrence time, the event occurrence time corresponding to each entity relationship is converted into a timestamp, and then encoded into a vector using sine and cosine coding, serving as the initial relationship vector for that entity relationship. This incorporates static timestamp information into the model, improving the accuracy of model training.

[0061] Next, the initial entity vector is updated based on the neighbor node information (as a specific example of adjacent entity nodes) and entity relationship information of each entity. The update formula is as follows:

[0062]

[0063] In the formula, Let be the initial vectors of the adjacent entity u and the relationship r between entities at time t, respectively. W is the entity vector of the updated entity v. λ(r) It is a specific parameter of the relation type, and φ(·) is a combination operation of vectors, such as addition and subtraction.

[0064] The update formula for the initial relation vector is as follows:

[0065]

[0066] In the formula, W rel It is a learnable transformation matrix. It is the entity relation vector representation of relation r after the update at time t.

[0067] S222, the structure vectors corresponding to each knowledge graph in the knowledge graphs of different granularities are fused to obtain fused structure information, wherein the fused structure information includes: fused entity vectors and fused entity relation vectors.

[0068] For example, in some embodiments of this application, the attention mechanism is used to fuse the structure vectors of knowledge graphs at different granularities to obtain fused entity representations and relation representations, namely fused entity vectors and fused entity relation vectors.

[0069] In some embodiments of this application, S222 may include: obtaining a multi-granularity vector matrix for each entity in each knowledge graph based on the target vector; obtaining attention scores of the multi-granularity vector matrix at different granularities; calculating the attention scores at different granularities to obtain a calculation result; wherein the target vector is the entity vector, the multi-granularity vector matrix is ​​a multi-granularity entity vector matrix, and the calculation result is a fused entity vector; or, the target vector is the entity relation vector, the multi-granularity vector matrix is ​​the multi-granularity relation vector matrix, and the calculation result is a fused entity relation vector.

[0070] For example, in some embodiments of this application, the process of obtaining the fused entity relationship vector is illustrated using the entity vector fusion process as an example. The annual granularity knowledge graph G at time t will be... (y) Monthly Granularity Knowledge Graph G (m) Daily Particle Size Knowledge Graph G (d) The entity vector of entity v in the corresponding context is represented as: and This yields the multi-granularity vector matrix of entity v. (As a concrete example of a multi-granularity entity vector matrix). Scaled dot product attention is used to score multi-granularity vector matrices corresponding to different granularities, using the following formula:

[0071]

[0072] In the formula, e (g,t) W is the vector fraction of g-granularity (i.e., year, month, day granularity) at time t. q and W k are the learnable parameter matrices, and d is the dimension of the vector.

[0073] For e (g,t) After normalization, the attention score β of the entity vector at the g granularity is obtained. (g,t) Attention score β (g,t) The calculation formula is as follows:

[0074]

[0075] Finally, the attention score was used to evaluate H. v t After weighted summation of the vectors, the final multi-granularity vector representation of the entity at time t is obtained, i.e., the fused entity vector. As shown in the following formula:

[0076]

[0077] Among them, W v Let be a learnable parameter matrix, and sum(·) be the matrix summation function by row.

[0078] It should be noted that the fusion process of entity relationship representations is the same as that of entity v described above, and will not be repeated here. Through the above fusion method, the multi-granularity vector representation of relationship r at time t can be obtained, that is, the fused entity relationship vector.

[0079] In some embodiments of this application, time information is obtained by processing the inter-entity relationships at the time the event occurred to obtain the time information.

[0080] For example, in some embodiments of this application, GRU is used to model the temporal evolution pattern of events to obtain the temporal evolution representation of relation r at time t, i.e., temporal information. The specific calculation formula is as follows:

[0081]

[0082] S223, using multiple scoring functions to score the fused structural information, temporal information, and externally related data respectively, to obtain the multiple evaluation scores. The multiple scoring functions include: a structural information scoring function, a temporal scoring function, and a related information scoring function; the multiple evaluation scores include: a structural score, a temporal score, and a related score.

