Network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph

Abstract

The application discloses a network routing mechanism vulnerability analysis method based on a graph neural network and a knowledge graph, which comprises the following steps: simulating the network routing mechanism vulnerability analysis of a target low-orbit interconnected network topology node based on a graph neural network and a knowledge graph; performing a fault injection experiment on a routing program in the simulated network topology; dynamically collecting vulnerability information of the network routing mechanism; and constructing a network routing mechanism vulnerability dataset; constructing a network routing mechanism vulnerability domain ontology NRMVO based on four dimensions of assets, networks, software and vulnerabilities; performing knowledge extraction on a program for realizing network routing; analyzing the relevance between complex structure information of the routing program and vulnerability of the network routing program; and constructing a target low-orbit interconnected network routing mechanism vulnerability knowledge graph; storing the result in a graph database; realizing knowledge graph visualization; constructing a target network routing mechanism vulnerability analysis model HGAT-BNR; and analyzing the vulnerability of the network routing mechanism from four dimensions of data flow, control flow, calling flow and access flow. The application has the advantages of high efficiency and high accuracy, and provides an effective analysis method for improving the reliability and security of the network routing mechanism.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and trusted vulnerability analysis, and in particular to a network routing mechanism vulnerability analysis method based on graph neural networks and knowledge graphs. Background Art

[0002] The low-orbit (LEO) internetwork is based on communication satellites connected by intersatellite links (ISLs). Its primary functions are information acquisition, information fusion, information transmission, and information distribution. As a satellite network, LEO satellites can be susceptible to single-event effects (SEEs) in complex environments, resulting in incorrect operational outputs. The impact of transient errors caused by SEEs on satellite node routing can generally be categorized into two main categories: data flow errors and control flow errors. Data flow errors occur when transient errors due to SEEs modify values ​​in router memory cells (such as registers, program, and data memory), causing errors in communication data. Control flow errors typically occur in the memory cells that implement routing algorithms. Soft errors caused by SEEs can cause data to be sent in the wrong direction. To ensure the reliability and security of the LEO internetwork, predicting and analyzing its vulnerabilities is crucial.

[0003] Currently, research at home and abroad is focusing on satellite network security routing protocols, primarily focusing on the application of IP protocols. However, due to the unpredictable nature of routing attacks, routing security protocols cannot account for all threats during their design. Therefore, research on the overall reliability and security of routing mechanisms is crucial. Existing research has primarily examined network routing through traditional evaluation methods, machine learning, knowledge graphs, and other approaches. For example, Zheng Jing et al. designed a trust assessment mechanism based on medium-orbit satellites for low-orbit satellite networks, which is used to establish trusted routing for these networks. They also proposed solutions to potential satellite node failures and intersatellite link congestion. Nishiyamah et al. proposed a load-balancing routing protocol and designed a new network structure for LEO / MEO dual-layer satellite networks. However, this approach suffers from significant overhead in practical applications.

[0004] With the development of machine learning theory, research on the integration of machine learning and routing mechanisms is also booming. For example, Cheng Yi proposed a random forest-based single-particle upset simulation software fault injection method. This method analyzes the characteristics related to instruction single-particle upset vulnerabilities, improves on traditional fault injection methods, and uses a random forest algorithm to train an instruction vulnerability prediction model. Zhang Qianwen proposed a machine learning-based instruction SDC vulnerability analysis method. This method obtains statistical data related to SDC errors through fault injection experiments, introduces program slicing technology, extracts instruction features during program compilation, and uses a prediction model trained by the training program to predict the SDC vulnerability of instructions.

[0005] Existing research methods for analyzing network routing mechanism vulnerabilities fail to fully consider the variability and integrity of network routing security, resulting in a large number of security vulnerabilities. Knowledge graphs, a graph-based knowledge representation method, can fuse, extract, and store multi-source, heterogeneous, and dynamic knowledge. They effectively correlate and analyze existing network entities and better extract the rich semantic information hidden between them. They have been applied in various fields. For example, Ma J et al. proposed a heterogeneous graph, GATPS (Graph Attention Network to Predict SDC-prone Instructions), with different types of edges to represent various instruction relationships. By stacking layers in which nodes can pay attention to the characteristics of their neighbors, GATPS automatically captures structural features that contribute to SDC propagation. An attention mechanism is applied to calculate the importance of neighboring nodes and quantify the impact of their failures. Liu Xin et al. cleverly incorporated the concept of knowledge graphs into the field of fault diagnosis and analysis. They combined fault tree diagnosis and failure mode and effect analysis with the ontology construction and reasoning capabilities of knowledge graphs, providing a novel and feasible solution for knowledge-sharing, highly versatile, and intelligent fault diagnosis technology. Although there has been research on knowledge graphs of single-particle upset-induced failures and network vulnerabilities, the prediction of network vulnerability is not accurate enough because the features extracted by the program are not accurate enough and the entity relationships used to construct the knowledge graph are not comprehensive enough.

[0006] In summary, although graph neural networks and knowledge graphs have become mature as strong artificial intelligence tools with cognitive capabilities, the following issues still need to be further studied in the analysis of network routing mechanism vulnerability: (1) The entity relationships in the knowledge graph for constructing network routing mechanism vulnerability are not comprehensive enough. (2) The prediction of network vulnerability is not accurate enough. Summary of the Invention

[0007] The present invention aims to address the aforementioned issues in the prior art by providing a vulnerability analysis method for network routing mechanisms based on currently popular knowledge graph technology. Current network router operating systems primarily implement network routing mechanisms in two phases: routing discovery and routing planning. By analyzing the vulnerability characteristics of these phases and the complex semantics and structural information of the programs themselves, a more comprehensive network routing vulnerability analysis model is constructed. This model combines a node message passing mechanism based on a multi-head graph attention mechanism with a node relationship message passing mechanism based on a graph convolutional neural network, transforming the vulnerability analysis problem of the target program into a node classification problem. Combining knowledge graph construction with vulnerability analysis model construction methods, a network routing vulnerability analysis method based on graph neural networks and knowledge graphs is proposed. Furthermore, knowledge graph visualization techniques are used to visualize the factors influencing program vulnerability characteristics and the complex relationships between program instructions for subsequent analysis. The application of this invention can particularly improve network security and reliability in the study of soft errors in routing mechanisms caused by interference and space radiation.

