A network space asset dynamic fusion mapping method based on knowledge graph enhancement

Abstract

The present application relates to the technical field of network space asset mapping, and particularly relates to a network space asset dynamic fusion mapping method based on knowledge graph enhancement, which is based on real network environment asset intelligence data, constructs an asset attribute co-reference resolution mechanism based on asset intelligence quality, defines asset intelligence data quality measurement indexes, comprehensively evaluates asset intelligence data quality, and guides network semantic co-reference attribute resolution in multi-source asset intelligence data. A network space asset knowledge graph ontology structure of six-tuple structure is designed, network asset entities and asset relationships are extracted through asset attribute representation and asset protocol analysis, and the network asset entities and relationships are accurately represented in combination with the ontology structure. The false alarm domain name asset entity alignment algorithm is used to identify the scope of the generic resolution domain name asset entity in the asset intelligence data, and the effective public main domain asset is extracted to align the false alarm asset entity, which helps to eliminate the noise of network asset fusion mapping and improve the accuracy of network asset knowledge representation results.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network space asset mapping, and in particular to a network space asset dynamic fusion mapping method based on knowledge graph enhancement. BACKGROUND

[0002] The trend of digital transformation accelerates the pace of asset digitization and service informatization in various industries, bringing convenience to people while also giving rise to more extensive digital asset security problems. On the one hand, the number of Internet exposed assets has expanded dramatically, and the complex business relationship network has led to a lack of understanding of the network asset inventory and a lack of clarity in the associated structure of assets, which is an important factor in the lack of threat perception ability of network assets in various industries. On the other hand, the open source intelligence of Internet exposed assets is heterogeneous and ubiquitous, and the data quality is not the same, which poses challenges to the convergence of asset information and the convergence of asset defense profile.

[0003] Therefore, the demand for comprehensive and accurate network asset knowledge representation is on the agenda, which requires solving the problems of asset intelligence data fusion, co-reference attribute resolution, entity attribute and relationship representation, and false positive result alignment in open source asset intelligence data. Network space assets and their relationships can be abstracted as a representation model with a graph structure. The asset information of the target domain name is extracted from the asset intelligence data, and the standardized asset intelligence data is used to construct the asset data set. Define asset intelligence data quantitative evaluation indicators and asset type weights, comprehensively evaluate asset data quality, and resolve asset semantic co-reference attributes. Further, the knowledge graph technology is used to model the network space asset entities and their relationships, and the entity relationship representation structure between the asset data is constructed. The pan-analysis mechanism is introduced to construct the pan-analysis domain name asset feature, identify the false positive domain name asset and align it to the effective asset main domain, and eliminate the noise data in the asset mapping result.

[0004] The traditional network asset fusion mapping method has limitations. On the one hand, multi-source heterogeneous network asset intelligence data is distributed on the Internet, and the extraction of asset data and their relationships requires higher professional knowledge. On the other hand, asset data lacks effectiveness verification, fusion data conflicts, and widespread asset false positives, which will bring data noise to the final asset knowledge representation result. In addition, the lack of a suitable network space asset representation structure model makes the network asset knowledge understanding have a high threshold. SUMMARY

[0005] The purpose of the present application is to provide a network space asset dynamic fusion mapping method based on knowledge graph enhancement, which combines knowledge graph and network space asset fusion mapping, and is used to solve the problems of multi-source asset attribute semantic co-reference conflict, entity pan-analysis, and asset false positive in the network space asset fusion mapping scenario.

[0006] In order to achieve the above object, the application provides a network space asset dynamic fusion mapping method based on knowledge graph enhancement, comprising the following steps:

[0007] Step 1: taking the target domain name as the initial asset seed, crawling the multi-source network asset open source intelligence data exposed to the Internet, extracting valid asset data through asset data preprocessing, and constructing a standardized asset intelligence data set;

[0008] Step 2: defining the core asset accuracy, asset attribute completeness index combined with the asset type weight, designing an asset intelligence data quality quantitative evaluation mechanism based on semantic co-reference attribute resolution, and resolving the asset semantic co-reference attribute based on the quantitative results;

[0009] Step 3: establishing an external asset knowledge base to complete the missing asset information of the standardized asset intelligence data set, constructing a single complete network asset data set, designing a network space asset knowledge graph ontology with a six-tuple structure, constructing a network asset entity representation structure and relationship extraction rule based on asset entity attribute and asset protocol analysis, and forming a network asset entity and relationship fusion result set;

[0010] Step 4: designing a false domain name asset entity alignment algorithm based on the similarity of pan-resolution features, identifying the pan-resolution false domain name asset range in the network asset entity fusion result set, and aligning the pan-resolution domain name asset entity set to the effective main domain asset entity.

