Network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph

Abstract

The invention discloses a network routing mechanism vulnerability analysis method based on a graph neural network and a knowledge graph, and the method comprises the steps: carrying out the simulation of a network routing mechanism vulnerability analysis structure based on the graph neural network and the knowledge graph of a target low-orbit interconnection network topology, and designing a fault injection experiment for a routing program in the simulation network topology, dynamically collecting vulnerability information of a network routing mechanism, and constructing a vulnerability data set of the network routing mechanism; constructing a network routing mechanism vulnerability domain ontology NRMVO based on four dimensions of assets, a network, software and vulnerability; performing knowledge extraction on a program for realizing network routing, analyzing relevance between complex structure information of the routing program and vulnerability of the network routing program, and constructing a vulnerability knowledge graph of a target low-orbit internet routing mechanism; the result is stored in a graph database, and knowledge graph visualization is achieved; and constructing a target network routing mechanism vulnerability analysis model HGAT-BNR, and analyzing the vulnerability of the network routing mechanism from four dimensions of a data flow, a control flow, a call flow and an access flow. The method has the advantages of high efficiency and high accuracy, and an effective analysis method is provided for improving the reliability and safety of a network routing mechanism.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and trusted vulnerability analysis, and in particular to a network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph. Background Art

[0002] The low-orbit interconnection network is based on communication satellites connected by intersatellite links, with information acquisition, information fusion, information transmission and information distribution as its main functions. The low-orbit interconnection network is a satellite network. In a complex environment, low-orbit satellites may be affected by single-particle effects and output incorrect operating results. The impact of transient errors caused by single-particle effects on satellite node routing can generally be divided into two categories: data flow errors and control flow errors. Data flow errors are transient errors caused by single-particle effects that modify the values ​​in the storage units (such as registers, program and data memories) in the router, causing errors in communication data. Control flow errors usually occur in the storage units that implement routing algorithms. Due to soft errors caused by single-particle effects, data may be sent in the wrong direction. In order to ensure the reliability and security of the low-orbit interconnection network, the prediction and analysis of the vulnerability of the low-orbit interconnection network is crucial.

[0003] At present, the research focus at home and abroad is on satellite network security routing protocols, and the research on satellite network security routing protocols mainly focuses on the application of IP protocols. However, due to the unpredictable forms of routing attacks, routing security protocols cannot take into account all threats during the design process, so it is very important to study the overall reliability and security of the routing mechanism. Existing research work mainly includes the study of network routing through traditional evaluation methods, machine learning, knowledge graphs, etc. For example, Zheng Jing et al. designed a trust evaluation mechanism based on medium-orbit satellites for low-orbit satellite networks to build trusted routing for low-orbit satellite networks. Corresponding solutions are proposed for possible satellite node failures and inter-satellite link congestion problems. NISHIYAMAH et al. proposed a routing protocol based on load balancing and designed a new network structure for LEO / MEO dual-layer satellite networks. However, this method has a large overhead problem in practical applications.

[0004] With the development of machine learning theory, research on the combination of machine learning and routing mechanisms is also booming. For example, Cheng Yi proposed a single-particle flip simulation software fault injection method based on random forests, analyzed the characteristics related to the single-particle flip vulnerability of instructions, improved the traditional fault injection method, and used the random forest algorithm to train the instruction vulnerability prediction model. Zhang Qianwen proposed an instruction SDC vulnerability analysis method based on machine learning. Through fault injection experiments, statistical data related to SDC errors were obtained, program slicing technology was introduced, instruction features were extracted during program compilation, and the SDC vulnerability of instructions was predicted by the prediction model trained by the training program.

[0005] The vulnerability analysis methods of network routing mechanisms used in existing research have not fully considered the variability and integrity of network routing security, resulting in a large number of security vulnerabilities in the network. Knowledge graph is a graph-based knowledge representation method that can integrate, extract and store multi-source, heterogeneous and dynamic knowledge. It can well associate and analyze existing entities in the network and better extract rich semantic information hidden between entities. It has been applied in many fields. For example, Ma J et al. proposed a heterogeneous graph GATPS (Graph Attention Network to Predict SDC-prone Instructions) with different types of edges to represent various instruction relationships. By stacking layers in which nodes can pay attention to their neighborhood features, GATPS can automatically capture structural features that contribute to SDC propagation. The attention mechanism is applied to calculate the importance of adjacent nodes and quantify the impact of adjacent node failures. Liu Xin et al. cleverly integrated the idea of ​​knowledge graphs into the field of fault diagnosis and analysis. They combined the fault tree diagnosis method, the failure mode and consequence analysis method with the ontology construction and reasoning function of the knowledge graph, providing a novel and feasible solution for knowledge sharing, strong versatility and intelligent fault diagnosis technology. Although there have been studies on knowledge graphs of single-particle upset-induced failures and network vulnerabilities, the prediction of network vulnerabilities is not accurate enough because the features extracted by the program are not accurate enough and the entity relationships used to construct the knowledge graph are not comprehensive enough.

[0006] In summary, although graph neural networks and knowledge graphs have matured as strong artificial intelligence tools with cognitive capabilities, the following issues still need to be further studied in the analysis of network routing mechanism vulnerability: (1) The entity relationships of the knowledge graph for constructing network routing mechanism vulnerability are not comprehensive enough. (2) The prediction of network vulnerability is not accurate enough. Summary of the invention

[0007] The purpose of the present invention is to provide a method for solving the vulnerability analysis of network routing mechanisms based on the currently popular knowledge graph technology in response to the problems existing in the above-mentioned prior art. The programs that implement the network routing mechanism in the current network router operating system mainly include the routing discovery phase program and the routing planning phase program. By analyzing the vulnerability characteristics of some programs in different stages and the complex semantics and structural information of the program itself, a more comprehensive network routing mechanism vulnerability analysis model is constructed. The model combines the node message passing mechanism based on the multi-head graph attention mechanism and the node relationship message passing mechanism based on the graph convolutional neural network to convert the vulnerability analysis problem of the target program into a node classification problem. Combining the construction of the knowledge graph with the method of constructing the vulnerability analysis model, a network routing mechanism vulnerability analysis method based on the graph neural network and the knowledge graph is proposed. At the same time, the visualization technology of the knowledge graph is used to display the influencing factors of the program vulnerability characteristics and the intricate relationship of the program's own instructions for subsequent analysis tasks. In the study of the phenomenon of soft errors in the routing mechanism caused by interference and space radiation, the application of the present invention can especially improve the security and reliability of the network.