[0008] The technical solution to achieve the purpose of the present invention is as follows: On the one hand, a network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph is provided, and the method includes:

[0009] Step 1: Based on the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to simulate the target low-orbit interconnected network topology;

[0010] Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for the typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability dataset;

[0011] Step 3: Based on the vulnerability characteristic information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set;

[0012] Step 4: Based on the constructed network routing mechanism vulnerability dataset, generate a control flow graph and a data flow graph, embed the network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0013] Step 5: Represent the nodes in the target LEO interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, and use it as the input of the target network routing mechanism vulnerability analysis model for training;

[0014] Step 6: Convert the target network routing mechanism vulnerability analysis task into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0015] On the other hand, a network routing mechanism vulnerability analysis system based on graph neural network and knowledge graph is provided, the system comprising:

[0016] The first module is used to establish a corresponding simulated network topology based on the actual network topology of the target low-orbit interconnected network, thereby simulating the target low-orbit interconnected network topology;

[0017] The second module is used to run network routing programs on routers in the simulated network, design fault injection schemes for typical routing programs, simulate the vulnerability of network routing mechanisms, analyze the operation results, dynamically collect vulnerability feature information of network routing mechanisms, and build a network routing mechanism vulnerability dataset;

[0018] The third module is used to build a target network routing mechanism vulnerability knowledge graph ontology model based on the vulnerability feature information of the network routing mechanism, which includes a set of concept classes, a set of relationships between classes, and a set of class attributes;

[0019] The fourth module is used to generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0020] The fifth module is used to represent the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, which is used as the input for training the target network routing mechanism vulnerability analysis model;

[0021] The sixth module is used to convert the target network routing mechanism vulnerability analysis task into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0022] Compared with the prior art, the present invention has the following significant advantages:

[0023] (1) It is proposed to use knowledge graphs in the field of network routing mechanism vulnerability analysis. A more general network routing mechanism vulnerability domain ontology model is constructed through different dimensions to achieve in-depth mining of contextual semantic relationships in the graph. At the same time, through the visualization technology of knowledge graphs, the logical relationship between the complex semantic structure information of the routing program and the various components in the network topology is displayed, so as to better analyze the vulnerable links in the network.

[0024] (2) A network routing mechanism vulnerability analysis method based on graph neural networks and knowledge graphs is proposed. The vulnerability analysis of the target network routing mechanism is abstracted into a node classification prediction problem. This method designs a node neighborhood information propagation model based on a graph attention model and a relationship neighborhood information propagation model based on a graph convolution model. Compared with previous analysis using machine learning models, this method obtains more comprehensive semantic and structural information, can automatically learn the structural characteristics of error propagation, and uses a new classifier layer to extract more advanced propagation features after the graph network, improving the propagation reasoning ability of soft error detection (SDC).

[0025] (3) The present invention starts from the source of routing security and analyzes some programs that implement the routing mechanism, which can effectively improve the vulnerability analysis capability of the network routing mechanism and improve the security and reliability of the routing mechanism.

[0026] The present invention is further described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a framework diagram of the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph.

[0028] Figure 2 This is a diagram of a network routing mechanism vulnerability ontology model constructed in one embodiment.

[0029] Figure 3 This is a partial example diagram of the network routing mechanism vulnerability knowledge graph in one embodiment.

[0030] Figure 4 Graph showing comparative experimental results of an ablation experiment on a network routing mechanism vulnerability analysis model in one embodiment. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0032] It should be noted that if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0033] To address the incompleteness of entity relationships in constructing a knowledge graph for network routing mechanism vulnerabilities, this paper proposes constructing a network routing mechanism vulnerability domain ontology (NRMVO) based on four dimensions: assets, networks, software, and vulnerabilities, and constructing a target low-orbit interconnected network routing mechanism vulnerability knowledge graph. To address the issue of inaccurate predictions of network vulnerabilities, this paper constructs a target network routing mechanism vulnerability analysis model, HGAT-BNR, which analyzes the vulnerability of network routing mechanisms from four dimensions: data flow, control flow, call flow, and access flow. This model combines a node messaging mechanism based on a multi-head graph attention mechanism with a node relationship messaging mechanism based on a graph convolutional neural network, transforming the vulnerability analysis problem of the target program into a node classification problem.

[0034] In one embodiment, combined Figure 1 , provides a network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph, which can be applied to the vulnerability analysis of network routing mechanism based on knowledge graph. It mainly includes: simulating the target low-orbit interconnected network topology, designing fault injection experiments for the routing program in the simulated network topology, dynamically collecting vulnerability information of the network routing mechanism, and constructing a network routing mechanism vulnerability dataset; constructing the network routing mechanism vulnerability domain ontology NRMVO based on the four dimensions of assets, network, software, and vulnerability; extracting knowledge from the program that implements network routing, analyzing the correlation between the complex structural information of the routing program, such as instructions, function operations, routing protocols, network performance, and the vulnerability of the network routing program, and constructing a target low-orbit interconnected network routing mechanism vulnerability knowledge graph; storing the results in a graph database to realize knowledge graph visualization; constructing the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyzing the vulnerability of the network routing mechanism from the four dimensions of data flow, control flow, call flow, and access flow.

[0035] The specific steps include:

[0036] Step 1: Based on the actual network topology of the LEO interconnection network, the simulation of the target LEO interconnection network topology is realized. The construction process consists of seven elements as shown in formula (1):

[0037] T topology ={N scale ,N topology ,N protocol ,N state ,N safety ,N link ,N paramter} (1)

[0038] Among them, N scale is the network scale, and the network is divided into four levels according to the number of nodes in the network: small scale, medium scale, large scale, and ultra-large scale; N topology is the network topology type, such as star, ring, etc.; N protocal It is a network routing protocol, such as OSPF protocol, BGP protocol, etc.; N state The node status of the network, such as whether the node is active or faulty; N safety Configure security for routers in the network, such as security logging, etc. link N is the link status in the network, such as whether it is connected; paramter These are network performance parameters, such as network delay and network bandwidth.

[0039] Step 2: Run the network routing program on the router of the network simulated in step 1, select the source program that implements the routing mechanism, convert the routing program into an intermediate IR code format through analysis methods such as LLVM, design a fault injection experiment plan, simulate the occurrence of faults under interference and radiation effects, analyze the operation results, dynamically collect vulnerability feature information of the network routing mechanism, and construct a network routing mechanism vulnerability dataset. The specific method is as follows:

[0040] Step 2.1: Construct the vulnerability feature dataset D of the target LEO interconnection network routing mechanism as shown in formula (2): vul :

[0041] D vul =(P protocol ,L link_state_info ,R router_table ,P program ,I ins ,N performance )(2)

[0042] Among them, P protocol is the routing protocol feature, L link_state_info is the link state information feature, R router_table is the routing table feature, P program is the routing program feature, Iins is the routing program instruction feature, N performance is the network performance characteristic;

[0043] a) Common routing protocol characteristics P protocol The vector is shown in formula (3):

[0044] P protocol ={P rip ,P ospf ,P is-is ,P bgp} (3)

[0045] Among them, P rip RIP (Routing Information Protocol, RIP) protocol, P ospf For OSPF (OpenShortest PathFirst, OSPF) protocol, P is-is Is-Is (Intermediate System to Intermediate System) protocol, P bgp It is the Border Gateway Protocol (BGP) protocol;

[0046] b) Link state information characteristics L link_state_info The vector is shown in formula (4):

[0047] L link_state_info ={L link_identifier ,L neighbor_router ,L state ,L sequence_number} (4)

[0048] Among them, L link_identifier L is the link identifier, which uniquely identifies the link; neighbor_router An adjacent router describes a router that is directly connected to a link and exchanges state information with the link. The router may belong to a different domain. state The current status of the link, such as up / down; L sequence_number is a sequence number used to identify the update order of link state information;