[0011] Optionally, in step 1, the target asset related open source asset intelligence is crawled to construct an original asset intelligence data set DS, a wrapper rule is designed to label and extract network assets and naming attributes, invalid asset samples in the extraction result are filtered by regular verification, and a multi-source standardized asset intelligence data set DS is formed standardized , network asset type AssetType, original asset intelligence data set DS and standardized asset intelligence data set DS standardized are defined as follows:

[0012] AssetType={Subdomain,Host,Service,Certs,Registration,Department,Location,AS}

[0013] DS={(e,k,v)|e∈E assetT ,k∈K assetT ,v∈V assetT ,assetT∈AssetType}

[0014] In the original multi-source asset data set DS result, the network asset object set is E Asset , the key set is K Asset , and the value set is VAsset wherein E assetT , K assetT , V assetT are asset object set, key set and value set corresponding to asset type;

[0015] The standardized asset intelligence data set DS standardized is composed of |DS standardized | tuples and m attributes, A = {A[1], A[2],..., A[m]} is the attribute set of DS standardized , each tuple t ∈ DS standardized is composed of asset label e ∈ E asset and attribute value set V, denoted as V = {t.A[1], t.A[2],..., t.A[m]}, wherein t.A[m] is the attribute value of the mth attribute of tuple t.

[0016] Optionally, the core asset accuracy Acc CoreAsset , asset attribute integrity AttrInt assetT and asset intelligence data quality evaluation result QE DS in step 2 are defined as follows:

[0017]

[0018] wherein, the core type asset E CoreAsset weight ω1 = 0.6, the number W = |E CoreAsset |, other type assets weight ω2 = 0.4, the number

[0019] Optionally, the six-tuple structure network space asset knowledge graph ontology in step 3 is used to represent the network space asset model structure, wherein the six-tuple structure is T = {E, R, A, V, T r , T a}, E represents each type of asset entity, R is the entity relationship, A is the asset concept attribute, and V is the asset attribute value. Wherein T r = {(h, r, t) | h, t ∈ E, r ∈ R} is a set of three-tuple relationships representing the relationship between network asset entities, represented as (entity1, relation, entity2); T a = {(e, a, v) | e ∈ E, a ∈ A, v ∈ V} is a set of three-tuple attributes representing the attributes of network asset entities, represented as (entity, attribute, value).

[0020] Optionally, in order to solve each standardized asset intelligence data set DS standardizedThe network asset attribute information missing problem existing in the middle, through constructing a network asset knowledge base based on external data sources, is used for network asset missing attribute knowledge completion to construct a complete network asset dataset DS complete , defined as follows:

[0021] DS complete = {(E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl )|

[0022] E cpl ∈E,R cpl ∈R,A cpl ∈A,V cpl ∈V,T r_cpl ∈T r ,T a_cpl ∈T a}

[0023] Wherein E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl are asset entities, relations, entity attributes, entity attribute values, entity relation sets and entity attribute relation sets of the complete network asset dataset DS complete .

[0024] Optionally, during the execution of step 3, the same type of network assets are extracted from the standardized asset intelligence dataset to construct a fused same type of network asset set, and the single complete network asset dataset DS complete The asset entity extraction result and the fused asset entity set result are defined as follows, wherein i is the DS complete number, and n is the DS complete quantity:

[0025] T a_assetT = {(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT∈AssetType}

[0026] T a_assetT_fusion = {{T[1] a_assetT ,...,T[i] a_assetT} assetT E AssetType, 1 < i < n}.