[0008] The technical solution to achieve the purpose of the present invention is: on the one hand, a network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is provided, and the method comprises:

[0009] Step 1: According to the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to realize the simulation of the target low-orbit interconnected network topology;

[0010] Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for a typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability data set;

[0011] Step 3: Based on the vulnerability feature information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set;

[0012] Step 4: Generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and construct a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0013] Step 5, the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph are represented as tensor matrices of a specific dimension, and used as input for training of the target network routing mechanism vulnerability analysis model;

[0014] Step 6: Convert the target network’s routing mechanism vulnerability analysis task into a node classification and prediction task, build the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0015] On the other hand, a network routing mechanism vulnerability analysis system based on graph neural network and knowledge graph is provided, and the system includes:

[0016] The first module is used to establish a corresponding simulated network topology according to the actual network topology of the target low-orbit interconnection network, and realize the simulation of the target low-orbit interconnection network topology;

[0017] The second module is used to implement running network routing programs on routers of simulated networks, design fault injection schemes for typical routing programs, simulate the vulnerability of network routing mechanisms, analyze the running results, dynamically collect the vulnerability feature information of network routing mechanisms, and construct a network routing mechanism vulnerability data set;

[0018] The third module is used to build a target network routing mechanism vulnerability knowledge graph ontology model based on the vulnerability feature information of the network routing mechanism, including a concept class set, a relationship set between classes, and a class attribute set;

[0019] The fourth module is used to generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0020] The fifth module is used to represent the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, which is used as the input of the target network routing mechanism vulnerability analysis model for training;

[0021] The sixth module is used to convert the routing mechanism vulnerability analysis task of the target network into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0022] Compared with the prior art, the present invention has the following significant advantages:

[0023] (1) It is proposed to use knowledge graphs in the field of network routing mechanism vulnerability analysis. A more general network routing mechanism vulnerability domain ontology model is constructed through different dimensions to achieve in-depth mining of contextual semantic relationships in the graph. At the same time, the knowledge graph visualization technology is used to display the logical relationship between the complex semantic structure information of the routing program and the various components in the network topology, so as to better analyze the vulnerable links in the network.

[0024] (2) A network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is proposed. The vulnerability analysis of the target network routing mechanism is abstracted into a node classification prediction problem. This method designs a node neighborhood information propagation model based on the graph attention model and a relationship neighborhood information propagation model based on the graph convolution model. Compared with the previous analysis using machine learning models, this method obtains more comprehensive semantic and structural information, can automatically learn the structural features of error propagation, and uses a new classifier layer to extract more advanced propagation features after the graph network, thereby improving the propagation reasoning ability of soft errors (SDC).

[0025] (3) The present invention starts from the source of routing security and analyzes some programs that implement the routing mechanism, which can effectively improve the vulnerability analysis capability of the network routing mechanism and improve the security and reliability of the routing mechanism.

[0026] The present invention is further described in detail below in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a framework diagram of the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph.

[0028] Figure 2 A diagram of a network routing mechanism vulnerability ontology model constructed in one embodiment.

[0029] Figure 3 This is a partial example diagram of the network routing mechanism vulnerability knowledge graph in one embodiment.

[0030] Figure 4 Graph showing comparative experimental results of an ablation experiment on a network routing mechanism vulnerability analysis model in one embodiment. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0032] It should be noted that if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0033] In the face of the problem that the entity relationships in constructing the network routing mechanism vulnerability knowledge graph are not comprehensive enough, the present invention proposes to construct the network routing mechanism vulnerability domain ontology NRMVO based on the four dimensions of assets, networks, software, and vulnerabilities, and construct the target low-orbit interconnection network routing mechanism vulnerability knowledge graph. In the face of the problem that the prediction of network vulnerability is not accurate enough, the present invention constructs the target network routing mechanism vulnerability analysis model HGAT-BNR, analyzes the vulnerability of the network routing mechanism from the four dimensions of data flow, control flow, call flow, and access flow. The model combines the node message passing mechanism based on the multi-head graph attention mechanism and the node relationship message passing mechanism based on the graph convolutional neural network, and converts the vulnerability analysis problem of the target program into a node classification problem.

[0034] In one embodiment, in combination Figure 1 , a network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is provided, which can be applied to the vulnerability analysis of network routing mechanism based on knowledge graph. It mainly includes: simulating the target low-orbit interconnection network topology, designing fault injection experiments for the routing program in the simulated network topology, dynamically collecting the vulnerability information of the network routing mechanism, and constructing the network routing mechanism vulnerability data set; constructing the network routing mechanism vulnerability domain ontology NRMVO based on the four dimensions of assets, networks, software, and vulnerabilities; extracting knowledge from the program that implements network routing, analyzing the correlation between the complex structural information of the routing program such as instructions, function operations, routing protocols, network performance and the vulnerability of the network routing program, and constructing the target low-orbit interconnection network routing mechanism vulnerability knowledge graph; storing the results in the graph database to realize the visualization of the knowledge graph; constructing the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyzing the vulnerability of the network routing mechanism from the four dimensions of data flow, control flow, call flow, and access flow.

[0035] The specific steps include:

[0036] Step 1: According to the actual network topology of the low-orbit interconnection network, the simulation of the target low-orbit interconnection network topology is realized. The construction process consists of seven elements as shown in formula (1):

[0037] T topology = {N scale ,N topology ,N protocol ,N state ,N safety ,N link ,N paramter} (1)

[0038] Among them, N scale N is the network scale. According to the number of nodes in the network, the network is divided into four levels: small scale, medium scale, large scale, and ultra-large scale. topology N is the network topology type, such as star, ring, etc. protocal It is a network routing protocol, such as OSPF protocol, BGP protocol, etc.; N state N is the node status of the network, such as whether the node is active or faulty; safety Configure the router security in the network, such as security log recording, etc. link N is the link status in the network, such as whether it is connected, etc. paramter These are network performance parameters, such as network delay, network bandwidth, etc.

[0039] Step 2: Run the network routing program on the router of the simulated network in step 1, select the source program that implements the routing mechanism, convert the routing program into the intermediate IR code format through LLVM and other analysis methods, design a fault injection experiment plan, simulate the occurrence of faults under interference and radiation effects, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and construct a network routing mechanism vulnerability data set. The specific method is as follows:

[0040] Step 2.1: Construct the vulnerability feature dataset D of the target low-orbit interconnection network routing mechanism as shown in formula (2): vul :

[0041] D vul =(P protocol ,L link_state_info ,R router_table ,P program ,I ins ,N performance )(2)

[0042] Among them, P protocol is the routing protocol feature, L link_state_info is the link state information feature, R router_table is the routing table feature, P program is the routing program feature, Iins is the routing program instruction feature, N performance is the network performance characteristics;

[0043] a) Common routing protocol characteristics P protocol The vector is shown in formula (3):

[0044] P protocol = {P rip ,P ospf ,P is-is ,P bgp} (3)

[0045] Among them, P rip RIP (Routing Information Protocol, RIP) protocol, P ospf It is the OSPF (OpenShortest PathFirst, OSPF) protocol. is-is For the (Intermediate System to Intermediate System, Is-Is) protocol, P bgp It is the Border Gateway Protocol (BGP) protocol;

[0046] b) Link state information feature L link_state_info The vector is shown in formula (4):

[0047] L link_state_info ={L link_identifier ,L neighbor_router ,L state ,L sequence_number} (4)