[0083] For example, in some embodiments of this application, each possible quadruple is scored from the perspectives of structural information (i.e., fused structural information), temporal evolution information (i.e., temporal information), and external information (i.e., externally related data). Specifically, multiple scoring functions are used to score the fused quadruple data obtained above. The system also scores external related data to obtain multiple evaluation scores, which facilitates the training of a highly accurate target knowledge graph reasoning model.

[0084] In some embodiments of this application, S223 may include:

[0085] S2231, The fused entity vector and the fused entity relationship vector are scored using the structural information scoring function to obtain the structural score.

[0086] For example, in some embodiments of this application, DistMult is used to score the quadruplets of structural information, and the formula for the structural information scoring function is:

[0087]

[0088] In the formula, Let I be the fused vector corresponding to entity s, the relationship between entities r, and entity o at time t. s This is the structural score.

[0089] S2232, The time information is scored using the time scoring function to obtain the time score.

[0090] For example, in some embodiments of this application, the time scoring function for time evolution information is:

[0091]

[0092] In the formula, W t For a learnable parameter matrix, Let I be the temporal evolution representation of the relationship r between entities at time t. t This is the structural score.

[0093] In some embodiments of this application, external related data is obtained by the following method: using the known entity names and known relationships between entities in any quadruple in the training set as search keywords, text information is obtained from the database; the keywords in the text information are converted into vectors to obtain a keyword vector matrix, wherein the keyword vector matrix is ​​the external related data.

[0094] For example, in some embodiments of this application, considering the potential data sparsity problem in knowledge graphs, where available information is limited at certain times, relevant text information from the knowledge graph is collected as external information by searching keywords in databases on the Internet. If the current inference task (as a specific example of any quadruple in the training set) is: given the head entity, inter-entity relations, and time t in the quadruple, inferring the tail entity in the quadruple, then the search keyword (or retrieval keyword) is "head entity name + inter-entity relation name," and relevant text information is found. Then, keywords are extracted from the text information, and the BERT model is used to convert the keywords into vectors, constructing a keyword vector matrix W = {W1, W2...W...}. l}

[0095] S2233, The external related data is scored using the related information scoring function to obtain the related score.

[0096] For example, in some embodiments of this application, the formula for the association information scoring function is as follows:

[0097]

[0098] In the formula, W w Given a learnable parameter matrix, avgpool(W) represents average pooling of the keyword vector matrix W. w This is the associated score.

[0099] S230, using the multi-class evaluation scores and the loss value determined by the loss function, optimize the initial knowledge graph reasoning model to obtain the trained target knowledge graph reasoning model; wherein, the target knowledge graph reasoning model is used to reason and predict any entity in the four-tuple of threat intelligence.

[0100] For example, in some embodiments of this application, the loss value of the multi-class ratings obtained above is calculated using the following loss function. After obtaining the loss value, the initial knowledge graph inference model is optimized until the loss value meets the set conditions, at which point the target knowledge graph inference model is output; or the target knowledge graph inference model is output after reaching the required number of iterations. The specific formula for the loss function is as follows:

[0101]

[0102] In the formula, I * The I obtained from the above calculation s I t I w .

[0103] After obtaining the target knowledge graph reasoning model through the above embodiments, reasoning operations can be performed on related threat intelligence reasoning tasks. The following is a related example. Figure 4 The present application provides an exemplary description of the specific process of threat intelligence reasoning based on knowledge graphs, as illustrated in some embodiments of this application.

[0104] Please see the appendix Figure 4 , Figure 4 A flowchart of a knowledge graph-based threat intelligence reasoning method is provided for some embodiments of this application. This knowledge graph-based threat intelligence reasoning method may include:

[0105] S410, based on the known information in the quadruple of threat intelligence, search in the time-series knowledge graph for all candidate entities or candidate relationships related to the known information.