[0027] Optionally, according to the network asset ontology structure and asset relationship characteristics, network asset entity relationship extraction rules based on protocol analysis are designed, combined with asset entity attributes, to construct various standardized asset entity association relationships, and form various network asset entity relationship sets, wherein the relationship set type is defined as:

[0028] AssetRelation = { RESOLVED_TO, DEPLOYED_AS, REGISTERED_IN, BELONGS_TO,

[0029] BOUND_TO, DEVIDED_INTO, LOCATED_AT}

[0030] Single complete network asset data set DS complete Asset entity relationship extraction results and fused asset relationship set results are defined as follows, wherein i is the DS complete number, and n is the DS complete quantity:

[0031] T r_assetR = { (h assetT , r assetR , t assetT ) | h assetT , t assetT E E cpl , r assetR E R cpl}

[0032] T r_assetR_fusion = { {T[1] r_assetR ,..., T[i] r_assetR} | assetR E AssetRelation, 1 < i < n}.

[0033] Optionally, the false domain name asset entity alignment algorithm based on the similarity of the generic resolution feature, according to the generic resolution domain name asset feature, extracts the relationship set T r_RESOLVED_TO_fusion with the same TTL and the same response host IP from the asset relationship result, obtains the domain name asset entity mapped by the asset relationship, and obtains the preliminary potential generic resolution domain name asset entity set T' a_subdomain_sh , and then obtains the service asset entity set T' a_subdomain_sh mapped by the preliminary potential generic resolution domain name asset entity set T' r_DEPLOYED_AS_fusion through the service deployment relationship set T a_service_sw , wherein T r_RESOLVED_TO_fusion , T' a_subdomain_sh , and T' a_service_sw are defined as follows:

[0034] T r_RESOLVED_TO_fusion {{T[1 r_assetR ,...,T[i r_assetR ]|assetR=RESOLVED_TO,1≤i≤n}

[0035] T′ a_subdomain_sh ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT=Subdomain}

[0036] T′ a_service_sw ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT=Service}.

[0037] The application provides a network space asset dynamic fusion mapping method based on knowledge graph enhancement, constructs an asset attribute coreference resolution mechanism based on asset intelligence quality based on real network environment asset intelligence data, defines asset intelligence data quality measurement indexes, comprehensively evaluates asset intelligence data quality, and guides network semantic coreference attribute resolution in multi-source asset intelligence data. A network space asset knowledge graph ontology structure of six-tuple structure is designed, network asset entities and asset relationships are extracted through asset attribute representation and asset protocol analysis, and the ontology structure is combined to accurately represent network asset entities and relationships. The false positive domain name asset entity alignment algorithm based on the pan-analysis feature similarity is used to identify the pan-analysis domain name asset entity range in the asset intelligence data, extract effective public domain asset alignment false positive asset entities, which helps to eliminate network asset fusion mapping noise and improve the accuracy of network asset knowledge representation results. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0039] Figure 1 is a step flow diagram of a network space asset dynamic fusion mapping method based on knowledge graph enhancement of the present application.

[0040] Figure 2 is a structural diagram of a network space asset knowledge graph ontology in a specific embodiment of the present application.

[0041] Figure 3 is a knowledge graph-based network space asset fusion mapping framework diagram in a specific embodiment of the present application. DETAILED DESCRIPTION

[0042] Embodiments of the present application will be described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numbers represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the present application, and cannot be understood as a limitation of the present application.

[0043] Referring to Figure 1 , the present application provides a network space asset dynamic fusion mapping method based on knowledge graph enhancement, comprising the following steps:

[0044] S1: Taking a target domain name as an initial asset seed, crawling multi-source network asset open source intelligence data exposed to the Internet, extracting valid asset data through asset data preprocessing, and constructing a standardized asset intelligence data set;

[0045] S2: Defining core asset accuracy, asset attribute completeness index combined with asset type weight, designing asset intelligence data quality quantitative evaluation mechanism based on semantic co-reference attribute resolution, and resolving asset semantic co-reference attributes based on quantitative results;

[0046] S3: Establishing an external asset knowledge base to complete missing asset information of the standardized asset intelligence data set, constructing a single complete network asset data set, designing a six-tuple structure network space asset knowledge graph ontology, constructing a network asset entity representation structure and relationship extraction rule based on asset entity attribute and asset protocol analysis, and forming a network asset entity and relationship fusion result set;

[0047] S4: Designing a false positive domain name asset entity alignment algorithm based on pan-resolution feature similarity, identifying the scope of pan-resolution false positive domain name assets in the network asset entity fusion result set, and aligning the pan-resolution domain name asset entity set to the effective main domain asset entity.