[0048] Among them, L link_identifier L is the link identifier, which uniquely identifies the link; neighbor_router An adjacent router describes a router that is directly connected to a link and exchanges state information with the link. The router may belong to different domains. state The current status of the link, such as up / down; L sequence_number is a sequence number used to identify the update order of link state information;

[0049] c) Routing table characteristics R router_table The vector is composed of seven tuples as shown in formula (5):

[0050] R router_table = {R source_ip ,R des_ip ,R next_hop ,R interface ,R router_type ,R metric ,Rrouter_id}(5)

[0051] Among them, R source_ip is the source IP address, R des_ip is the target IP address, R next_hop is the next hop, R interface For the interface, R router_type is the router type, R metric is the router index, R router_id Unique ID for the router;

[0052] d) Routing program characteristics P program The vector is shown in formula (6):

[0053] P program = {P router_find_ins ,P router_plan_ins} (6)

[0054] Among them, P router_find_ins For routing discovery program related instructions, P router_plan_ins Provides instructions related to the routing planning program;

[0055] e) Routing Program Instruction Feature I ins The vector is shown in formula (7):

[0056] I ins = {I inherent ,I bb ,I function} (7)

[0057] Among them, I inherent The inherent characteristics of the instruction, such as instruction type, register type, etc.; bb is the basic block feature of the instruction, such as the size of the basic block where the instruction is located; function The relevant function features of the instruction, such as the number of times the function containing the instruction is called;

[0058] f) Network performance characteristics N performance The vector is shown in formula (8):

[0059] P performance = {P reliability ,P band_width ,P delay ,P cost ,P mtu ,P security ,P connect}(8)

[0060] Among them, P reliability is the network reliability, P band_width is the network bandwidth, P delay is the network delay, Pcost is the network overhead, P mtu is the maximum transmission unit of the network, P security is the network security state, P connect for network connectivity;

[0061] Step 2.2: Run the LNRMVFE (Low Earth Orbit Internet Network Routing Mechanisms Vulnerabilities Feature Extraction) algorithm to extract the vulnerability features of the target low-orbit Internet network routing mechanism. The algorithm steps are as follows:

[0062] (1) According to formula (3), the routing protocol feature P protocol The construction and feature extraction method are as follows:

[0063]

[0064]

[0065] (2) According to formula (4), link state information feature L is calculated link_state_info The construction and feature extraction method are as follows:

[0066]

[0067] (3) According to formula (5), the routing table feature R router_table The construction and feature extraction method are as follows:

[0068]

[0069]

[0070] (4) According to formula (6), the routing program feature P program The construction and feature extraction method are as follows:

[0071]

[0072] (5) According to formula (7), the routing program instruction feature I ins The construction and feature extraction method are as follows:

[0073]

[0074]

[0075] (6) According to formula (8), the network performance characteristics N performance The construction and feature extraction method are as follows:

[0076]

[0077] Among them, Rule 1 means that for each node x, if node x is a security-vulnerable node, firstly, the vulnerability or malicious behavior of the router is simulated on the node x of the simulated network topology, and then the simulation results of the node x are analyzed to extract the security characteristics of the node x; Rule 2 means that for each node x, if node x is a reliability-vulnerable node, firstly, a fault injection experiment is performed on the node x in the simulated network topology, and then the response and recovery capabilities, connection status, etc. of the node are monitored to extract network delay (delay), network connectivity (connect), network overhead (cost) and other characteristics; Rule 3 means that for the link connecting node x and node y, if the link is a security-vulnerable link, firstly, an active attack is simulated on the simulated link, and then the simulation results of the link are analyzed to extract the security characteristics of the link; Rule 4 means that for the link connecting node x and node y, if the node is a reliable link, firstly, fault detection is performed on the link in the simulated network topology, the relevant status of the link is detected, and then the network bandwidth (band_width), network maximum transmission unit (mtu) and other characteristics are extracted.

[0078] Step 3: Based on the network routing mechanism vulnerability characteristics obtained in step 2 and the extracted network routing mechanism vulnerability dataset, a more general network routing mechanism vulnerability domain ontology model is constructed based on the four dimensions of asset dimension, network dimension, software dimension, and vulnerability dimension. Figure 2 As shown, the vulnerability ontology model of the target network routing mechanism is constructed as shown in formula (9):

[0079] NRMVO=<Concept,Relation,Properities,Rule> (9)

[0080] The NRMVO model (Low Earth Orbit Internet Network Routing Mechanisms Vulnerabilities Domain Ontology) represents the domain ontology of low earth orbit internet network routing mechanism vulnerabilities; Concept is a set of concept classes related to low earth orbit internet network routing mechanism vulnerabilities, Relation is a set of relationships between concept classes related to low earth orbit internet network routing mechanism vulnerabilities, Properties is a set of properties corresponding to the concept classes of low earth orbit internet network routing mechanism vulnerabilities, and Rule is a set of related constraints on properties;

[0081] Step 3.1, construct the Concept class set as shown in formula (10):

[0082] Concept={Asset,NetWork,SoftWare,Fragility} (10)

[0083] Among them, Asset represents the concept class set of asset dimension, NetWork represents the concept class set of network dimension, SoftWare represents the concept class set of software dimension, and Fragility represents the concept class set of vulnerability dimension;

[0084] The specific steps to construct the Concept class set are as follows:

[0085] Step 3.1.1, construct the concept class set of asset dimension as shown in formula (11):

[0086] Concept(Asset)={NodeType,Router} (11)

[0087] Among them, NodeType represents the node type class, and Router represents the router class.

[0088] Step 3.1.2, construct the concept class set of network dimension as shown in formula (12):

[0089] Concept(NetWork)

[0090] ={TarNetTopology,NetTopoType,RouterProtocol,LinkStateInfo,RouterTable}(12)

[0091] Among them, TarNetTopology represents the target network topology, NetTopoType represents the network topology type, RouterProtocol represents the routing protocol, LinkStateInfo represents the link state information, and RouterTable represents the routing table;

[0092] Step 3.1.3, construct the concept class set of the software dimension as shown in formula (13):

[0093] Concept(SoftWare)={RouterProgram,RouterProgramIns} (13)

[0094] Among them, RouterProgram represents the routing program class, and RouterProgramIns represents the routing program instruction class;

[0095] Step 3.1.4, construct the concept class set of vulnerability dimension as shown in formula (14):

[0096] Concept(Fragility)={NetReliability,NetSecurity} (14)

[0097] Among them, NetReliability represents the network reliability class set, and NetSecurity represents the network security class set;

[0098] Step 3.2: Construct a set of Relation relationship classes. The construction method is shown in formula (15):

[0099] Relation(Model)={has,obey,run,build,lead} (15)

[0100] Among them, has means inclusion relationship, for example: the routing program contains routing program instructions; obey means compliance relationship, for example: the router obeys the relevant routing protocol; run means operation relationship, for example: the routing protocol runs the relevant routing program; build means construction relationship, for example: the routing program builds the routing table; lead means leading relationship, for example: the routing program instructions lead to network vulnerability during operation;

[0101] Step 3.3, build the Properties attribute class collection, which specifically includes the following attribute collections:

