Entity-based network space map expression method, space-time entity visualization method and system

Abstract

The invention relates to the cross technical field of cyberspace surveying and mapping and geographic information visualization, and provides an entity-based cyberspace map expression method, a space-time entity visualization method and a space-time entity visualization system. The cyberspace map expression method is used for expressing cyberspace time-space entity data from an entity layer, a feature layer and a change layer, and specifically comprises the following steps: step 101, performing entity classification on the obtained cyberspace time-space entity data, and constructing a cyberspace entity layer; step 102, extracting features of each network space time-space entity in the network space entity layer, and constructing a network space feature layer; and step 103, recording each feature change of different network space time-space entities in the network space feature layer, and constructing a network space change layer. A cyberspace time-space entity expression model is established from an entity layer, a feature layer and a change layer, and the specific content of each layer is subjected to formalized expression, so that the characteristics of complex association and high-speed dynamic change of elements in a cyberspace map can be accurately expressed.

Description

Technical Field

[0001] The present invention relates to the cross-technical field of cyberspace mapping and geographic information visualization, and in particular to an entity-based cyberspace map expression method, a space-time entity visualization method and a system. Background Art

[0002] With the development of emerging technologies such as big data, artificial intelligence, and the Internet of Things, cyberspace has become the "second living space" for human production and life. Cyberspace contains a huge amount of information, is widely distributed, and has a complex structure. In order to deeply explore and understand cyberspace, an important visualization tool, the cyberspace map, is needed. The cyberspace map can clearly, intuitively, and vividly express cyberspace, helping people better understand the laws of development and change in cyberspace.

[0003] Cyberspace maps associate cyberspace with geographic space and use mapping methods and techniques to express the characteristics of various aspects of cyberspace elements. However, there are two problems with maps in expressing the high-speed dynamic changes and ubiquitous associations of cyberspace elements: (1) Maps organize and store mapping data in the form of layers, which can only express static spatial relationships, but cannot express the complex associations between cyberspace elements, such as the friendships between social accounts and the connections between network devices. (2) Map data models express geographic information in a static way, which loses the time characteristics. Cyberspace is changing rapidly, and some cyberspace information is very easy to change. For example, cyber attacks are often completed within 1 second, and news is forwarded tens of thousands of times within 1 minute. Map models are not suitable for expressing the characteristics of high-speed dynamic changes of cyberspace elements. Summary of the invention

[0004] In order to solve the problem that the current map data model is difficult to effectively express the complex correlation characteristics and dynamic change characteristics of cyberspace elements, the present invention provides an entity-based cyberspace map expression method, which expresses the cyberspace map from the entity layer, feature layer and change layer, and formalizes the specific content of each layer, which can accurately express the complex and high-speed dynamic change characteristics of cyberspace elements.

[0005] In a first aspect, the present invention provides an entity-based network space map expression method, comprising:

[0006] Step 101: classify the acquired cyberspace spatiotemporal entity data and construct a cyberspace entity layer;

[0007] Step 102: extracting the features of each cyberspace spatiotemporal entity in the cyberspace entity layer, and constructing a cyberspace feature layer;

[0008] Step 103: Record the characteristic changes of different cyberspace spatiotemporal entities in the cyberspace characteristic layer to construct a cyberspace change layer.

[0009] Further, step 1 specifically includes: dividing the cyberspace spatiotemporal entity data into physical facility entities, logical network entities and network user entities;

[0010] The above classification results of network spatiotemporal entity data are expressed as:

[0011] E={E i |E i ∈{P,L,U},i=1,2,…,n}

[0012] Among them, E i It represents the i-th cyberspace spatiotemporal entity that needs to be expressed in the cyberspace map, n represents the number of cyberspace spatiotemporal entities in the cyberspace map, P represents the set of physical facility entities, L represents the set of logical network entities, and U represents the set of network user entities.

[0013] Further, in step 102, the characteristics of the cyberspace spatiotemporal entity include spatial characteristics, attribute characteristics, morphological characteristics, relationship characteristics and behavioral characteristics;

[0014] Among them, for a single cyberspace space-time entity, its characteristic C is expressed as:

[0015] C={Pos,Forms,Attrs,Relations,Behaviors}

[0016] Among them, Pos represents spatial features, Forms represents morphological features, Attrs represents attribute features, Relations represents relationship features, and Behaviors represents behavioral features.