[0048] The following will be further described in combination with specific embodiments and execution steps, as shown in Figure 2 and Figure 3 :

[0049] In step S1, the target main domain name is used as the initial asset seed to crawl multi-source network asset intelligence data exposed on the Internet, and an original network asset intelligence dataset belonging to the target main domain name is constructed. Specifically, the initial network asset intelligence dataset has:

[0050] DS = {(e, k, v) | e E assetT , k K assetT , v V assetT , assetT AssetType}

[0051] AssetType = {Subdomain, Host, Service, Certs, Registration, Department, Location, AS}

[0052] Wherein, the network asset object set is E Asset , the key set is K Asset , and the value set is V Asset , wherein E assetT , K assetT , V assetT are the asset object set, key set and value set corresponding to the asset type.

[0053] Based on the original network asset intelligence dataset, the main domain asset related asset type data is extracted from the semi-structured asset intelligence data, and via data preprocessing, a standardized network asset intelligence dataset is formed. Specifically, in combination with step (1) of Figure 3 , a wrapper rule is designed to label the semi-structured asset intelligence data <title>、< / title> Tag elements containing network asset data are used to extract network assets and naming attributes. Regular expressions are then used to filter out invalid asset samples (such as wildcard domain names containing "*", Class C address internal network format host assets, etc.) from the extracted results. A standardized multi-source asset dataset is constructed, and the result can be defined as: Standardized Asset Intelligence Dataset DS standardized By |DS standardized A consists of tuples and m attributes, where A = {A[1], A[2], ..., A[m]} is the DS. standardized The attribute set, where each tuple t∈DS standardized By asset marker e∈E asset Together with the attribute value set V, it is denoted as V={tA[1],tA[2],...,tA[m]}, where tA[m] is the attribute value of tuple t on the m-th attribute.

[0054] Step S2, based on the standardized multi-source asset dataset, constructs a quantitative evaluation mechanism for asset intelligence data quality based on semantic coreference attribute resolution by defining core asset accuracy, asset attribute completeness, and asset type weights. This mechanism is used to resolve asset semantic coreference attributes. Specifically, Figure 3 In step (2) of the framework diagram, the network assets and their attributes under the same type are divided into categories. The same asset object with similar attributes from different datasets is aggregated, and the text similarity of the aggregated attributes is calculated using cosine similarity. The portion with a threshold higher than 95% is selected as the core attribute recognition result. The mechanism defines the core asset accuracy Acc. CoreAsset CoreAsset = {Subdomain, Host, Service}, CoreAsset ∈ AssetType represents DS standardized Chinese domain name assets, hosting assets, and service assets are the three categories of network assets. CoreAsset Survival sample percentage, asset type attribute completeness AttrInt assetT ,assetT∈AssetType represents DS standardized The completeness of information on the attributes of various types of network assets can be measured by the following indicators:

[0055]

[0056]

[0057] Furthermore, such as Figure 3 Step (3) considers that domain name assets, host assets, and service assets have high priority in the overall asset mapping results in AssetType, and in the core asset accuracy Acc CoreAsset AttrInt, the completeness of asset attributes assetT On this basis, weights are assigned to different types of network assets, and the data quality of each dataset asset is quantified comprehensively. Among them, the core type asset E CoreAsset Weight ω1=0.6, quantity W=|E CoreAsset |, other type assets Weight ω2=0.4, quantity Data set asset intelligence data quality evaluation result QE DS Has:

[0058]

[0059] As Figure 3 shown in the semantic coreference attribute resolution part (step (6)), the core asset accuracy Acc CoreAsset , attribute integrity AttrInt assetT , assetT∈AssetType combined with asset type weights ω1, ω2, the quality of each DS standardized asset intelligence data quality evaluation result QE DS , with QE DS The result is higher asset attribute as the basis for resolving asset coreference attributes.