[0102] Step 3.3.1, construct the attribute set of the Router class in the asset dimension as shown in formula (16):

[0103] Properties(Router)={RouterID,RouterIP,RouterPort} (16)

[0104] Among them, RouterID is the unique identifier of the router, RouterIP is the IP address of the router, and RouterPort is the port of the router;

[0105] Step 3.3.2, construct the attribute set of LinkStateInfo class in the network dimension as shown in formula (17):

[0106] Properties(LinkStateInfo)

[0107] ={LID,LType,LSequenceNumber,LDesIP,LAdjcentRouters,LLinkWeight}(17)

[0108] Where LID represents the unique identifier of the link, LType represents the type of link state information, LSequenceNumber represents the sequence number of the link state information, LDesIP represents the target IP in the link state information, LAdjcentRouters represents the adjacent routers in the link state information, and LLinkWeight represents the link weight in the link state information;

[0109] Step 3.3.3, construct the attribute set of the RouterTable class in the network dimension as shown in formula (18):

[0110] Properties(RouterTable)={RTDesIP,RTNextHop,RTPort,RTPriority}(18)

[0111] Among them, RTDesIP represents the destination IP address of the routing item in the routing table, RTNextHop represents the next hop address of the routing item in the routing table, RTPort represents the destination port of the routing item in the routing table, and RTPriority represents the priority of the routing item in the routing table;

[0112] Step 3.3.4, construct the attribute set of the RouterProgram class in the software dimension as shown in formula (19):

[0113] Properties(RouterProgram)={RPType,RPFunction,RPStatement} (19)

[0114] Among them, RPType represents the routing program type, RPFunction represents the routing program function, and RPStatement represents the routing program statement;

[0115] Step 3.3.5, construct the attribute set of the RouterProgramIns class in the software dimension as shown in formula (20):

[0116] Properties(RouterProgramIns)={RPIInherent,RTIBB,RTIFunction}(20)

[0117] Among them, RPIInherent represents the intrinsic attribute set of the routing program instruction, RTIBB represents the basic block attribute set of the routing program instruction, and RTIFunction represents the function attribute set of the routing program instruction;

[0118] Step 3.3.6, construct the attribute set of the NetReliability class in the vulnerability dimension as shown in formula (21):

[0119] Properties(NetReliability)={BandWidth,ThroughtPut,Delay,Cost,LossTolerance}(21)

[0120] BandWidth indicates network bandwidth, Throughput indicates network throughput, Delay indicates network delay, Cost indicates network cost, and LossTolerance indicates network packet loss rate.

[0121] Step 3.3.7, construct the attribute set of the NetSecurity class in the vulnerability dimension as shown in formula (22):

[0122] Properties(NetSecurity)={NNSafeState,NLSafeState} (22)

[0123] Among them, NNSafeState represents the safety status of the node in the network, 0 represents unsafe and 1 represents safe; NLSafeState represents the safety status of the link in the network, 0 represents unsafe and 1 represents safe;

[0124] Step 3.4, construct the Rule class set. The construction method is shown in formula (23):

[0125] Rule(Properties)={dataType,isNull,defaultValue,lowerBound,upperBound}(23)

[0126] Among them, dataType represents the data type of the attribute set in the ontology model, isNull represents whether the value is null, defaultValue represents the default value, lowerBound represents the lower bound of the value of the attribute set in the ontology model, and upperBound represents the upper bound of the value of the attribute set in the ontology model.

[0127] Step 4: Based on the target network routing mechanism vulnerability characteristics, vulnerability datasets, and ontology models obtained in steps 2 and 3, four flow charts are generated, the network routing mechanism vulnerability characteristic information is embedded, entities, relationships, and attributes are extracted, and the target network routing mechanism vulnerability knowledge graph construction method is as follows:

[0128] Step 4.1, run the R-HRGA (Router Heterogeneous Relation Graph Generate Algorithm) algorithm to automatically construct the heterogeneous relationship graph RHRG (Router Heterogeneous Relation Flow Graph) of the generated routing program; wherein, the R-HRGA algorithm steps are as follows:

[0129] Step 4.1.1, generate the entity node of RHRG;

[0130] Step 4.1.2, construct the control flow graph (CFG) of the target routing program;

[0131] Step 4.1.3, construct the data flow graph (DFG) of the target routing program;

[0132] Step 4.1.4, construct the function call flow graph (FCFG) of the target routing program;

[0133] Step 4.1.5, construct the load store flow graph (LSFG) of the target routing program;

[0134] Step 4.1.6, merge the control flow graph, data flow graph, call flow graph, and access flow graph mentioned above to construct a heterogeneous relationship graph RHRG, where nodes represent routing program instructions, and edges represent control dependencies, data dependencies, call dependencies, and access dependencies of routing programs; the specific method for constructing the routing program heterogeneous relationship graph RHRG is as follows:

[0135] (1) Create the node corresponding to RHRG according to the following rules:

[0136] Rule 1: For all the above dependencies, the nodes involved are put into a set, and all the nodes in the set are used as the nodes corresponding to the RHRG;

[0137] (2) Create edge connections between nodes in the RHRG graph according to the following rules:

[0138] Rule 2: For each control dependency in the CFG, i.e., conditional branches in the routing program and sequential branches in the basic block, create a corresponding control dependency edge from the source node of the control dependency to the target node;

[0139] Rule 3: For each data dependency in the DFG, i.e., the comparison branch in the routing program and the operand call branch in the basic block, create corresponding data dependency edges to connect the relevant RHRFG nodes;

[0140] Rule 4: For each call dependency in the FCFG, i.e., the node branch in the current basic block that calls other functions in the routing program, create a corresponding call dependency edge from the function call node in the current basic block to the start node of the called function basic block;

[0141] Rule 5: For each access dependency in LSFG, i.e., the writing and reading of the same operand in the routing program, a storage dependency edge in RHRG is established according to the corresponding rules and algorithms;

[0142] (3) Merge all nodes and edges to form RHRG, where nodes consist of instructions and edges represent control dependencies and data dependencies;

[0143] Step 4.2, embed the attributes of the nodes in the generated RHRG, traverse the RHRG according to the vulnerability feature type defined in formula (2), identify the nodes in the RHRG related to the vulnerability feature, and add the network routing mechanism vulnerability feature set as the attribute of the corresponding instruction node in the graph as the vulnerability label of the node;

[0144] Step 4.3, according to the definitions and constraints of classes, attributes, and relationships in the network routing mechanism vulnerability ontology model, traverse the graph composed of the node set. The specific rule steps are as follows:

[0145] (1) According to formula (10), determine whether each node in the graph represents an entity;

[0146] (2) Extract attribute information by viewing the attributes and labels of the nodes;

[0147] (3) In the process of traversing the graph, the relationships between nodes are constructed based on the connections and interactions between nodes, and the edges in the target network routing mechanism knowledge graph are constructed based on these established relationships;

[0148] Step 4.4, store the extracted entity, attribute and relationship information in a CSV (Comma Separated Values) file, each entity and attribute corresponds to a row of the CSV, and the relationship corresponds to a column of the CSV. The knowledge graph is stored in the format of a CSV file and displayed in a visual form.