[0017] Further, in step 3, the feature change includes constant, discrete change and continuous change;

[0018] The expression of the discrete changes adopts the form of version sequence, which specifically includes: when the characteristics of the cyberspace space-time entity change once, it is necessary to record the time of the characteristic change and the corresponding characteristic item that changes, forming a version of the entity;

[0019] The discrete change process is expressed as:

[0020] E i = {V i1 ,V i2 ,…,V im}={[T i1 ,C i1 ],[T i2,C i2 ],…,[T im ,C im ]}

[0021] Among them, {V i1 ,V i2 ,…,V im} means E i version sequence, m represents the number of versions in the version sequence, [T i1 ,T im ] means E i The entire life cycle from creation to disappearance, i1 ,C i2 ,…,C im} means E i The feature set of each version, and the difference between two adjacent versions is E i The feature set C i There is a difference, C i Only the changed features are recorded;

[0022] The continuous change process is expressed as:

[0023] E i (t) = {C i (t)|t∈[T a ,T b ]}

[0024] Where t represents the time step, C i (t) represents the feature change at time step t, [T a ,T b ] indicates the start time and end time of the continuous change.

[0025] In a second aspect, the present invention provides a method for visualizing spatiotemporal entities for a network space map, comprising:

[0026] Step 201: Processing the original cyberspace entity data according to the method described above to obtain cyberspace spatiotemporal object data; wherein the cyberspace spatiotemporal object data is the target cyberspace entity layer, the target cyberspace feature layer and the target cyberspace change layer corresponding to the target cyberspace spatiotemporal entity;

[0027] Step 202: Map the target network space entity layer, the target network space feature layer and the target network space change layer to the real geographic space through map symbols or visualization charts to obtain a visualization result of the target network space spatiotemporal entity.

[0028] Furthermore, the visualization process of discrete changes in the target network spatial change layer is as follows:

[0029] Dividing the target cyberspace entity layer into cyberspace spatiotemporal entity subclasses according to application scenarios;

[0030] Based on the discrete changes of the features in the cyberspace spatiotemporal entity subclasses, setting corresponding mapping rules;

[0031] Binding multimodal symbols to mapping rules of features in the cyberspace spatiotemporal entity subclasses.

[0032] Furthermore, the visualization process of continuous changes in the target network space change layer is as follows:

[0033] Load the continuous change process of each feature of the target network space-time entity, and obtain the start time, end time and process simulation function of the feature;

[0034] Classifying the continuously changing features of the target network space-time entity, and distinguishing different types of features by different symbolic static visual variables;

[0035] Based on the symbol static visual variables, parameter settings for the change type and related dynamic visual variables are added.

[0036] Furthermore, the relationship feature visualization content in the target network space feature layer includes relationship type, relationship strength and relationship direction, which are expressed by different visual variables of symbols;

[0037] Among them, the relationship type is visualized through the shape, hue and texture variables of the symbol; the relationship strength is visualized through the size, transparency and rate of change of the symbol; the relationship direction is visualized through the arrow of the linear symbol, the gradient of the linear symbol or the moving direction of the linear symbol.

[0038] In a third aspect, the present invention provides a spatiotemporal entity visualization system for a cyberspace map, comprising:

[0039] The entity layer construction module is used to classify the original cyberspace space-time entities and construct the cyberspace entity layer;

[0040] A feature layer construction module, used to extract the features of each cyberspace spatiotemporal entity in the cyberspace entity layer and construct a cyberspace feature layer;

[0041] A change layer construction module is used to record the characteristic changes of different cyberspace spatiotemporal entities in the cyberspace characteristic layer to construct a cyberspace change layer;

[0042] The map visualization module is used to map the cyberspace entity layer, the cyberspace feature layer and the cyberspace change layer into the real geographic space to obtain the visualization result of the target cyberspace spatiotemporal entity.

[0043] In a fourth aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described above when executing the program.