[0060] After obtaining the multi-source standardized network asset intelligence dataset quality quantitative evaluation result, in order to solve the problem of missing asset attribute information in each dataset, through Figure 3 Step (4) described above, the network asset knowledge base based on external data sources is constructed, which is used for network asset missing attribute knowledge completion to construct complete network asset dataset. For example, Whois knowledge base is used to complete domain name asset registration attribute, SSL certificate knowledge base is used to complete service asset authentication attribute, and external data sources are shown in Table 1. After knowledge completion, each DS standardized Corresponding single complete network asset dataset DS complete Has:

[0061] DS complete = {(E cpl ,R cpl ,A cpl ,V cpl ,T r_cpl ,T a_cpl )|

[0062] E cpl ∈E,R cpl ∈R,A cpl ∈A,V cpl ∈V,T r_cpl ∈T r ,T a_cpl ∈T a}

[0063] Among them, E cpl ,R cpl A cpl V cpl ,T r_cpl ,T a_cpl DS complete The asset entity, relationship, entity attribute, entity attribute value, entity relationship set, and entity attribute relationship set.

[0064] Table 1 Data Sources for the Network Asset Knowledge Base

[0065]

[0066]

[0067] In step S3, based on the single complete network asset dataset, through... Figure 3 Step (5) Design a six-tuple-based ontology structure for a knowledge graph of network spatial assets to represent network assets and their relationships. Asset entities are extracted from a single complete network asset dataset using asset type objects and asset attribute features, represented as asset entity triple structures. Asset entities of the same type are then merged to construct an asset entity fusion result set. Asset relationship extraction rules are designed through asset protocol analysis to extract asset relationships from a single complete network asset dataset. Relationships of the same type are then merged to construct an asset relationship fusion result set. Specifically, combined with... Figure 2 The ontology structure of a knowledge graph of cyberspace assets can be represented as a six-tuple T = {E, R, A, V, T}. r T a In this context, E represents various types of asset entities, R represents entity relationships, A represents asset conceptual attributes, and V represents asset attribute values. Where T... r ={(h,r,t)|h,t∈E,r∈R} is a set of triples representing the relationships between network asset entities, denoted as (entity1,relation,entity2); T a ={(e,a,v)|e∈E,a∈A,v∈V} is a set of triple attributes representing the attributes of network asset entities, denoted as (entity,attribute,value).

[0068] Knowledge graph ontology of cyberspace assets, such as Figure 3 As shown in step (6), a triplet structure consisting of an entity, an attribute, and an attribute value is designed to represent different types of asset entities. Specifically, each DS... complete The results of the triplet extraction for various network asset entities are as follows:

[0069] T a_assetT ={(e assetT ,a assetT ,v assetT )|e assetT ∈E cpl ,a assetT ∈A cpl ,v assetT ∈V cpl ,assetT∈AssetType}

[0070] From a single DS complete Entity extraction result set T a_assetT There are: a set of merged entities of the same asset type:

[0071] Where i is DS complete Number, n is DS complete Quantity. The extraction of various network asset entities and their attribute definitions are shown in Table 2.

[0072] Table 2. Asset Entity Representation of the Cyberspace Asset Knowledge Graph Ontology

[0073]

[0074]

[0075] Furthermore, such as Figure 3 As shown in step (6), the relationships between asset entities are analyzed from the perspective of protocol relationships, such as domain name asset entities being mapped to host asset entities through DNS resolution, and domain name asset entities being mapped to service asset entities through HTTP protocol. Specifically, the relationship types between network asset entities can be abstracted as AssetRelation = {RESOLVED_TO, DEPLOYED_AS, REGISTERED_IN, BELONGS_TO, BOUND_TO, DEVIDED_INTO, LOCATED_AT}. Asset relationship extraction rules based on protocol analysis are established to construct each DS complete The relationships between different network assets in the system. (DS) complete The results of constructing the relationship triples between different asset entities are as follows:

[0076] T r_assetR ={(h assetT ,r assetR ,t assetT )|h assetT ,t assetT ∈E cpl ,r assetR ∈R cpl }

[0077] From a single DS complete The result set T of the relation extraction r_assetR There are: a set of fused relations of the same relation type:

[0078] T r_assetR_fusion ={{T[1] r_assetR ,...,T[i] r_assetR }|assetR∈AssetRelation,1≤i≤n}

[0079] Where i is DS complete Number, n is DS complete Quantity. The results of constructing relation triples for various network asset entities are shown in Table 3.