[0149] Step 5: construct the nodes in the knowledge graph into a tensor matrix and train it as the input of the target network routing mechanism vulnerability analysis model. The tensor matrix construction method is as follows:

[0150] Step 5.1: construct the tensor matrix h of node v according to the encoding features shown in formula (24) v ;

[0151] h v ={NNF v ,INH v ,BB v ,FUN v ,OTH v} (twenty four)

[0152] h v Contains five tuples, each of which is a |K|-dimensional vector, where K is the feature vector to be encoded;

[0153] (1) NNF v Represents the characteristics of network routing nodes, as shown in formula (25):

[0154] NNF v ={Net_protocol,Net_program,Net_fragility} (25)

[0155] Among them, Net_protocol represents the network routing protocol, such as OSPF, etc.; Net_program represents the network routing running program, such as Dijkstra, etc.; Net_fragility represents the network routing vulnerability, such as 0 for not fragile and 1 for fragile;

[0156] (2) INH v represents the inherent characteristics of the routing instruction, as shown in formula (26):

[0157] INH v ={Ins_type,Ins_ope_width,Reg_type,Ins_dyn_all_pro_ratio (26)

[0158] Among them, Ins_type indicates the type of routing instruction, such as terminator, int_binary, etc.; Ins_ope_width indicates the width of the routing instruction operand, Reg_type indicates the type of routing instruction register, and Ins_dyn_all_pro_ratio indicates the ratio of the dynamic routing instruction execution time to the total program time;

[0159] (3)BB v The basic block characteristics of the routing instruction are shown in formula (27):

[0160] BB v={bb_length,Is_in_loop,Bb_remaining_ins_num,Pred_bb_num,Succ_bb_num}(27)

[0161] Among them, bb_length indicates the size of the basic block where the routing instruction is located, Is_in_loop indicates whether the routing instruction is in a loop, Bb_remaining_ins_num indicates the number of routing instructions that need to be executed until the end of the basic block, Pred_bb_num indicates the number of basic blocks preceding the routing instruction, and Succ_bb_num indicates the number of basic blocks following the routing instruction;

[0162] (4)FUN v The function characteristics of the routing instruction are shown in formula (28):

[0163] FUN v ={Call_num,Fun_remaining_ins_num} (28)

[0164] Among them, Call_num indicates the number of times the function where the routing instruction is located is called, and Fun_remaining_ins_num indicates the number of routing instructions that need to be executed before the function returns;

[0165] (5)OTH v The variable attribute characteristics of the routing instruction are shown in formula (29):

[0166] OTH v ={Is_global_var,Var_fanout_val} (29)

[0167] Among them, Is_global_var indicates whether it is a global variable, and Var_fanout_val indicates the fan-out value of the variable.

[0168] Step 6: Convert the target network routing mechanism vulnerability analysis task into a node classification prediction problem. The construction method of the target network routing mechanism vulnerability analysis model, namely the HGAT-BNR model, is as follows:

[0169] Step 6.1, when learning low-dimensional embedding of nodes, consider both the information of the nodes themselves and the relationship information of the edges connecting the nodes, and fully learn the semantic information and structural information of the nodes;

[0170] Step 6.2, based on the constructed routing program heterogeneous relationship graph RHRG, for the information of the nodes in the graph, build an attention layer structure for node neighborhood aggregation, and use a multi-head attention mechanism in the single-layer aggregation model to stabilize the learning process of the attention mechanism. The specific steps are as follows:

[0171] Step 6.2.1, As the initial input of the attention layer, h is a set of node features, where N is the number of nodes and F is the number of attribute features of node v;

[0172] Step 6.2.2, use the single-relation GAT (Graph Attention Network) model to build a recommendation model as a node information aggregation; use multiple GATs to combine and build a heterogeneous graph attention network message passing framework that simulates multiple relations;

[0173] Step 6.2.3, in the last layer, the output of M attention mechanisms is averaged and the residual mechanism is introduced to enhance the node information. The calculation method is shown in formula (30):

[0174]

[0175] in, represents the output vector representation of node v after L-layer information aggregation operation, M represents the number of single-layer attention heads, Represents the output vector representation of node v at the mth attention head in the L-1th layer.

[0176] In step 6.3, for the relationship information of the edge connecting the nodes in the graph, according to the idea of ​​graph convolutional neural network message passing, the vector representation of the edge is updated by aggregating the messages from its multi-hop neighbor edges. The update equation is shown in formula (31):

[0177]

[0178] (1) Where the initial feature of edge e is The one-hot vector of the relationship type to which edge e belongs can be used as the initial feature to define the hidden state of edge e is the result of the i-th iteration. For node v, the hidden states of all its connected edges are summed to obtain the node message representation N(v) represents the set of edges connected to node v. Although the message of node v is calculated However, the node is only used to collect and temporarily store messages from adjacent edges, and does not represent the message representation of the node v itself. In the i-th iteration, the message representation of the vertex v connected by the aggregation edge e is and the message representation of vertex u and the hidden state of edge e itself To calculate the hidden state of edge e in the i-th iteration N(e) represents the set of vertices directly connected to edge e.

[0179] (2) AGG(·) represents the aggregation operation function, and its specific calculation method is shown in formula (32):

[0180]

[0181] In formula (32), [·] represents the cascade operation, W i-1 represents the learnable transformation matrix parameters, b i-1 represents the bias parameter, σ(·) represents the activation function. The depth of message passing is defined as K, and the final relationship neighborhood message representation context of node v is

[0182] Step 6.4: Embedding the node neighborhood learned by the graph neural network Embedding representation with relational neighborhood Connect together and perform two-layer convolution calculation to obtain high-level features that are more relevant to the vulnerability; the calculation method is shown in formula (33):

[0183]

[0184] In the formula, CONV1 represents the first convolutional layer, RELU is the activation function, and MAXPOOL is the maximum pooling layer;

[0185] Step 6.5, predict the SDC. Finally, input the learned features into the multi-layer fully connected neural network for probability prediction to obtain the instruction vulnerability y', which represents the probability of each instruction generating SDC. The calculation method is shown in formula (34):

[0186]

[0187] Step 6.6, use the labeled data to calculate the cross entropy loss and perform gradient update. The calculation method is shown in formula (35):

[0188]

[0189] In the formula, y i represents the true label of node i, y' i Represents the probability that node i is predicted to be a positive class;

[0190] Step 6.7, use the trained network routing mechanism vulnerability analysis model HGAT-BNR to predict the vulnerability of the routing program instruction nodes in the network routing mechanism in the constructed target low-orbit interconnection network routing mechanism vulnerability knowledge graph, and obtain the vulnerability probability value of the instruction node.