[0049] c) Routing table characteristics R router_table The vector is composed of seven tuples as shown in formula (5):

[0050] R router_table ={R source_ip ,R des_ip ,R next_hop ,R interface ,R router_type ,R metric ,Rrouter_id}(5)

[0051] Among them, R source_ip is the source IP address, R des_ip is the target IP address, R next_hop is the next hop, R interface For the interface, R router_type For router type, R metric is the router index, R router_id Unique ID for the router;

[0052] d) Routing program characteristics P program The vector is shown in formula (6):

[0053] P program ={P router_find_ins ,P router_plan_ins} (6)

[0054] Among them, P router_find_ins For routing discovery program related instructions, P router_plan_ins Instructions related to routing planning procedures;

[0055] e) Routing Program Instruction Feature I ins The vector is shown in formula (7):

[0056] I ins ={I inherent ,I bb ,I function} (7)

[0057] Among them, I inherent The inherent characteristics of the instruction, such as instruction type, register type, etc.; bb is the basic block feature of the instruction, such as the size of the basic block where the instruction is located; I function Related function features of the instruction, such as the number of times the function containing the instruction is called;

[0058] f) Network performance characteristics N performance The vector is shown in formula (8):

[0059] P performance ={P reliability ,P band_width ,P delay ,P cost ,P mtu ,P security ,P connect}(8)

[0060] Among them, P reliability is the network reliability, P band_width is the network bandwidth, P delay is the network delay, Pcost is the network overhead, P mtu is the maximum transmission unit of the network, P security For network security status, P connect for network connectivity;

[0061] Step 2.2: Run the LNRMVFE (Low Earth Orbit Internet Network Routing Mechanisms Vulnerabilities Feature Extraction) algorithm to extract the vulnerability features of the target low-Earth orbit internet network routing mechanism. The algorithm steps are as follows:

[0062] (1) According to formula (3), the routing protocol feature P protocol The construction and feature extraction methods are as follows:

[0063]

[0064]

[0065] (2) According to formula (4), the link state information feature L link_state_info The construction and feature extraction methods are as follows:

[0066]

[0067] (3) According to formula (5), the routing table feature R router_table The construction and feature extraction methods are as follows:

[0068]

[0069]

[0070] (4) According to formula (6), the routing program feature P program The construction and feature extraction methods are as follows:

[0071]

[0072] (5) According to formula (7), the routing program instruction feature I ins The construction and feature extraction methods are as follows:

[0073]

[0074]

[0075] (6) According to formula (8), the network performance characteristics N performance The construction and feature extraction methods are as follows:

[0076]

[0077] Among them, Rule 1 means that for each node x, if node x is a security-vulnerable node, first simulate the vulnerability or malicious behavior of the router on node x in the simulated network topology, then analyze the simulation results of node x and extract the security characteristics of node x; Rule 2 means that for each node x, if node x is a reliability-vulnerable node, first perform a fault injection experiment on node x in the simulated network topology, then monitor the node's response and recovery capabilities, connection status, etc., and extract characteristics such as network delay, network connectivity, and network cost; Rule 3 means that for the link connecting node x and node y, if the link is a security-vulnerable link, first simulate an active attack on the simulated link, then analyze the simulation results of the link, and extract the security characteristics of the link; Rule 4 means that for the link connecting node x and node y, if the link is a reliable link, first perform fault detection on the link in the simulated network topology, check the relevant status of the link, and then extract characteristics such as network bandwidth and maximum transmission unit.

[0078] Step 3: Based on the network routing mechanism vulnerability characteristics obtained in step 2 and the extracted network routing mechanism vulnerability dataset, a more general network routing mechanism vulnerability domain ontology model is constructed based on the four dimensions of asset dimension, network dimension, software dimension and vulnerability dimension. Figure 2 As shown, the vulnerability ontology model of the target network routing mechanism is constructed as shown in formula (9):

[0079] NRMVO=<Concept,Relation,Properities,Rule> (9)

[0080] The NRMVO model (Low Earth Orbit Internet Network Routing Mechanisms Vulnerabilities Domain Ontology) represents the domain ontology of low-Earth orbit internet network routing mechanism vulnerabilities; Concept is a set of concept classes related to low-Earth orbit internet network routing mechanism vulnerabilities; Relation is a set of relationships between concept classes related to low-Earth orbit internet network routing mechanism vulnerabilities; Properties is a set of properties corresponding to the concept classes of low-Earth orbit internet network routing mechanism vulnerabilities; and Rule is a set of related constraints on properties.

[0081] Step 3.1: Construct the Concept class set as shown in formula (10):

[0082] Concept={Asset,NetWork,SoftWare,Fragility} (10)

[0083] Among them, Asset represents the concept class set of asset dimension, NetWork represents the concept class set of network dimension, SoftWare represents the concept class set of software dimension, and Fragility represents the concept class set of vulnerability dimension.

[0084] The specific steps to construct the Concept class set are as follows:

[0085] Step 3.1.1: Construct the concept class set of asset dimension as shown in formula (11):

[0086] Concept(Asset)={NodeType,Router} (11)

[0087] Among them, NodeType represents the node type class, and Router represents the router class.

[0088] Step 3.1.2: Construct the concept class set of the network dimension as shown in formula (12):

[0089] Concept(NetWork)

[0090] ={TarNetTopology,NetTopoType,RouterProtocol,LinkStateInfo,RouterTable}(12)

[0091] Among them, TarNetTopology represents the target network topology, NetTopoType represents the network topology type, RouterProtocol represents the routing protocol, LinkStateInfo represents the link state information, and RouterTable represents the routing table;

[0092] Step 3.1.3: Construct the concept class set of the software dimension as shown in formula (13):

[0093] Concept(SoftWare)={RouterProgram,RouterProgramIns} (13)

[0094] Among them, RouterProgram represents the routing program class, and RouterProgramIns represents the routing program instruction class;

[0095] Step 3.1.4: Construct a set of concept classes of vulnerability dimensions as shown in formula (14):

[0096] Concept(Fragility)={NetReliability,NetSecurity} (14)

[0097] Among them, NetReliability represents the network reliability class set, and NetSecurity represents the network security class set;

[0098] Step 3.2: Construct a set of Relation relationship classes. The construction method is shown in formula (15):

[0099] Relation (Model) = {has, obey, run, build, lead} (15)

[0100] Among them, has indicates a containment relationship, for example: the routing program contains routing program instructions; obey indicates a compliance relationship, for example: the router complies with the relevant routing protocol; run indicates a run relationship, for example: the routing protocol runs the relevant routing program; build indicates a build relationship, for example: the routing program builds the routing table; lead indicates a result relationship, for example: the routing program instructions lead to network vulnerability during operation;

[0101] Step 3.3: Build the Properties attribute class collection, which specifically includes the following attribute collections:

[0102] Step 3.3.1: Construct the attribute set of the Router class in the asset dimension as shown in formula (16):

[0103] Properties(Router)={RouterID,RouterIP,RouterPort} (16)

[0104] Where RouterID is the unique identifier of the router, RouterIP is the IP address of the router, and RouterPort is the port of the router.