[0080] Table 3. Asset Relationship Representation of the Cyberspace Asset Knowledge Graph Ontology

[0081]

[0082] Furthermore, during the fusion process of multi-source asset data, wildcard domain name asset entities will lead to false asset reports in the fused rendering results. Combined with... Figure 1 , Figure 3 Step S4 aims to eliminate the concentration of wildcard domain asset entities. It designs the false positive domain asset entity alignment algorithm based on wildcard resolution feature similarity. This algorithm utilizes the idea that entities with the same assets have similar attributes, calculating the similarity of false positive entity attributes to identify the range of false positive domain assets and solve the entity alignment problem for wildcard domain assets. Specifically, as shown... Figure 3 The misreported asset entity alignment section in the framework diagram shows that during the domain name resolution process, wildcard DNS records have the same Time-to-Live (TTL) in the authoritative name server cache, all resolution records point to the same host IP, and application-layer domain name service accesses all point to the same service asset entity. Based on wildcard DNS characteristic analysis, firstly, according to the address resolution relationship set T... r_RESOLVED_TO_fusion From T a_subdomain_fusion Extracting domain name asset entities with the same DNS resolution response hosts and record time-to-live (TTL) results in a preliminary potential wildcard domain name asset entity set T′. a_subdomain_sh Secondly, through T′ a_subdomain_sh For the service deployment relationship set T r_DEPLOYED_AS_fusion Extract service asset entity set T′ a_service_sw The service asset entity pairs are converted into corresponding text vector sets (Sets) using Term Frequency-Inverse Document Frequency (TF-IDF) methods to represent the three types of attributes: service title, response content, and response header. vectorT1 ={V title1 V text1 V headers1 }、Set vectorT2 ={V title2 V text2 V headers2 Then, cosine similarity is used to calculate the service asset entity pairs Set. vectorT1 Set vectorT2 By analyzing the text vector similarity of entity attributes, and filtering out service asset entities with a cosine similarity of entity attributes higher than 95%, a set T′ of service asset entities with similar response attributes is obtained. a_service_sim , by set T′ a_service_sim Mapping a connection to set T using the domain name attribute a_subdomain_fusion The potential wildcard domain name asset entity set T′ is obtained. a_subdomain_sw .

[0083] According to the definition of wildcard DNS, a wildcard DNS domain asset entity is a copy of the wildcard DNS primary domain, therefore its wildcard DNS primary domain is a valid asset. Thus, it is necessary to extract the primary domain of the wildcard DNS domain asset set as the alignment target for false positive domain assets. Specifically, to extract the wildcard DNS primary domain, in the set T′... a_subdomain_sw Based on this, the longest common substring of its domain name structure is calculated to obtain potential wildcard domain name asset entities D with the same parent domain name structure. suspect_wildcard To further confirm D suspect_wildcard Let T′ be the generic primary domain, and use it as the input to Algorithm 1. If the result is True, then set T′ to True. a_subdomain_sw Align to D suspect_wildcard Complete the entity alignment of wildcard domain name assets; if the result is False, then D suspect_wildcard For a non-generic resolution primary domain, T′ a_subdomain_sw The collected domain asset entities are confirmed to be non-wildcard domain entities. The pseudocode for the wildcard domain entity identification algorithm is shown in the execution steps of Algorithm 1:

[0084] Step 1: Enter the domain name to be identified.

[0085] Step 2: Randomly generate N non-existent subdomains based on the input domain name.

[0086] Step 3: Perform DNS resolution on the generated random subdomain with an authoritative DNS server to obtain the Time-to-Live (TTL) and the IP address of the responding host.

[0087] Step 4: If the TTL value and the responding host IP value are the same in all of the randomly generated N subdomains, proceed to step 5; otherwise, proceed to step 6.