[0106] For example, in some embodiments of this application, given the head entity s, the inter-entity relation r, and time t (as a specific example of known information) in the quadruple, the quadruple is inferred.<s,r,?,t> The process involves searching the temporal knowledge graph for all possible tail entities and constructing a candidate tail entity set (as a concrete example of a candidate entity). Specifically, the entity types of the head entities and the tail entities (TAIL) of all relations r in the knowledge graph are statistically analyzed, and a rule set RULE = {(HEAD, r, TAIL)} is constructed. Tail entities whose head entity type HEAD is the same as the head entity type s and whose relation is r (TAIL) are added to the candidate tail entity type set TA. The temporal knowledge graph is then traversed, searching for entities whose entity types are in the candidate tail entity type set TA, and these are added to the candidate tail entity set candidate. Alternatively, in another implementation, a set of candidate relations that exist with the known information entity s, the inter-entity relation r, and time t can be selected.

[0107] S420, the candidate entity or the candidate relationship is combined with the known information to form a candidate quadruple, wherein the candidate quadruple is one or more.

[0108] For example, in some embodiments of this application, the candidate tail entity set `candidate` is traversed, and candidate quadruples are constructed using the candidate tail entities, the head entity `s`, the inter-entity relationship `r`, and the time `t`. Alternatively, candidate quadruples can be constructed using candidate relationships.

[0109] S430, the candidate quadruplets are input into the target knowledge graph reasoning model, and the reasoning result is output, wherein the reasoning result includes at least one quadruplet among the candidate quadruplets whose scores meet the preset conditions.

[0110] For example, in some embodiments of this application, subsequent quadruplets are input into the target knowledge graph reasoning model trained above. The candidate quadruplets are scored using multiple scoring functions within the target knowledge graph reasoning model, and the sum of the function values ​​of the three scoring functions is the score for each candidate quadruplet. The top k quadruplets with the highest scores (as a specific example of a preset condition) are used as the reasoning result; or quadruplets with scores greater than a preset threshold (as another specific example of a preset condition) are used as the reasoning result.

[0111] The following is in conjunction with the appendix Figure 5 The present application provides an exemplary description of the specific process of threat intelligence reasoning based on knowledge graphs, as illustrated in some embodiments of this application.

[0112] Please see the appendix Figure 5 , Figure 5 A flowchart of a knowledge graph-based threat intelligence reasoning method is provided for some embodiments of this application.

[0113] The above process is illustrated below by example.

[0114] S510 will construct a time-series knowledge graph based on the threat intelligence data collected over time.

[0115] S520 aggregates the time-series knowledge graph according to multiple granularities to obtain a multi-granularity knowledge graph.

[0116] S530 uses the initial knowledge graph reasoning model to vectorize each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector.

[0117] S540 utilizes the initial knowledge graph reasoning model to fuse the structural vectors corresponding to each knowledge graph in knowledge graphs of different granularities, thereby obtaining fused structural information.

[0118] S550 uses multiple scoring functions to score the fused structural information, temporal information, and external correlation data respectively, and obtains multiple evaluation scores.

[0119] S560 optimizes the initial knowledge graph reasoning model by using multi-class evaluation scores and loss values ​​determined by the loss function, and obtains the trained target knowledge graph reasoning model.

[0120] S570 uses known information from the threat intelligence quadruple to search for candidate entities related to the entity to be predicted in the time-series knowledge graph.

[0121] For example, if the reasoning question is "Which asset did Organization A control on November 1, 2024?", then the four-tuple of the query threat intelligence would be <Organization A, Control, ?, November 1, 2024>. Based on the query four-tuple, all possible candidate tail entities C (i.e., candidate entities) are searched in the temporal knowledge graph.

[0122] S580, form candidate quadruples with the candidate entities and known information.

[0123] S590: Input the candidate quadruples into the target knowledge graph reasoning model and output the reasoning results.

[0124] For example, the query quadruple is input into the target knowledge graph reasoning model, and a scoring function is used to score all candidate quadruples <Organization A, Control, C, November 1, 2024>. The top k candidate tail entities with the highest scores are the reasoning results. The reasoning results can be quadruples containing C, or they can contain only C. This embodiment of the application does not make specific limitations here.

[0125] It should be understood that the specific implementation process of S510 to S590 can be referred to the method embodiments provided above. To avoid repetition, detailed descriptions are omitted here.