[0105] Step 3.3.2, construct the attribute set of LinkStateInfo class in the network dimension as shown in formula (17):

[0106] Properties(LinkStateInfo)

[0107] ={LID,LType,LSequenceNumber,LDesIP,LAdjcentRouters,LLinkWeight}(17)

[0108] Where LID is the unique identifier of the link, LType is the type of link state information, LSequenceNumber is the sequence number of the link state information, LDesIP is the destination IP address in the link state information, LAdjcentRouters is the adjacent router in the link state information, and LLinkWeight is the link weight in the link state information.

[0109] Step 3.3.3, construct the attribute set of the RouterTable class in the network dimension as shown in formula (18):

[0110] Properties(RouterTable)={RTDesIP,RTNextHop,RTPort,RTPriority}(18)

[0111] Among them, RTDesIP represents the destination IP address of the route item in the routing table, RTNextHop represents the next hop address of the route item in the routing table, RTPort represents the destination port of the route item in the routing table, and RTPriority represents the priority of the route item in the routing table;

[0112] Step 3.3.4, construct the attribute set of the RouterProgram class in the software dimension as shown in formula (19):

[0113] Properties(RouterProgram)={RPType,RPFunction,RPStatement} (19)

[0114] Among them, RPType represents the routing program type, RPFunction represents the routing program function, and RPStatement represents the routing program statement;

[0115] Step 3.3.5, construct the attribute set of the RouterProgramIns class in the software dimension as shown in formula (20):

[0116] Properties(RouterProgramIns)={RPIInherent,RTIBB,RTIFunction}(20)

[0117] Among them, RPIInherent represents the intrinsic attribute set of the routing program instruction, RTIBB represents the basic block attribute set of the routing program instruction, and RTIFunction represents the function attribute set of the routing program instruction;

[0118] Step 3.3.6: Construct the attribute set of the NetReliability class in the vulnerability dimension as shown in formula (21):

[0119] Properties(NetReliability)={BandWidth,ThroughtPut,Delay,Cost,LossTolerance}(21)

[0120] BandWidth represents network bandwidth, ThroughPut represents network throughput, Delay represents network delay, Cost represents network cost, and LossTolerance represents network packet loss rate.

[0121] Step 3.3.7, construct the attribute set of the NetSecurity class in the vulnerability dimension as shown in formula (22):

[0122] Properties(NetSecurity)={NNSafeState,NLSafeState} (22)

[0123] Among them, NNSafeState represents the safety status of the node in the network, 0 represents unsafe and 1 represents safe; NLSafeState represents the safety status of the link in the network, 0 represents unsafe and 1 represents safe;

[0124] Step 3.4: Construct the Rule class set. The construction method is shown in formula (23):

[0125] Rule(Properties)={dataType,isNull,defaultValue,lowerBound,upperBound}(23)

[0126] Among them, dataType represents the data type of the attribute set in the ontology model, isNull represents whether the value is empty, defaultValue represents the default value, lowerBound represents the lower bound of the value of the attribute set in the ontology model, and upperBound represents the upper bound of the value of the attribute set in the ontology model.

[0127] Step 4: Based on the target network routing mechanism vulnerability characteristics, vulnerability dataset, and ontology model obtained in steps 2 and 3, four flow charts are generated, the vulnerability characteristics of the network routing mechanism are embedded, and entities, relationships, and attributes are extracted. The target network routing mechanism vulnerability knowledge graph construction method is as follows:

[0128] In step 4.1, the R-HRGA (Router Heterogeneous Relation Graph Generate Algorithm) algorithm is run to automatically construct the Router Heterogeneous Relation Flow Graph (RHRG) of the generated routing program. The steps of the R-HRGA algorithm are as follows:

[0129] Step 4.1.1, generate the entity node of RHRG;

[0130] Step 4.1.2, construct the control flow graph (CFG) of the target routing program;

[0131] Step 4.1.3, construct the data flow graph (DFG) of the target routing program;

[0132] Step 4.1.4, construct the function call flow graph (FCFG) of the target routing program;

[0133] Step 4.1.5, construct the load store flow graph (LSFG) of the target routing program;

[0134] Step 4.1.6: Merge the control flow graph, data flow graph, call flow graph, and access flow graph mentioned above to construct a heterogeneous relationship graph RHRG, where nodes represent routing program instructions and edges represent control dependencies, data dependencies, call dependencies, and access dependencies of the routing program. The specific method for constructing the routing program heterogeneous relationship graph RHRG is as follows:

[0135] (1) Create the node corresponding to RHRG according to the following rules:

[0136] Rule 1: For all the dependencies mentioned above, the nodes involved are put into a set, and all the nodes in the set are used as the nodes corresponding to the RHRG;

[0137] (2) Create edge connections between nodes in the RHRG graph according to the following rules:

[0138] Rule 2: For each control dependency in the CFG, i.e., conditional branches in the routing program and sequential branches in the basic block, create a corresponding control dependency edge from the source node of the control dependency to the target node;

[0139] Rule 3: For each data dependency in the DFG, i.e., the comparison branch in the routing program and the operand call branch in the basic block, create a corresponding data dependency edge to connect the relevant RHRFG nodes;

[0140] Rule 4: For each call dependency in the FCFG, that is, the node branch in the routing program that calls other functions in the current basic block, create a corresponding call dependency edge from the function call node in the current basic block to the start node of the called function basic block;

[0141] Rule 5: For each access dependency in the LSFG, i.e., the write and read of the same operand in the routing program, a storage dependency edge in the RHRG is established according to the corresponding rules and algorithms;

[0142] (3) Merge all nodes and edges to form RHRG, where nodes consist of instructions and edges represent control dependencies and data dependencies;

[0143] Step 4.2: embed attributes of the nodes in the generated RHRG. According to the vulnerability feature type defined in formula (2), traverse the RHRG, identify the nodes in the RHRG that are related to the vulnerability feature, and add the network routing mechanism vulnerability feature set as the attribute of the corresponding instruction node in the graph as the vulnerability label of the node.

[0144] Step 4.3: Based on the definitions and constraints of classes, attributes, and relationships in the network routing mechanism vulnerability ontology model, traverse the graph consisting of the node set. The specific rule steps are as follows:

[0145] (1) According to formula (10), determine whether each node in the graph represents an entity;

[0146] (2) Extract attribute information by viewing the attributes and labels of the nodes;

[0147] (3) In the process of traversing the graph, the relationships between nodes are constructed based on the connections and interactions between nodes, and the edges in the target network routing mechanism knowledge graph are constructed based on these established relationships;

[0148] In step 4.4, the extracted entity, attribute, and relationship information is stored in a CSV (Comma Separated Values) file. Each entity and attribute corresponds to a row of the CSV, and each relationship corresponds to a column of the CSV. The knowledge graph is stored in the format of a CSV file and displayed in a visual form.