[0044] Beneficial effects of the present invention:

[0045] The present invention provides an entity-based cyberspace map expression method, which uniformly describes and expresses cyberspace spatiotemporal entities through three levels: entity layer, feature layer and change layer, laying a foundation for the organization and management of cyberspace map data, thereby meeting the application requirements of refined, dynamic and diversified expression of cyberspace maps. On the one hand, in addition to representing the most basic characteristics of cyberspace spatiotemporal entities such as location, quality and quantity attributes, cyberspace maps can also represent complex relationships between entities and their dynamic change processes, which is conducive to people's more comprehensive and refined cognition of cyberspace. On the other hand, for the same cyberspace spatiotemporal entity, different people may need to express different focuses. Some may focus on the distribution of the entity in the geographic space, while others may focus on the network connection relationship with other entities. Through this model, cyberspace maps can meet the personalized expression needs of users and provide a reference for making more diversified cyberspace maps in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 One of the flow diagrams of an entity-based network space map expression method provided by an embodiment of the present invention;

[0047] Figure 2 A second flow chart of an entity-based network space map expression method provided by an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of a dynamic expression of discrete changes provided by an embodiment of the present invention;

[0049] Figure 4 A schematic diagram of a spatiotemporal entity visualization process for a network space map provided by an embodiment of the present invention;

[0050] Figure 5 A schematic diagram of the target network space space-time entity state change and symbol mapping provided by an embodiment of the present invention;

[0051] Figure 6 A visual schematic diagram of a continuous change process provided by an embodiment of the present invention;

[0052] Figure 7 A schematic diagram of the target network space spatiotemporal entity relationship characteristics and symbol mapping provided by an embodiment of the present invention;

[0053] Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention;

[0054] Fig. 9 A schematic diagram of network security event visualization provided by an embodiment of the present invention;

[0055] Fig.10 A schematic diagram of network security events and network device status changes in 2017 provided by an embodiment of the present invention;

[0056] Fig.11 A schematic diagram of network security events and network device status changes in 2021 provided by an embodiment of the present invention;

[0057] Fig.12 A schematic diagram of network security events and network device status changes in 2022 provided by an embodiment of the present invention;

[0058] Fig.13 A schematic diagram of the results of visualizing entity relationship features in cyberspace provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] like Figure 1 and Figure 2 As shown, the embodiment of the present invention provides an entity-based network space map expression method, which expresses network space spatiotemporal entity data from three levels: entity layer, feature layer and change layer, including:

[0061] Step 101: Classify the acquired cyberspace spatiotemporal entity data and construct a cyberspace entity layer, which specifically includes:

[0062] The cyberspace spatiotemporal entity data is divided into physical facility entities, logical network entities and network user entities, and each type of entity can be further subdivided. Among them, physical facility entities include network transmission media (such as optical cables and coaxial cables), network interconnection facilities (such as routers, switches, base stations and hubs), and access facilities (such as computers, mobile phones and cameras); logical network entities include application services, network protocols and logical links; network user entities include network activity personnel and user accounts.

[0063] It can be understood that the cyberspace entity layer mainly determines the specific cyberspace spatiotemporal entities that need to be expressed in the cyberspace map. Usually, the feature descriptions of similar entities are similar, and the symbol styles are relatively consistent when expressing them on the map. Therefore, it is necessary to classify the cyberspace spatiotemporal entities.

[0064] The above classification results of network spatiotemporal entity data are expressed as:

[0065] E={E i |E i ∈{P,L,U},i=1,2,…,n}

[0066] Among them, E i It represents the i-th cyberspace spatiotemporal entity that needs to be expressed in the cyberspace map, n represents the number of cyberspace spatiotemporal entities in the cyberspace map, P represents the set of physical facility entities, L represents the set of logical network entities, and U represents the set of network user entities.

[0067] Step 102: extracting the features of each cyberspace spatiotemporal entity in the cyberspace entity layer and constructing a cyberspace feature layer;

[0068] It can be understood that the cyberspace feature layer defines the common and individual characteristics of different cyberspace space-time entities, and is the basic and inseparable characteristic of cyberspace space-time entities.

[0069] The characteristics of cyberspace space-time entities include spatial characteristics, attribute characteristics, morphological characteristics, relationship characteristics and behavioral characteristics. For a single cyberspace space-time entity, its characteristic C is expressed as:

[0070] C={Pos,Forms,Attrs,Relations,Behaviors}

[0071] Among them, Pos represents spatial features, Forms represents morphological features, Attrs represents attribute features, Relations represents relationship features, and Behaviors represents behavioral features;

[0072] (1) Spatial characteristics reflect the spatial location or distribution of space-time entities in cyberspace. They can express the spatial location or distribution of space-time entities in cyberspace and are one of the basic characteristics of all space-time entities in cyberspace. Commonly used expressions include geographic coordinates, IP addresses, etc., and geographic coordinates and IP addresses can also be mapped.