[0126] As can be seen from the embodiments described above, this application provides more contextual information through static timestamps. Encoding static timestamp information into the target knowledge graph reasoning model can effectively improve the model's performance. By introducing external related data, the model can capture more historical information, thereby improving the accuracy of reasoning.

[0127] Please refer to Figure 6 , Figure 6 The diagram illustrates the composition of an apparatus for training a knowledge graph reasoning model according to some embodiments of this application. It should be understood that this apparatus corresponds to the method embodiments described above and is capable of performing the various steps involved in the method embodiments. The specific functions of this apparatus for training a knowledge graph reasoning model can be found in the description above; detailed descriptions are omitted here to avoid repetition.

[0128] Figure 6The apparatus for training a knowledge graph reasoning model includes at least one software functional module that can be stored in a memory or embedded in the apparatus in the form of software or firmware. The apparatus includes: an aggregation module 610 for aggregating the temporal knowledge graph corresponding to threat intelligence data to obtain a multi-granularity knowledge graph; a model processing module 620 for performing relevant processing on the multi-granularity knowledge graph using an initial knowledge graph reasoning model to obtain multiple evaluation scores; wherein the relevant processing includes vectorization, fusion, and scoring; and an optimization module 630 for optimizing the initial knowledge graph reasoning model using the multiple evaluation scores and a loss value determined by a loss function to obtain a trained target knowledge graph reasoning model; wherein the target knowledge graph reasoning model is used to reason and predict any entity in the four-tuple of threat intelligence.

[0129] Please refer to Figure 7 , Figure 7 The diagram illustrates a block diagram of a knowledge graph-based threat intelligence reasoning method provided in some embodiments of this application. It should be understood that this knowledge graph-based threat intelligence reasoning apparatus corresponds to the method embodiments described above and is capable of performing the various steps involved in the method embodiments. The specific functions of this knowledge graph-based threat intelligence reasoning apparatus can be found in the description above; detailed descriptions are omitted here to avoid repetition.

[0130] Figure 7 The knowledge graph-based threat intelligence reasoning device includes at least one software functional module that can be stored in a memory or embedded in the device in the form of software or firmware. The device includes: a search module 710, used to search for all candidate entities or candidate relationships related to the known information in a time-series knowledge graph based on known information in the threat intelligence quadruples; a composition module 720, used to combine the candidate entities or candidate relationships with the known information to form candidate quadruples, wherein the candidate quadruples can be one or more; and a reasoning module 730, used to input the candidate quadruples into a target knowledge graph reasoning model and output a reasoning result, wherein the reasoning result includes at least one quadruple whose score satisfies a preset condition.

[0131] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0132] Some embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can perform the operation of any of the methods corresponding to the methods provided in the above embodiments.

[0133] Some embodiments of this application also provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the above embodiments provided in the above embodiments.

[0134] like Figure 8 As shown, some embodiments of this application provide an electronic device 800, which includes a memory 810, a processor 820, and a computer program stored in the memory 810 and executable on the processor 820. When the processor 820 reads the program from the memory 810 via a bus 830 and executes the program, it can implement the methods of any of the above embodiments.

[0135] Processor 820 can process digital signals and can include various computing architectures. Examples include complex instruction set computer architectures, reduced instruction set computer architectures, or architectures that implement multiple instruction set combinations. In some examples, processor 820 can be a microprocessor.