[0149] Step 5: Construct the nodes in the knowledge graph into a tensor matrix and use it as the input for training the target network routing mechanism vulnerability analysis model. The tensor matrix construction method is as follows:

[0150] Step 5.1: Construct the tensor matrix h of node v according to the encoding features shown in formula (24) v ;

[0151] h v ={NNF v ,INH v ,BB v ,FUN v ,OTH v} (twenty four)

[0152] h v Contains five tuples, each of which is a |K|-dimensional vector, where K is the feature vector to be encoded;

[0153] (1)NNF v Represents the characteristics of network routing nodes, as shown in formula (25):

[0154] NNF v ={Net_protocol,Net_program,Net_fragility} (25)

[0155] Among them, Net_protocol represents the network routing protocol, such as OSPF; Net_program represents the network routing program, such as Dijkstra; Net_fragility represents the network routing vulnerability, such as 0 for not fragile and 1 for fragile.

[0156] (2) INH v It represents the inherent characteristics of the routing instruction, as shown in formula (26):

[0157] INH v ={Ins_type,Ins_ope_width,Reg_type,Ins_dyn_all_pro_ratio (26)

[0158] Among them, Ins_type indicates the type of routing instruction, such as terminator, int_binary, etc.; Ins_ope_width indicates the width of the routing instruction operand, Reg_type indicates the type of routing instruction register, and Ins_dyn_all_pro_ratio indicates the ratio of dynamic routing instruction execution time to total program time;

[0159] (3)BB v The basic block characteristics of the routing instruction are shown in formula (27):

[0160] BB v={bb_length,Is_in_loop,Bb_remaining_ins_num,Pred_bb_num,Succ_bb_num}(27)

[0161] Among them, bb_length indicates the size of the basic block where the routing instruction is located, Is_in_loop indicates whether the routing instruction is in a loop, Bb_remaining_ins_num indicates the number of routing instructions that need to be executed before the end of the basic block, Pred_bb_num indicates the number of basic blocks preceding the routing instruction, and Succ_bb_num indicates the number of basic blocks following the routing instruction.

[0162] (4)FUN v The function characteristics of the routing instruction are shown in formula (28):

[0163] FUN v ={Call_num,Fun_remaining_ins_num} (28)

[0164] Among them, Call_num indicates the number of times the function containing the routing instruction is called, and Fun_remaining_ins_num indicates the number of routing instructions that need to be executed before the function returns;

[0165] (5)OTH v The variable attribute characteristics of the routing instruction are shown in formula (29):

[0166] OTH v ={Is_global_var,Var_fanout_val} (29)

[0167] Among them, Is_global_var indicates whether it is a global variable, and Var_fanout_val indicates the fan-out value of the variable.

[0168] Step 6: Convert the target network routing mechanism vulnerability analysis task into a node classification prediction problem. The target network routing mechanism vulnerability analysis model, namely the HGAT-BNR model, is constructed as follows:

[0169] Step 6.1: When learning the low-dimensional embedding of nodes, consider both the node information itself and the relationship information of the node connecting edges to fully learn the semantic and structural information of the nodes;

[0170] In step 6.2, based on the constructed routing program heterogeneous relationship graph RHRG, we construct an attention layer structure for node neighborhood aggregation based on the node information in the graph, and use a multi-head attention mechanism in the single-layer aggregation model to stabilize the learning process of the attention mechanism. The specific steps are as follows:

[0171] Step 6.2.1, As the initial input of the attention layer, h is a set of node features, where N is the number of nodes and F is the number of attribute features of node v;

[0172] In step 6.2.2, a single-relation GAT (Graph Attention Network) model is used to construct a recommendation model for node information aggregation. Multiple GATs are combined to construct a heterogeneous graph attention network message passing framework that simulates multiple relations.

[0173] In step 6.2.3, in the last layer, the output of the M attention mechanisms is averaged and the residual mechanism is introduced to enhance the node information. The calculation method is shown in formula (30):

[0174]

[0175] in, represents the output vector representation of node v after L-layer information aggregation operation, M represents the number of single-layer attention heads, Represents the output vector representation of node v at the mth attention head in the L-1th layer.

[0176] In step 6.3, based on the idea of ​​graph convolutional neural network message passing, the vector representation of the edge is updated by aggregating messages from its multi-hop neighbor edges based on the relationship information of the node connection edges in the graph. The update equation is shown in Equation (31):

[0177]

[0178] (1) Where, the initial feature of edge e is The one-hot vector of the relationship type of edge e can be used as the initial feature to define the hidden state of edge e is the result of the i-th iteration. For node v, the hidden states of all its connected edges are summed to obtain the node message representation N(v) represents the set of edges connected to node v. Although the message of node v is calculated However, the node is only used to collect and temporarily store messages from adjacent edges, and does not represent the message representation of the node v itself. In the i-th iteration, the message representation of the vertex v connected by the aggregation edge e is and the message representation of vertex u and the hidden state of edge e itself To calculate the hidden state of edge e in the i-th iteration N(e) represents the set of vertices directly connected to edge e.

[0179] (2) AGG(·) represents the aggregation operation function, and its specific calculation method is shown in formula (32):

[0180]

[0181] In formula (32), [·] represents the cascade operation, W i-1 represents the learnable transformation matrix parameters, b i-1 Denotes the bias parameter, σ(·) denotes the activation function. The depth of message passing is defined as K, and the final relationship neighborhood message of node v represents the context as

[0182] Step 6.4: Embedding the node neighborhood learned by the graph neural network Embedding representation of relational neighborhood Connect them together and perform two-layer convolution calculation to obtain high-level features that are more relevant to the vulnerability; the calculation method is shown in formula (33):

[0183]

[0184] Where CONV1 represents the first convolutional layer, RELU is the activation function, and MAXPOOL is the maximum pooling layer;

[0185] In step 6.5, the SDC is predicted. Finally, the learned features are input into the multi-layer fully connected neural network for probability prediction to obtain the instruction vulnerability y', which represents the probability of each instruction generating SDC. The calculation method is shown in formula (34):

[0186]

[0187] In step 6.6, use the labeled data to calculate the cross entropy loss and perform gradient update. The calculation method is shown in formula (35):

[0188]

[0189] Where y i represents the true label of node i, y' i Indicates the probability that node i is predicted to be a positive class;

[0190] In step 6.7, the trained network routing mechanism vulnerability analysis model HGAT-BNR is used to predict the vulnerability of the routing program instruction nodes in the network routing mechanism in the constructed target low-orbit interconnection network routing mechanism vulnerability knowledge graph, and the vulnerability probability value of the instruction node is obtained.