[0191] In one embodiment, a network routing mechanism vulnerability analysis system based on graph neural network and knowledge graph is provided, and the system includes:

[0192] The first module is used to establish a corresponding simulated network topology according to the actual network topology of the target low-orbit interconnection network, and realize the simulation of the target low-orbit interconnection network topology;

[0193] The second module is used to implement running network routing programs on routers of simulated networks, design fault injection schemes for typical routing programs, simulate the vulnerability of network routing mechanisms, analyze the running results, dynamically collect the vulnerability feature information of network routing mechanisms, and construct a network routing mechanism vulnerability data set;

[0194] The third module is used to build a target network routing mechanism vulnerability knowledge graph ontology model based on the vulnerability feature information of the network routing mechanism, including a concept class set, a relationship set between classes, and a class attribute set;

[0195] The fourth module is used to generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0196] The fifth module is used to represent the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, which is used as the input of the target network routing mechanism vulnerability analysis model for training;

[0197] The sixth module is used to convert the routing mechanism vulnerability analysis task of the target network into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0198] For the specific limitations of the network routing mechanism vulnerability analysis system based on graph neural networks and knowledge graphs, please refer to the limitations of the network routing mechanism vulnerability analysis method based on graph neural networks and knowledge graphs above, which will not be repeated here. Each module in the above-mentioned network routing mechanism vulnerability analysis system based on graph neural networks and knowledge graphs can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0199] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following is achieved:

[0200] Step 1: According to the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to realize the simulation of the target low-orbit interconnected network topology;

[0201] Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for a typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability data set;

[0202] Step 3: Based on the vulnerability feature information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set;

[0203] Step 4: Generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and construct a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0204] Step 5, the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph are represented as tensor matrices of a specific dimension, and used as input for training of the target network routing mechanism vulnerability analysis model;

[0205] Step 6: Convert the target network’s routing mechanism vulnerability analysis task into a node classification and prediction task, build the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0206] For the specific limitations of each step, please refer to the limitations of the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph mentioned above, which will not be repeated here.

[0207] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the computer program implements:

[0208] Step 1: According to the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to realize the simulation of the target low-orbit interconnected network topology;

[0209] Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for a typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability data set;

[0210] Step 3: Based on the vulnerability feature information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set;

[0211] Step 4: Generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and construct a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0212] Step 5, the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph are represented as tensor matrices of a specific dimension, and used as input for training of the target network routing mechanism vulnerability analysis model;

[0213] Step 6: Convert the target network’s routing mechanism vulnerability analysis task into a node classification and prediction task, build the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0214] For the specific limitations of each step, please refer to the limitations of the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph mentioned above, which will not be repeated here.

[0215] The method of the present invention first trains the proposed network routing mechanism vulnerability analysis model, uses the trained model to predict the instruction vulnerability type in the network routing program, and then further analyzes the vulnerability of the network routing mechanism, sorts the predicted instruction vulnerabilities, and reinforces the instructions with higher vulnerabilities, thereby improving the reliability and security of the network routing mechanism. Figure 3 Some examples of the network routing mechanism vulnerability knowledge graph constructed in the method of the present invention are shown.

[0216] Figure 4 The experimental results are shown. The experiment conducts ablation experiments by considering only node neighborhood, considering node neighborhood and relationship neighborhood, and considering Conv layer for feature extraction. The Accuracy, Precision, Recall and F1_score performance indicators are used to quantitatively compare the proposed network routing mechanism vulnerability analysis model. The experimental results show that the model has certain improvements in all four indicators.

[0217] In summary, the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph proposed in the present invention mainly collects the vulnerability information of the network routing mechanism dynamically, constructs the network routing mechanism vulnerability data set, constructs a more universal network routing mechanism vulnerability domain ontology model from different dimensions, extracts knowledge from the entire program that implements the network routing mechanism, analyzes the correlation between the program's instructions, function operations, routing protocols, network performance and other complex structural information and the vulnerability of the network routing program, completes the knowledge graph construction and graphic visualization, and fully learns the semantics and structural information of the nodes by training the graph neural network model based on node neighborhood and relationship neighborhood proposed in this paper, accurately predicts the instructions in the routing program that may cause the vulnerability of the routing mechanism, and analyzes the vulnerability of the routing program. Based on the knowledge graph and deep learning technology, it provides effective support for the efficient and accurate prediction of instruction vulnerability, and the method of the present invention helps to enhance the reliability and security of the network.

[0218] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph, characterized in that: The method comprises: Step 1: According to the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to realize the simulation of the target low-orbit interconnected network topology; Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for a typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability data set; Step 3: Based on the vulnerability feature information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set; Step 4: Generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and construct a target low-orbit interconnection network routing mechanism vulnerability knowledge graph; Step 5, the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph are represented as tensor matrices of a specific dimension, and used as input for training of the target network routing mechanism vulnerability analysis model; Step 6: Convert the target network’s routing mechanism vulnerability analysis task into a node classification and prediction task, build the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

2. According to claim 1, the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is characterized in that: The simulated network topology in step 1 is constructed based on seven elements as shown below: T topology ={N scale ,N topology ,N protocol ,N state ,N safety ,N link ,N paramter } Among them, N scale N is the network scale. According to the number of nodes in the network, the network is divided into four levels: small scale, medium scale, large scale, and ultra-large scale. topology N is the network topology type; protocol N is the network routing protocol; state is the node status of the network; N safety Configure the router security in the network; N link is the link status in the network; N parammter It is a network performance parameter.

3. According to claim 2, the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is characterized in that: In step 2, a network routing mechanism vulnerability dataset is constructed. The specific steps are as follows: Step 2.1: Construct the vulnerability feature dataset D of the target low-orbit interconnection network routing mechanism as shown in the following formula: vul : D vul =(P protocol ,L link_state_info ,R router_table ,P program ,I ins ,N performance ) Among them, P protocol is the routing protocol feature, L link_state_info is the link state information feature, R router_table is the routing table feature, P program is the routing program feature, I ins is the routing program instruction feature, N performance is the network performance characteristics; a) Routing protocol characteristics P protocol The vector is shown below: P protocol ={P rip ,P ospf ,P is-is ,P bgp } Among them, P rip RIP protocol, P ospf For OSPF protocol, P is-is Is-Is protocol, P bgp It is the BGP protocol; b) Link state information feature L link_state_info The vector is shown below: L link_state_info ={L link_identifier ,L neighbor_router ,L state ,L sequence_number } Among them, L link_identifier L is the link identifier, which uniquely identifies the link; neighbor_router An adjacent router describes a router that is directly connected to a link and exchanges state information with it; L state is the current state of the link; L sequence_number is a sequence number used to identify the update order of link state information; c) Routing table characteristics R router_table The vector is composed of seven tuples as shown below: R router_table ={R source_ip ,R des_ip ,R next_hop ,R interface ,R router_type ,R metric ,R router_id } Among them, R source_ip is the source IP address, R des_ip is the target IP address, R next_hop is the next hop, R interface For the interface, R router_type is the router type, R metric is the router index, R router_id Unique ID for the router; d) Routing program characteristics P program The vector is shown below: P program ={P router_find_ins ,P router_plan_ins } Among them, P router_find_ins For routing discovery program related instructions, P router_plan_ins Provides instructions related to the routing planning program; e) Routing Program Instruction Feature I ins The vector is shown below: I ins ={I inherent ,I bb ,I function } Among them, I inherent It is an inherent feature of the instruction; bb is the basic block feature of the instruction; function is the relevant function feature of the instruction; f) Network performance characteristics N performance The vector is shown below: P performance ={P reliability ,P band_width ,P delay ,P cost ,P mtu ,P security ,P connect } Among them, P reliability is the network reliability, P band_width is the network bandwidth, P delay is the network delay, P cost is the network overhead, P mtu is the maximum transmission unit of the network, P security is the network security state, P connect for network connectivity; Step 2.2: Run the LNRMVFE algorithm to extract the vulnerability characteristics of the target low-orbit interconnection network routing mechanism. The algorithm steps are as follows: (1) Perform routing protocol feature P protocol The construction and feature extraction method are as follows: (2) Link state information feature L link_state_info The construction and feature extraction method are as follows: (3) Perform routing table feature R router_table The construction and feature extraction method are as follows: (4) Perform routing program feature P program The construction and feature extraction method are as follows: (5) Perform routing program instruction feature I ins The construction and feature extraction method are as follows: (6) Perform network performance characterization N performance The construction and feature extraction method are as follows:

4. According to claim 3, the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is characterized in that: The target network routing mechanism vulnerability knowledge graph ontology model constructed in step 3 is as follows: NRMVO=<Concept,Relation,Properities,Rule> Among them, the NRMVO model represents the domain ontology of the vulnerability of the low-orbit internet network routing mechanism; Concept is a set of concept classes related to the vulnerability of the low-orbit internet network routing mechanism, Relation is a set of relationships between concept classes related to the vulnerability of the low-orbit internet network routing mechanism, Properties is a set of properties corresponding to the concept classes of the vulnerability of the low-orbit internet network routing mechanism, and Rule is a set of related constraints on properties.

5. According to claim 4, the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is characterized in that: In step 3, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, including: Step 3.1, construct the Concept class set as shown below: Concept={Asset,NetWork,SoftWare,Fragility} Among them, Asset represents the concept class set of asset dimension, NetWork represents the concept class set of network dimension, SoftWare represents the concept class set of software dimension, and Fragility represents the concept class set of vulnerability dimension; The specific steps to construct the Concept class set are as follows: (1) Construct a conceptual class set of asset dimensions as shown below: Concept(Asset)={NodeType,Router} Among them, NodeType represents the node type class, and Router represents the router class; (2) Construct a set of concept classes of network dimensions as shown in the following formula: Concept(NetWork) ={TarNetTopology,NetTopoType,RouterProtocol,LinkStateInfo,RouterTable} Among them, TarNetTopology represents the target network topology, NetTopoType represents the network topology type, RouterProtocol represents the routing protocol, LinkStateInfo represents the link state information, and RouterTable represents the routing table; (3) Construct a set of concept classes for the software dimension as shown below: Concept(SoftWare)={RouterProgram,RouterProgramIns} Among them, RouterProgram represents the routing program class, and RouterProgramIns represents the routing program instruction class; (4) Construct a set of conceptual classes of vulnerability dimensions as shown in the following formula: Concept(Fragility)={NetReliability,NetSecurity} Among them, NetReliability represents the network reliability class set, and NetSecurity represents the network security class set; Step 3.2, construct the Relation relationship class set. The construction method is as follows: Relation(Model)={has,obey,run,build,lead} Among them, has means inclusion relationship; obey means compliance relationship; run means operation relationship; build means construction relationship; lead means leading relationship; Step 3.3, build the Properties attribute class collection, which specifically includes the following attribute collections: (1) Construct the attribute set of the Router class in the asset dimension as shown below: Properties(Router)={RouterID,RouterIP,RouterPort} Among them, RouterID is the unique identifier of the router, RouterIP is the IP address of the router, and RouterPort is the port of the router; (2) Construct the attribute set of LinkStateInfo class in the network dimension as shown in the following formula: Properties(LinkStateInfo) ={LID,LType,LSequenceNumber,LDesIP,LAdjcentRouters,LLinkWeight}, where LID represents the unique identifier of the link, LType represents the type of link state information, LSequenceNumber represents the sequence number of the link state information, LDesIP represents the target IP in the link state information, LAdjcentRouters represents the adjacent routers in the link state information, and LLinkWeight represents the link weight in the link state information; (3) Construct the attribute set of the RouterTable class in the network dimension as shown below: Properties(RouterTable)={RTDesIP,RTNextHop,RTPort,RTPriority} Among them, RTDesIP represents the destination IP address of the routing item in the routing table, RTNextHop represents the next hop address of the routing item in the routing table, RTPort represents the destination port of the routing item in the routing table, and RTPriority represents the priority of the routing item in the routing table; (4) Construct the attribute set of the RouterProgram class in the software dimension as shown below: Properties(RouterProgram)={RPType,RPFunction,RPStatement} Among them, RPType represents the routing program type, RPFunction represents the routing program function, and RPStatement represents the routing program statement; (5) Construct the attribute set of the RouterProgramIns class in the software dimension as shown in the following formula: Properties(RouterProgramIns)={RPIInherent,RTIBB,RTIFunction} Among them, RPIInherent represents the intrinsic attribute set of the routing program instruction, RTIBB represents the basic block attribute set of the routing program instruction, and RTIFunction represents the function attribute set of the routing program instruction; (6) Construct the attribute set of the NetReliability class in the vulnerability dimension as shown in the following formula: Properties(NetReliability)={BandWidth,ThroughtPut,Delay,Cost,LossTolerance} BandWidth indicates network bandwidth, Throughput indicates network throughput, Delay indicates network delay, Cost indicates network cost, and LossTolerance indicates network packet loss rate. (7) Construct the attribute set of the NetSecurity class in the vulnerability dimension as shown below: Properties(NetSecurity)={NNSafeState,NLSafeState} Among them, NNSafeState represents the safety status of the node in the network, 0 represents unsafe and 1 represents safe; NLSafeState represents the safety status of the link in the network, 0 represents unsafe and 1 represents safe; Step 3.4, build a Rule class set. The construction method is as follows: Rule(Properties)={dataType,isNull,defaultValue,lowerBound,upperBound} Among them, dataType represents the data type of the attribute set in the ontology model, isNull represents whether the value is null, defaultValue represents the default value, lowerBound represents the lower bound of the value of the attribute set in the ontology model, and upperBound represents the upper bound of the value of the attribute set in the ontology model.