[0136] The memory 810 can be used to store instructions executed by the processor 820 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 820 of this disclosure embodiment can be used to execute the instructions in the memory 810 to implement the methods shown above. The memory 810 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0137] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0138] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0139] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for training a knowledge graph reasoning model, characterized in that, include: Aggregate the time-series knowledge graphs corresponding to threat intelligence data to obtain multi-granularity knowledge graphs; The multi-granularity knowledge graph is processed using an initial knowledge graph reasoning model to obtain multiple evaluation scores; wherein, the processing includes vectorization, fusion, and scoring. Using the multi-class evaluation scores and the loss value determined by the loss function, the initial knowledge graph reasoning model is optimized to obtain a trained target knowledge graph reasoning model; wherein, the target knowledge graph reasoning model is used to reason and predict any entity in the four-tuple of threat intelligence; The aggregation of the temporal knowledge graph corresponding to the threat intelligence data to obtain a multi-granularity knowledge graph includes: constructing the temporal knowledge graph from the threat intelligence data collected over time, wherein the knowledge graph at each moment in the temporal knowledge graph is a quadruple, and the quadruple includes: head entity, tail entity, inter-entity relationship, and event occurrence time; and aggregating the temporal knowledge graph according to multiple granularities to obtain the multi-granularity knowledge graph, wherein the multiple granularities include yearly granularity, monthly granularity, and daily granularity, and the multi-granularity knowledge graph includes: annual granularity knowledge graph, monthly granularity knowledge graph, and daily granularity knowledge graph; The step of using an initial knowledge graph reasoning model to process the multi-granularity knowledge graph and obtain multiple evaluation scores includes: vectorizing each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector, wherein the structure vector includes an entity vector and an entity relation vector; fusing the structure vectors corresponding to each knowledge graph in different granularity knowledge graphs to obtain fused structure information, wherein the fused structure information includes a fused entity vector and a fused entity relation vector; and using multiple scoring functions to score the fused structure information, time information, and external related data to obtain the multiple evaluation scores. The step of fusing the structural vectors corresponding to each knowledge graph in different granularity knowledge graphs to obtain fused structural information includes: obtaining a multi-granularity vector matrix for each entity in each knowledge graph based on the target vector; obtaining the attention score of the multi-granularity vector matrix at different granularities; calculating the attention score at different granularities to obtain a calculation result; wherein the target vector is the entity vector, the multi-granularity vector matrix is ​​a multi-granularity entity vector matrix, and the calculation result is the fused entity vector; or, the target vector is the entity relation vector, the multi-granularity vector matrix is ​​a multi-granularity relation vector matrix, and the calculation result is the fused entity relation vector.

2. The method as described in claim 1, characterized in that, The vectorization process for each knowledge graph in the multi-granularity knowledge graph to obtain a structure vector includes: Each entity in each knowledge graph is initialized to obtain an initial entity vector; and the event occurrence time is converted into timestamp information and then encoded to obtain an initial relation vector. By using the adjacent entity nodes and entity relationship information of each entity, the initial entity vector and the initial relationship vector are updated to obtain the entity vector and the entity relationship vector.

3. The method as described in claim 1 or 2, characterized in that, The time information was obtained through the following method: The relationships between entities at the time of the event are processed to obtain the time information.

4. The method as described in claim 1 or 2, characterized in that, The multiple scoring functions include: structural information scoring function, time scoring function, and correlation information scoring function; the multiple evaluation scores include: structural score, time score, and correlation score.

5. The method as described in claim 4, characterized in that, The method of using multiple scoring functions to score the fused structural information, temporal information, and external correlation data respectively, to obtain the multiple evaluation scores, includes: The fused entity vector and the fused entity relationship vector are scored using the structural information scoring function to obtain the structural score; The time information is scored using the time scoring function to obtain the time score; The external related data is scored using the related information scoring function to obtain the related score.

6. The method according to any one of claims 1-2 and 5, characterized in that, The externally associated data is obtained through the following method: Using the known entity names and known relationships between entities within any quadruple in the training set as search keywords, text information is retrieved from the database. The keywords in the text information are converted into vectors to obtain a keyword vector matrix, wherein the keyword vector matrix is ​​the external associated data.

7. A method for threat intelligence reasoning based on knowledge graphs, characterized in that, include: Based on the known information in the four-tuple of threat intelligence, all candidate entities or candidate relationships related to the known information are searched in the time-series knowledge graph. The candidate entity or the candidate relation is combined with the known information to form a candidate quadruple, and the candidate quadruple can be one or more. The candidate quadruples are input into the target knowledge graph reasoning model obtained by the method according to any one of claims 1 to 6, and the reasoning result is output, wherein the reasoning result includes at least one quadruple among the candidate quadruples whose score satisfies a preset condition.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, performs the method as described in any one of claims 1-7.

9. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program is executed by the processor to perform the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program, wherein the computer program is executed by a processor to perform the method as described in any one of claims 1-7.

Images