[0073] (2) Morphological features refer to the forms of cyberspace space-time entities after digital description and visualization, such as point symbols, line symbols, three-dimensional models, etc. A cyberspace space-time entity can have multiple forms. Morphological features are expressed as:

[0074] Forms = {Form i |i=1,2,…,m1}

[0075] Among them, Form i represents the ith form of the cyberspace space-time entity, and m1 represents the number of morphological features of the cyberspace space-time entity.

[0076] (3) Attribute characteristics reflect the nature of cyberspace space-time entities. The attribute characteristics of space-time entities at different levels vary greatly. For example, physical facility entities are located at the physical layer of network interconnection, logical network entities are located at the logical layer, and network user entities are located at the social layer. The attribute characteristics of entities at different levels vary greatly. It should be noted that in addition to inherent characteristics such as name and number, many attributes of cyberspace space-time entities, such as traffic, bandwidth, and usage status, are volatile. Each cyberspace space-time entity has multiple attributes, and the attribute characteristics are expressed as:

[0077] Attrs = {Attrs i |i=1,2,…,m2}={[Name i ,Value i ]|i=1,2,…,m2}

[0078] Among them, Attr i represents the i-th attribute of the cyberspace space-time entity, m2 represents the number of attribute features of the cyberspace space-time entity, and is represented by the attribute name Name i and the attribute value i Express in one-to-one correspondence.

[0079] (4) Relationship characteristics reflect the collection of associations, constraints, and effects between spatiotemporal entities in cyberspace, and can describe the ubiquitous associations and linkages in cyberspace. The types of relationships in cyberspace are complex and diverse, including connectivity relationships, network adversarial relationships, and social friendship relationships. Relationship characteristics can be expressed as:

[0080] Relations = {[DeEntity i ,Edgej ]|i=1,2,…,m3; j=1,2,…,n1}

[0081] Edge j ={RName,RValue}

[0082] Among them, DeEntity i represents the i-th target cyberspace space-time entity that establishes a relationship with the current cyberspace space-time entity. The direction of establishing the relationship is from the current cyberspace space-time entity to the target cyberspace space-time entity. m3 represents the number of target cyberspace space-time entities. Edge j Represents the corresponding relationship edge, n1 represents the number of relationship edges, each edge is expressed by the relationship name RName and the relationship strength RValue, and there may be multiple relationship edges between two entities.

[0083] (5) Behavior characteristics reflect some network operations or activities performed by cyberspace space-time entities, including data operations and network attacks and defenses, which will lead to changes in the spatial characteristics, morphological characteristics, attribute characteristics, and relationship characteristics of the entity or other cyberspace space-time entities. The expression results of behavior characteristics are usually reflected in the changes of other characteristics. Based on the needs of map expression, the embodiment of the present invention only describes the basic information of behavior characteristics. Behavior characteristics can be expressed as:

[0084] Behaviors = {[TEntity i ,BName j ]|i=1,2,…,m4; j=1,2,…,n2}

[0085] Among them, TEntity represents the target cyberspace space-time entity affected by the current cyberspace space-time entity behavior, m4 represents the number of target cyberspace space-time entities affected by the current cyberspace space-time entity behavior, n2 represents the number of current cyberspace space-time entity behaviors, and BName represents the specific name of the behavior.

[0086] Step 103: Record the characteristic changes of different cyberspace spatiotemporal entities in the cyberspace characteristic layer to construct a cyberspace change layer;

[0087] It can be understood that the cyberspace change layer is used to record and express how cyberspace spatiotemporal entities and their characteristics change. Compared with geographic entities, cyberspace spatiotemporal entities are more time-varying. As time goes by, each feature of cyberspace spatiotemporal entities may change. Therefore, in addition to expressing the multidimensional features of cyberspace spatiotemporal entities, cyberspace maps also need to express the dynamic changes of these features, such as changes in spatial features, changes in morphological features, changes in attribute features, changes in relationship features, etc.

[0088] Specifically, the embodiment of the present invention divides the change types of features into three types: unchanged, discrete change and continuous change.