6. According to claim 4, the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is characterized in that: In step 4, a knowledge graph of the vulnerability of the target low-orbit interconnection network routing mechanism is constructed, which specifically includes: Step 4.1, run the R-HRGA algorithm to automatically construct and generate the routing program heterogeneous relationship graph RHRG; wherein the steps of the R-HRGA algorithm are as follows: Step 4.1.1, generate the entity node of RHRG; Step 4.1.2, construct the control flow graph of the target routing program; Step 4.1.3, construct the data flow graph of the target routing program; Step 4.1.4, construct a call flow graph of the target routing program; Step 4.1.5, construct the access flow graph of the target routing program; Step 4.1.6, merge the constructed control flow graph, data flow graph, call flow graph, and access flow graph to construct a heterogeneous relationship graph RHRG, where nodes represent routing program instructions, and edges represent control dependencies, data dependencies, call dependencies, and access dependencies in the routing program; Step 4.2: embed the attributes of the nodes in the generated RHRG according to the vulnerability feature dataset D vul The vulnerability feature types defined in , traverse RHRG, identify the nodes related to the vulnerability features in RHRG, and add the network routing mechanism vulnerability feature set as the attribute of the corresponding instruction node in the graph as the vulnerability label of the node; Step 4.3, according to the definitions and constraints of classes, attributes, and relationships in the target network routing mechanism vulnerability knowledge graph ontology model, traverse the graph composed of the node set; Step 4.4, store the extracted entity, attribute and relationship information in a CSV file.

7. The network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph according to claim 6 is characterized in that: Step 4.3 specifically includes: (1) Determine whether each node in the graph represents an entity based on the Concept class set in step 3.1; (2) Extract attribute information by viewing the attributes and labels of the nodes; (3) In the process of traversing the graph, the relationships between nodes are established based on the connections and interactions between the nodes, and the edges in the target network routing mechanism knowledge graph are constructed based on these established relationships.

8. The network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph according to claim 6 is characterized in that: The tensor matrix in step 5 is constructed as follows: Construct the tensor matrix h of node v according to the encoding features shown in the following formula v ; h v ={NNF v ,INH v ,BB v ,FUN v ,OTH v } h v Contains five tuples, each of which is a |K|-dimensional vector, where K is the feature vector to be encoded; (1) NNF v Represents the characteristics of network routing nodes, as shown in the following formula: NNF v ={Net_protocol,Net_program,Net_fragility} Among them, Net_protocol represents the network routing protocol; Net_program represents the network routing operating program; Net_fragility represents the network routing vulnerability; (2) INH v Represents the inherent characteristics of routing instructions, as shown in the following formula: INH v ={Ins_type,Ins_ope_width,Reg_type,Ins_dyn_all_pro_ratio Among them, Ins_type indicates the type of routing instruction; Ins_ope_width indicates the width of the routing instruction operand, Reg_type indicates the type of routing instruction register, and Ins_dyn_all_pro_ratio indicates the ratio of the dynamic routing instruction execution time to the total program time; (3)BB v The basic block characteristics of the routing instruction are shown in the following formula: BB v ={bb_length,Is_in_loop,Bb_remaining_ins_num,Pred_bb_num,Succ_bb_num} Among them, bb_length indicates the size of the basic block where the routing instruction is located, Is_in_loop indicates whether the routing instruction is in a loop, Bb_remaining_ins_num indicates the number of routing instructions that need to be executed until the end of the basic block, Pred_bb_num indicates the number of basic blocks preceding the routing instruction, and Succ_bb_num indicates the number of basic blocks following the routing instruction; (4)FUN v The function characteristics of the routing instruction are shown in the following formula: FUN v ={Call_num,Fun_remaining_ins_num} Among them, Call_num indicates the number of times the function where the routing instruction is located is called, and Fun_remaining_ins_num indicates the number of routing instructions that need to be executed before the function returns; (5)OTH v The variable attribute characteristics of the routing instruction are shown in the following formula: OTH v ={Is_global_var,Var_fanout_val} Among them, Is_global_var indicates whether it is a global variable, and Var_fanout_val indicates the fan-out value of the variable.

9. The network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph according to claim 6 is characterized in that: The construction method of the target network routing mechanism vulnerability analysis model HGAT-BNR in step 6 is as follows: Step 6.1, based on the routing program heterogeneous relationship graph RHRG constructed in step 4.1, construct an attention layer structure for node neighborhood aggregation based on the information of the nodes in the graph, and use a multi-head attention mechanism in the single-layer aggregation model to stabilize the learning process of the attention mechanism; Step 6.2, for the relationship information of the node connection edges in the routing program heterogeneous relationship graph RHRG, according to the idea of ​​graph convolutional neural network message passing, the vector representation of the edge is updated by aggregating the messages from its multi-hop neighbor edges. The update equation is shown as follows: in, is the hidden state representation of edge e in round i-1, N(v) represents the set of edges directly connected to node v, It means summing the hidden states of all connected edges of node v and temporarily storing messages from adjacent edges. It does not represent the message representation of node v itself. It represents the sum of the hidden states of all the edges connected to node u and temporarily stores the messages from the adjacent edges. It does not represent the message representation of node u itself. N(e) represents the set of vertices directly connected to edge e. is the hidden state representation of edge e in the i-th iteration; AGG(·) represents the aggregation operation function, and its specific calculation method is shown in the following formula: Where [·] represents the cascade operation, W i-1 represents the learnable transformation matrix parameters, b i-1 represents the bias parameter, σ(·) represents the activation function; the depth of message passing is defined as K, and the final relationship neighborhood message of node v represents the context as Step 6.3: Embedding the node neighborhood learned by the graph neural network Embedding representation with relational neighborhood Connected together, two layers of convolution calculation are performed to obtain high-level features that are more relevant to the vulnerability; the calculation method is shown in the following formula: In the formula, CONV1 represents the first convolutional layer, RELU is the activation function, and MAXPOOL is the maximum pooling layer; Step 6.4, predict the SDC, and finally input the learned features into the multi-layer fully connected neural network for probability prediction to obtain the instruction vulnerability y', which represents the probability of each instruction generating SDC. The calculation method is shown in the following formula: Step 6.5, use the labeled data to calculate the cross entropy loss and perform gradient update. The calculation method is as follows: In the formula, y i represents the true label of node i, y' i Represents the probability that node i is predicted to be a positive class; Step 6.6, use the trained target network routing mechanism vulnerability analysis model HGAT-BNR to predict the vulnerability of the routing program instruction nodes in the network routing mechanism in the constructed target low-orbit interconnection network routing mechanism vulnerability knowledge graph, and obtain the vulnerability probability value of the instruction node.

10. The network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph according to claim 9 is characterized in that: Step 6.1 specifically includes: Step 6.1.1, As the initial input of the attention layer, h is a set of node features, where N is the number of nodes and F is the number of attribute features of node v; Step 6.1.2, using the single-relation GAT model, construct a recommendation model as node information aggregation; using multiple GATs to combine and construct a heterogeneous graph attention network message passing framework that simulates multiple relations; Step 6.1.3, in the last layer, the output of M attention mechanisms is averaged and the residual mechanism is introduced to enhance the node information. The calculation method is shown in the following formula: in, represents the output vector representation of node v after L-layer information aggregation operation, M represents the number of single-layer attention heads, Represents the output vector representation of node v at the mth attention head in the L-1th layer.

Images