[0191] In one embodiment, a network routing mechanism vulnerability analysis system based on a graph neural network and a knowledge graph is provided, the system comprising:

[0192] The first module is used to establish a corresponding simulated network topology based on the actual network topology of the target low-orbit interconnected network, thereby simulating the target low-orbit interconnected network topology;

[0193] The second module is used to run network routing programs on routers in the simulated network, design fault injection schemes for typical routing programs, simulate the vulnerability of network routing mechanisms, analyze the operation results, dynamically collect vulnerability feature information of network routing mechanisms, and build a network routing mechanism vulnerability dataset;

[0194] The third module is used to build a target network routing mechanism vulnerability knowledge graph ontology model based on the vulnerability feature information of the network routing mechanism, which includes a set of concept classes, a set of relationships between classes, and a set of class attributes;

[0195] The fourth module is used to generate control flow graphs and data flow graphs based on the constructed network routing mechanism vulnerability dataset, embed network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0196] The fifth module is used to represent the nodes in the target low-orbit interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, which is used as the input for training the target network routing mechanism vulnerability analysis model;

[0197] The sixth module is used to convert the target network routing mechanism vulnerability analysis task into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0198] Regarding the specific limitations of the network routing mechanism vulnerability analysis system based on graph neural networks and knowledge graphs, please refer to the limitations of the network routing mechanism vulnerability analysis method based on graph neural networks and knowledge graphs above, which will not be repeated here. Each module in the above-mentioned network routing mechanism vulnerability analysis system based on graph neural networks and knowledge graphs can be implemented in whole or in part by software, hardware, and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0199] In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following is achieved:

[0200] Step 1: Based on the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to simulate the target low-orbit interconnected network topology;

[0201] Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for the typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability dataset;

[0202] Step 3: Based on the vulnerability characteristic information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set;

[0203] Step 4: Based on the constructed network routing mechanism vulnerability dataset, generate a control flow graph and a data flow graph, embed the network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0204] Step 5: Represent the nodes in the target LEO interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, and use it as the input of the target network routing mechanism vulnerability analysis model for training;

[0205] Step 6: Convert the target network routing mechanism vulnerability analysis task into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0206] For the specific limitations of each step, please refer to the limitations of the network routing mechanism vulnerability analysis method based on graph neural networks and knowledge graphs mentioned above, which will not be repeated here.

[0207] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the computer program implements:

[0208] Step 1: Based on the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to simulate the target low-orbit interconnected network topology;

[0209] Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for the typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability dataset;

[0210] Step 3: Based on the vulnerability characteristic information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set;

[0211] Step 4: Based on the constructed network routing mechanism vulnerability dataset, generate a control flow graph and a data flow graph, embed the network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph;

[0212] Step 5: Represent the nodes in the target LEO interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, and use it as the input of the target network routing mechanism vulnerability analysis model for training;

[0213] Step 6: Convert the target network routing mechanism vulnerability analysis task into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow.

[0214] For the specific limitations of each step, please refer to the limitations of the network routing mechanism vulnerability analysis method based on graph neural networks and knowledge graphs mentioned above, which will not be repeated here.

[0215] The method of the present invention first trains the proposed network routing mechanism vulnerability analysis model, uses the trained model to predict the instruction vulnerability type in the network routing program, and then further analyzes the vulnerability of the network routing mechanism. By sorting the predicted instruction vulnerabilities, the instructions with higher vulnerabilities are reinforced, thereby improving the reliability and security of the network routing mechanism. Figure 3 Some examples of the network routing mechanism vulnerability knowledge graph constructed in the method of the present invention are shown.

[0216] Figure 4 The experimental results are presented. The experiment conducts ablation experiments by considering only node neighborhood, considering node neighborhood and relationship neighborhood, and considering Conv layer for feature extraction. The Accuracy, Precision, Recall and F1_score performance indicators are used to quantitatively compare the proposed network routing mechanism vulnerability analysis model. The experimental results show that the model has certain improvements in all four indicators.

[0217] In summary, the network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph proposed in the present invention mainly dynamically collects vulnerability information of network routing mechanism, constructs network routing mechanism vulnerability data set, constructs a more universal network routing mechanism vulnerability domain ontology model from different dimensions, extracts knowledge of the program that implements the network routing mechanism as a whole, analyzes the correlation between the program's instructions, function operations, routing protocols, network performance and other complex structural information and the vulnerability of the network routing program, completes knowledge graph construction and graph visualization, and fully learns the semantics and structural information of the nodes by training the graph neural network model based on node neighborhood and relationship neighborhood proposed in this article, accurately predicts the instructions in the routing program that may cause routing mechanism vulnerability, and analyzes the vulnerability of the routing program. Based on knowledge graph and deep learning technology, it provides effective support for the efficient and accurate prediction of instruction vulnerability. The method of the present invention helps to enhance the reliability and security of the network.