[0088] Step 5: Construct HTTP requests from the generated N subdomains to obtain the response text and response headers of the subdomains. Calculate the similarity between the response text and response headers of each subdomain using cosine similarity. If the text similarity between the response text and response headers is higher than the threshold, the input domain is determined to be a wildcard domain and the output result is true; otherwise, proceed to step 6.

[0089] Step 6: If the input domain name is not a wildcard domain name, the output result will be false.

[0090] The above-described is only a preferred embodiment of the present application, of course, cannot be limited by this, the person skilled in the art can understand that the whole or part of the process of realizing the above-mentioned embodiment, and the equivalent change made according to the claims of the present application, still belongs to the scope covered by the present application. 、

Claims

1. A network space asset dynamic fusion mapping method based on knowledge graph enhancement, characterized in that, The method comprises the following steps: Step 1: Taking the target domain name as the initial asset seed, crawling multi-source network asset open source intelligence data exposed to the Internet, extracting valid asset data through asset data preprocessing, and constructing a standardized asset intelligence data set; Step 2: Defining core asset accuracy and asset attribute completeness indicators combined with asset type weight, designing an asset intelligence data quality quantitative evaluation mechanism based on semantic co-reference attribute resolution, and resolving semantic co-reference attributes based on quantitative results; Step 3: Establishing an external asset knowledge base to complete the missing asset information of the standardized asset intelligence data set, constructing a single complete network asset data set, designing a network space asset knowledge graph ontology with a six-tuple structure, constructing a network asset entity representation structure and relationship extraction rule based on asset entity attribute and asset protocol analysis, and forming a network asset entity and relationship fusion result set; Step 4: Designing a false domain name asset entity alignment algorithm based on generic resolution feature similarity, identifying the generic resolution false domain name asset range in the network asset entity fusion result set, and aligning the generic resolution domain name asset entity set to the effective main domain asset entity.

2. The network space asset dynamic fusion mapping method based on knowledge graph enhancement according to claim 1, wherein AssetType={Subdomain,Host,Service,Certs,Registration,Department,Location,AS} In step 1, the target asset related open source asset intelligence is crawled to construct an original asset intelligence dataset DS, a wrapper rule is designed to label the extracted network assets and naming attributes, invalid asset samples in the extraction results are filtered by regular verification, and a standardized asset intelligence dataset DS is formed standardized , network asset type AssetType, original asset intelligence dataset DS and standardized asset intelligence dataset DS standardized are defined as follows:

3. The network space asset dynamic fusion mapping method based on knowledge graph enhancement according to claim 1, wherein DS = {(e, k, v) | e E assetT , k K assetT , v V assetT , assetT AssetType} The original asset intelligence dataset DSresult, wherein a network asset object set is E Asset , a key set is K Asset , and a value set is V Asset , wherein E assetT , K assetT , and V assetT are asset object sets, key sets, and value sets corresponding to asset types. The standardized asset intelligence dataset DS standardized By |DS standardized One tuple and m attributes, A = {A[1], A[2],..., A[m]} is the attribute set of DS standardized Each tuple t ∈ DS standardized Composed of asset markers e ∈ E asset And attribute value set V, denoted as V = {t.A[1], t.A[2],..., t.A[m]}, where t.A[m] is the attribute value of the mth attribute of tuple t.

4. The network space asset dynamic fusion mapping method based on knowledge graph enhancement according to claim 1, wherein Core asset accuracy Acc in step 2 CoreAsset Asset attribute integrity AttrInt assetT and asset intelligence data quality evaluation result QE DS are defined as follows: Among them, the core type asset E CoreAsset Weight ω1=0.6, quantity W=|E CoreAsset |, other type assets Weight ω2=0.4, quantity 5. The network space asset dynamic fusion mapping method based on knowledge graph enhancement according to claim 2, wherein The network space asset knowledge graph ontology of the sextuple structure in step 3 is used for representing a network space asset model structure, wherein the sextuple structure is T = {E, R, A, V, T r , T a}, E represents each type of asset entity, R is an entity relationship, A is an asset concept attribute, and V is an asset attribute value; wherein T r = {(h, r, t) | h, t E, r R} is a triple relationship set representing a relationship between network asset entities, and is represented as (entity1, relation, entity2); T a = {(e, a, v) | e E, a A, v V} is a triple attribute set representing a network asset entity attribute, and is represented as (entity, attribute, value).