[0218] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only illustrative of the principles of the present invention. Without departing from the spirit and scope of the present invention, any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A network routing mechanism vulnerability analysis method based on graph neural network and knowledge graph, characterized by: The method comprises: Step 1: Based on the actual network topology of the target low-orbit interconnected network, a corresponding simulated network topology is established to simulate the target low-orbit interconnected network topology; Step 2: Run the network routing program on the router of the simulated network, design a fault injection scheme for the typical routing program, simulate the vulnerability of the network routing mechanism, analyze the operation results, dynamically collect the vulnerability feature information of the network routing mechanism, and build a network routing mechanism vulnerability dataset; Step 3: Based on the vulnerability characteristic information of the network routing mechanism, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which includes a concept class set, a relationship set between classes, and a class attribute set; Step 4: Based on the constructed network routing mechanism vulnerability dataset, generate a control flow graph and a data flow graph, embed the network routing mechanism vulnerability features, and build a target low-orbit interconnection network routing mechanism vulnerability knowledge graph; Step 5: Represent the nodes in the target LEO interconnection network routing mechanism vulnerability knowledge graph into a tensor matrix of a specific dimension, and use it as the input of the target network routing mechanism vulnerability analysis model for training; Step 6: Convert the target network routing mechanism vulnerability analysis task into a node classification and prediction task, construct the target network routing mechanism vulnerability analysis model HGAT-BNR, and analyze the vulnerability of instruction nodes in the target network routing mechanism vulnerability knowledge graph from four dimensions: data flow, control flow, call flow, and access flow; The simulated network topology in step 1 is constructed based on seven elements as shown in the following formula: T topology ={N scale ,N topology ,N protocol ,N state ,N safety ,N link ,N paramter } Among them, N scale is the network scale, and the network is divided into four levels according to the number of nodes in the network: small scale, medium scale, large scale, and ultra-large scale; N topology is the network topology type; N protocol N is the network routing protocol; state is the node status of the network; N safety Configure the router security in the network; N link is the link status in the network; N paramter is the network performance parameter; In step 2, we construct a network routing mechanism vulnerability dataset. The specific steps are as follows: Step 2.1: Construct the vulnerability feature dataset D of the target low-orbit internet routing mechanism as shown below: vul : D vul =(P protocol ,L link_state_info ,R router_table ,P program ,I ins ,N performance ) Among them, P protocol is the routing protocol feature, L link_state_info is the link state information feature, R router_table is the routing table feature, P program is the routing program feature, I ins is the routing program instruction feature, N performance is the network performance characteristic; a) Routing protocol characteristics P protocol The vector is shown below: P protocol ={P rip ,P ospf ,P is-is ,P bgp } Among them, P rip RIP protocol, P ospf For OSPF protocol, P is-is Is-Is protocol, P bgp It is the BGP protocol; b) Link state information characteristics L link_state_info The vector is shown below: L link_state_info ={L link_identifier ,L neighbor_router ,L state ,L sequence_number } Among them, L link_identifier L is the link identifier, which uniquely identifies the link; neighbor_router L is an adjacent router, which describes the router that is directly connected to the link and exchanges state information; state is the current state of the link; L sequence_number is a sequence number used to identify the update order of link state information; c) Routing table characteristics R router_table The vector is composed of seven tuples as shown below: R router_table ={R source_ip ,R des_ip ,R next_hop ,R interface ,R router_type ,R metric ,R router_id } Among them, R source_ip is the source IP address, R des_ip is the target IP address, R next_hop is the next hop, R interface For the interface, R router_type For router type, R metric is the router index, R router_id Unique ID for the router; d) Routing program characteristics P program The vector is shown below: P program ={P router_find_ins ,P router_plan_ins } Among them, P router_find_ins For routing discovery program related instructions, P router_plan_ins Instructions related to routing planning procedures; e) Routing Program Instruction Feature I ins The vector is shown below: I ins ={I inherent ,I bb ,I function } Among them, I inherent It is an inherent feature of the instruction; bb is the basic block feature of the instruction; I function is the relevant function feature of the instruction; f) Network performance characteristics N performance The vector is shown below: P performance ={P reliability ,P band_width ,P delay ,P cost ,P mtu ,P security ,P connect } Among them, P reliability is the network reliability, P band_width is the network bandwidth, P delay is the network delay, P cost is the network overhead, P mtu is the maximum transmission unit of the network, P security For network security status, P connect for network connectivity; Step 2.2: Run the LNRMVFE algorithm to extract the vulnerability characteristics of the target low-orbit interconnection network routing mechanism. The algorithm steps are as follows: (1) Perform routing protocol feature P protocol The construction and feature extraction methods are as follows: (2) Perform link state information feature L link_state_info The construction and feature extraction methods are as follows: (3) Perform routing table feature R router_table The construction and feature extraction methods are as follows: (4) Perform routing program feature P program The construction and feature extraction methods are as follows: (5) Perform routing program instruction feature I ins The construction and feature extraction methods are as follows: (6) Perform network performance characterization N performance The construction and feature extraction methods are as follows: The target network routing mechanism vulnerability knowledge graph ontology model constructed in step 3 is shown as follows: NRMVO=<Concept,Relation,Properities,Rule> The NRMVO model represents the domain ontology of the vulnerability of the low-orbit interconnected network routing mechanism. Concept is a set of concept classes related to the vulnerability of the low-orbit interconnected network routing mechanism. Relation is a set of relationships between concept classes related to the vulnerability of the low-orbit interconnected network routing mechanism. Properties is a set of properties corresponding to the concept classes of the low-orbit interconnected network routing mechanism. Rule is a set of related constraints on properties. In step 3, a target network routing mechanism vulnerability knowledge graph ontology model is constructed, which specifically includes: Step 3.1, construct the Concept class set as shown below: Concept={Asset,NetWork,SoftWare,Fragility} Among them, Asset represents the concept class set of asset dimension, NetWork represents the concept class set of network dimension, SoftWare represents the concept class set of software dimension, and Fragility represents the concept class set of vulnerability dimension. The specific steps to construct the Concept class set are as follows: (1) Construct the concept class set of asset dimension as shown below: Concept(Asset)={NodeType,Router} Among them, NodeType represents the node type class, and Router represents the router class; (2) Construct a set of concept classes of network dimensions as shown in the following formula: Concept(NetWork) ={TarNetTopology,NetTopoType,RouterProtocol,LinkStateInfo,RouterTable} Among them, TarNetTopology represents the target network topology, NetTopoType represents the network topology type, RouterProtocol represents the routing protocol, LinkStateInfo represents the link state information, and RouterTable represents the routing table; (3) Construct the concept class set of software dimension as shown below: Concept(SoftWare)={RouterProgram,RouterProgramIns} Among them, RouterProgram represents the routing program class, and RouterProgramIns represents the routing program instruction class; (4) Construct a set of conceptual classes of vulnerability dimensions as shown below: Concept(Fragility)={NetReliability,NetSecurity} Among them, NetReliability represents the network reliability class set, and NetSecurity represents the network security class set; Step 3.2: Construct a Relation class set. The construction method is as follows: Relation(Model)={has,obey,run,build,lead} Among them, has means inclusion relationship; obey means compliance relationship; run means operation relationship; build means construction relationship; lead means leading relationship; Step 3.3: Build the Properties attribute class collection, which specifically includes the following attribute collections: (1) Construct the attribute set of the Router class in the asset dimension as shown below: Properties(Router)={RouterID,RouterIP,RouterPort} Where RouterID is the unique identifier of the router, RouterIP is the IP address of the router, and RouterPort is the port of the router. (2) Construct the attribute set of the LinkStateInfo class in the network dimension as shown in the following formula: Properties(LinkStateInfo) ={LID, LType, LSequenceNumber, LDesIP, LAdjcentRouters, LLinkWeight}, where LID is the unique identifier of the link, LType is the type of link state information, LSequenceNumber is the sequence number of the link state information, LDesIP is the destination IP address in the link state information, LAdjcentRouters is the adjacent router in the link state information, and LLinkWeight is the link weight in the link state information. (3) Construct the attribute set of the RouterTable class in the network dimension as shown below: Properties(RouterTable)={RTDesIP,RTNextHop,RTPort,RTPriority} Among them, RTDesIP represents the destination IP address of the route item in the routing table, RTNextHop represents the next hop address of the route item in the routing table, RTPort represents the destination port of the route item in the routing table, and RTPriority represents the priority of the route item in the routing table; (4) Construct the attribute set of the