6. The network space asset dynamic fusion mapping method based on knowledge graph enhancement according to claim 5, wherein To solve the problem of missing network asset attribute information in each standardized asset intelligence data set DS standardized , a network asset knowledge base based on external data sources is constructed to complete the missing attribute knowledge of network assets to construct a single complete network asset data set DS complete , defined as follows: DS complete = {(E cpl , R cpl , A cpl , V cpl , T r_cpl , T a_cpl ) | E cpl ∈E,R cpl ∈R,A cpl ∈A,V cpl ∈V,T r_cpl ∈T r ,T a_cpl ∈T a} wherein E cpl , R cpl , A cpl , V cpl , T r_cpl , T a_cpl are respectively asset entity, relation, entity attribute, entity attribute value, entity relation set and entity attribute relation set of a single complete network asset dataset DS complete .

7. The network space asset dynamic fusion mapping method based on knowledge graph enhancement according to claim 6, wherein During the execution of step 3, similar network assets are extracted from the standardized asset intelligence dataset to construct a merged set of similar network assets, forming a single complete network asset dataset DS. complete The results of asset entity extraction and the results of merging asset entity sets are defined as follows, where i is DS. complete Number, n is DS complete quantity: T a_assetT = {(e assetT ,a assetT ,v assetT )| e assetT ∈ E cpl , a assetT ∈ A cpl , v assetT ∈ V cpl , assetT∈ AssetType} T a_assetT_fusion = { { T[1] a_assetT ,...,T[i] a_assetT} | assetT∈AssetType,1≤i≤n}. According to the network asset ontology structure and asset relationship features, a network asset entity relationship extraction rule based on protocol analysis is designed, combined with asset entity attributes, a standardized asset entity association relationship is constructed, and a network asset entity relationship set is formed, wherein the relationship set type is defined as: AssetRelation={RESOLVED_TO,DEPLOYED_AS,REGISTERED_IN,BELONGS_TO, BOUND_TO,DEVIDED_INTO,LOCATED_AT} 8. The network space asset dynamic fusion mapping method based on knowledge graph enhancement according to claim 1, wherein Single complete network asset dataset DS complete Asset entity relationship extraction results, fused asset relationship set results are defined as follows, where i is the DS complete Number, n is the DS complete Quantity: T r_assetR = {(h assetT ,r assetR ,t assetT )|h assetT ,t assetT ∈ E cpl ,r assetR ∈ R cpl} T r_assetR_fusion = {T[i r_assetR ,...,T[i r_assetR ]| assetR E AssetRelation, 1 < i < n}. ​ The false positive domain name asset entity alignment algorithm based on the pan-resolution feature similarity extracts a relationship set T with the same TTL and the same response host IP from the asset relationship result according to the pan-resolution domain name asset feature r_RESOLVED_TO_fusion , obtains domain name asset entities mapped by the asset relationship, and obtains a preliminary potential pan-resolution domain name asset entity set T' a_subdomain_sh , further obtains a service asset entity set T' from the preliminary potential pan-resolution domain name asset entity set T' a_subdomain_sh by the service deployment relationship set T r_DEPLOYED_AS_fusion , obtains the mapped service asset entity set T' a_service_sw , wherein T r_RESOLVED_TO_fusion , T' a_subdomain_sh , T' a_service_sw are defined as follows: T r_RESOLVED_TO_fusion = {{T[1] r_assetR ,...,T[i] r_assetR}| assetR = RESOLVED_TO, 1≤i≤n} T' a_subdomain_sh = {(e assetT ,a assetT ,v assetT )| e assetT ∈ E cpl , a assetT ∈ A cpl , v assetT ∈ V cpl , assetT = Subdomain} T' a_service_sw = {(e assetT ,a assetT ,v assetT )| e assetT ∈ E cpl , a assetT ∈ A cpl , v assetT ∈ V cpl , assetT = Service}.

Images