RouterProgram class in the software dimension as shown below: Properties(RouterProgram)={RPType,RPFunction,RPStatement} Among them, RPType represents the routing program type, RPFunction represents the routing program function, and RPStatement represents the routing program statement; (5) Construct the attribute set of the RouterProgramIns class in the software dimension as shown below: Properties(RouterProgramIns)={RPIInherent,RTIBB,RTIFunction} Among them, RPIInherent represents the intrinsic attribute set of the routing program instruction, RTIBB represents the basic block attribute set of the routing program instruction, and RTIFunction represents the function attribute set of the routing program instruction; (6) Construct the attribute set of the NetReliability class in the vulnerability dimension as shown below: Properties(NetReliability)={BandWidth,ThroughtPut,Delay,Cost,LossTolerance} BandWidth represents network bandwidth, ThroughPut represents network throughput, Delay represents network delay, Cost represents network cost, and LossTolerance represents network packet loss rate. (7) Construct the attribute set of the NetSecurity class in the vulnerability dimension as shown below: Properties(NetSecurity)={NNSafeState,NLSafeState} Among them, NNSafeState represents the safety status of the node in the network, 0 represents unsafe and 1 represents safe; NLSafeState represents the safety status of the link in the network, 0 represents unsafe and 1 represents safe; Step 3.4: Build a Rule class set. The construction method is as follows: Rule(Properties)={dataType,isNull,defaultValue,lowerBound,upperBound} Among them, dataType indicates the data type of the attribute set in the ontology model, isNull indicates whether the value is empty, defaultValue indicates the default value, lowerBound indicates the lower bound of the value of the attribute set in the ontology model, and upperBound indicates the upper bound of the value of the attribute set in the ontology model; In step 4, a knowledge graph of the vulnerability of the target LEO interconnection network routing mechanism is constructed, which specifically includes: Step 4.1: Run the R-HRGA algorithm to automatically construct and generate the routing program heterogeneous relationship graph RHRG. The steps of the R-HRGA algorithm are as follows: Step 4.1.1, generate the entity node of RHRG; Step 4.1.2, construct the control flow graph of the target routing program; Step 4.1.3, construct the data flow graph of the target routing program; Step 4.1.4, construct the call flow graph of the target routing program; Step 4.1.5, construct the access flow graph of the target routing program; Step 4.1.6: Merge the constructed control flow graph, data flow graph, call flow graph, and access flow graph to construct a heterogeneous relationship graph RHRG, where nodes represent routing program instructions and edges represent control dependencies, data dependencies, call dependencies, and access dependencies in the routing program. Step 4.2: embed the attributes of the nodes in the generated RHRG according to the vulnerability feature dataset D vul Based on the vulnerability feature type defined in [1], we traverse the RHRG, identify the nodes in the RHRG that are related to the vulnerability feature, and add the network routing mechanism vulnerability feature set as an attribute of the corresponding instruction node in the graph as the vulnerability label of the node; Step 4.3: traverse the graph consisting of the node set according to the definitions and constraints of classes, attributes, and relationships in the target network routing mechanism vulnerability knowledge graph ontology model; Step 4.4, store the extracted entity, attribute and relationship information in a CSV file; Step 4.3 specifically includes: (1) Determine whether each node in the graph represents an entity based on the Concept class set in step 3.1; (2) Extract attribute information by viewing the attributes and labels of the nodes; (3) In the process of traversing the graph, the relationships between nodes are established based on the connections and interactions between nodes, and the edges in the target network routing mechanism knowledge graph are constructed based on these established relationships; The tensor matrix in step 5 is constructed as follows: Construct the tensor matrix h of node v according to the encoding features shown in the following formula v ; h v ={NNF v ,INH v ,BB v ,FUN v ,OTH v } h v Contains five tuples, each of which is a |K|-dimensional vector, where K is the feature vector to be encoded; (1)NNF v The characteristics of the network routing nodes are shown in the following formula: NNF v ={Net_protocol,Net_program,Net_fragility} Among them, Net_protocol represents the network routing protocol; Net_program represents the network routing program; Net_fragility represents the network routing vulnerability; (2) INH v The inherent characteristics of the routing instructions are shown in the following formula: INH v ={Ins_type,Ins_ope_width,Reg_type,Ins_dyn_all_pro_ratio Among them, Ins_type represents the type of routing instruction; Ins_ope_width represents the width of the routing instruction operand, Reg_type represents the routing instruction register type, and Ins_dyn_all_pro_ratio represents the ratio of the dynamic routing instruction execution time to the total program time; (3)BB v The basic block characteristics of the routing instruction are shown in the following formula: BB v ={bb_length,Is_in_loop,Bb_remaining_ins_num,Pred_bb_num,Succ_bb_num} Among them, bb_length indicates the size of the basic block where the routing instruction is located, Is_in_loop indicates whether the routing instruction is in a loop, Bb_remaining_ins_num indicates the number of routing instructions that need to be executed before the end of the basic block, Pred_bb_num indicates the number of basic blocks preceding the routing instruction, and Succ_bb_num indicates the number of basic blocks following the routing instruction. (4)FUN v The function characteristics of the routing instruction are shown in the following formula: FUN v ={Call_num,Fun_remaining_ins_num} Among them, Call_num indicates the number of times the function containing the routing instruction is called, and Fun_remaining_ins_num indicates the number of routing instructions that need to be executed before the function returns; (5)OTH v The variable attribute characteristics of the routing instruction are as shown below: OTH v ={Is_global_var,Var_fanout_val} Among them, Is_global_var indicates whether it is a global variable, and Var_fanout_val indicates the fanout value of the variable; The construction method of the target network routing mechanism vulnerability analysis model HGAT-BNR in step 6 is as follows: Step 6.1: Based on the routing program heterogeneous relationship graph RHRG constructed in step 4.1, an attention layer structure for node neighborhood aggregation is constructed for the node information in the graph, and a multi-head attention mechanism is used in the single-layer aggregation model to stabilize the learning process of the attention mechanism; In step 6.2, for the relationship information of the node connection edges in the routing program heterogeneous relationship graph RHRG, according to the idea of ​​graph convolutional neural network message passing, the vector representation of the edge is updated by aggregating the messages from its multi-hop neighbor edges. The update equation is shown as follows: in, is the hidden state representation of edge e in round i-1, N(v) represents the set of edges directly connected to node v, It represents the summation of the hidden states of all connected edges of node v and temporarily stores messages from adjacent edges. It does not represent the message representation of node v itself. It represents the sum of the hidden states of all connected edges of node u and temporarily stores messages from adjacent edges. It does not represent the message representation of node u itself. N(e) represents the set of vertices directly connected to edge e. is the hidden state representation of edge e in the i-th iteration; AGG(·) represents the aggregation operation function, and its specific calculation method is shown in the following formula: Where [·] represents the cascade operation, W i-1 represents the learnable transformation matrix parameters, b i-1 represents the bias parameter, σ(·) represents the activation function; the depth of message passing is defined as K, and the final relationship neighborhood message of node v represents the context Step 6.3: Embedding the node neighborhood learned by the graph neural network Embedding representation of relational neighborhood Connect them together and perform two layers of convolution calculation to obtain high-level features that are more relevant to the vulnerability; the calculation method is shown in the following formula: Where CONV1 represents the first convolutional layer, RELU is the activation function, and MAXPOOL is the maximum pooling layer; Step 6.4, predict the SDC, and finally input the learned features into the multi-layer fully connected neural network for probability prediction to obtain the instruction vulnerability y ′ , which represents the probability of each instruction generating SDC, is calculated as follows: In step 6.5, use the labeled data to calculate the cross entropy loss and perform gradient update. The calculation method is as follows: Where y i represents the true label of node i, y ′ i Indicates the probability that node i is predicted to be a positive class; Step 6.6: Use the trained target network routing mechanism vulnerability analysis model HGAT-BNR to predict the vulnerability of the routing program instruction nodes in the network routing mechanism in the constructed target low-orbit interconnection network routing mechanism vulnerability knowledge graph, and obtain the vulnerability probability value of the instruction node; Step 6.1 specifically includes: Step 6.1.1, As the initial input of the attention layer, h is a set of node features, where N is the number of nodes and F is the number of attribute features of node v; In step 6.1.2, a single-relation GAT model is used to construct a recommendation model for node information aggregation. Multiple GATs are combined to construct a heterogeneous graph attention network message passing framework that simulates multiple relations. In step 6.1.3, in the last layer, the output of the M attention mechanisms is averaged and the residual mechanism is introduced to enhance the node information. The calculation method is shown in the following formula: in, represents the output vector representation of node v after L-layer information aggregation operation, M represents the number of single-layer attention heads, Represents the output vector representation of node v at the mth attention head in the L-1th layer.

Images