[0089] Specifically, the feature expression of discrete changes adopts the version sequence method. When the feature of a cyberspace-time entity changes once, it is necessary to record the feature change time and the corresponding feature item that has changed to form a version of the current cyberspace-time entity. During the life cycle of the current entity, its features may change many times. The versions are sorted in the order of time, and the dynamic change process of the cyberspace-time entity is represented by the version sequence. For a cyberspace-time entity E i For , its discrete dynamic change process can be expressed as:

[0090] E i = {V i1 ,V i2 ,…,V im}={[T i1 ,C i1 ],[T i2 ,C i2 ],…,[T im ,C im ]}

[0091] Among them, {V i1 ,V i2 ,…,V im} represents the cyberspace space-time entity E i version sequence, m represents the number of versions in the version sequence, [T i1 ,T im ] means E i The entire life cycle from creation to disappearance, i1 ,C i2 ,…,C im} represents the cyberspace space-time entity E i The feature set of each version, and the difference between two adjacent versions in the version sequence is E i The feature set C i There is a difference, C i Only the changed features are recorded;

[0092] It can be understood that discrete changes mainly refer to the sudden changes in the characteristics of the cyberspace entity's IP address, form, quantity, state, relationship, etc. at a certain moment, such as a sudden computer interruption (attribute change), unfollowing a Weibo account (relationship change), etc. The version sequence is used to represent the dynamic change process of the cyberspace entity, so that the historical data can be traced back through the version information when performing data visualization.

[0093] To facilitate understanding, an example is given to illustrate the process expression of discrete changes, such as Figure 3 As shown, the life cycle of computer A is the time period [T1, T5], with a total of 5 versions: computer A is created at time T1; at time T2, the status of computer A changes from normal to interrupted, and it is disconnected from router B; at time T3, computer A returns to normal, its IP address changes, and it is connected to routers B and C; at T4, a network attack is launched; and at T5, the life cycle of computer A ends.

[0094] Specifically, for a certain cyberspace space-time entity E i For , its continuous change characteristics can be expressed as:

[0095] E i (t) = {C i (t)|t∈[T a ,T b ]}

[0096] Where t represents the time step, C i (t) represents the characteristic change at time t, [T a ,T b ] indicates the start time and end time of continuous change. i The feature set C i Each feature item in may produce continuous dynamic changes, so they are all related to the time step t. When visualizing, different process simulation functions are called for different features, which can realize the spatial-temporal entity E in the network space. i Dynamic expression of continuous changes of different features. It should be noted that the process simulation function is a function that adjusts the dynamic changes of graphic symbols during visualization. For example, during a network attack, the network attack line is moving, so the process simulation function is a formula that calculates the position where the attack line moves at different times through the starting point coordinates, arrival point coordinates and movement time. After completing a cycle, the above process is repeated to clearly show the continuous changes of the network attack. For example, when conducting network defense, the process simulation function is to set the circle from the initial radius to how large it spreads, how many seconds it takes to complete the spread, whether it is cyclical, etc., to achieve visualization of network defense.

[0097] It can be understood that continuous change mainly refers to the continuous change process of the spatiotemporal entity feature items in the network space within a certain period of time, which generally has the characteristics of continuous, repetitive and high-frequency changes. Typical application scenarios include tens of thousands of network attacks per second and millions of forwardings of posts in ten minutes. In this case, using the version sequence method will lead to too frequent and inefficient data access and scheduling, so the continuous change feature expression provided by the embodiment of the present invention is used to express the map.

[0098] An entity-based cyberspace map expression method provided in an embodiment of the present invention provides a unified description and expression of cyberspace spatiotemporal entities from three levels: entity layer, feature layer, and change layer, thereby laying a foundation for the organization and management of cyberspace map data, thereby meeting the application requirements of refined, dynamic, and diversified expression of cyberspace maps.

[0099] like Figure 4 As shown, the embodiment of the present invention also provides a method for visualizing spatiotemporal entities for a network space map, including:

[0100] Step S201: Processing the original cyberspace entity data according to the entity-based cyberspace map expression method provided in the above embodiment to obtain cyberspace spatiotemporal object data; wherein the cyberspace spatiotemporal object data is a target cyberspace entity layer, a target cyberspace feature layer, and a target cyberspace change layer corresponding to the target cyberspace spatiotemporal entity;

[0101] It can be understood that the method provided in the above embodiment realizes the detailed description and expression of various characteristics and changes of cyberspace spatiotemporal entities in the cyberspace map, enriches the expression content of the cyberspace map, and lays the foundation for the unified organization and visual expression of cyberspace map data.

[0102] Step S202: Map the target network space entity layer, the target network space characteristic layer and the target network space change layer to the real geographic space through map symbols or visualization charts to obtain the visualization result of the target network space spatiotemporal entity.

[0103] It can be understood that with the help of different visualization methods and technologies, the dynamic mapping of each characteristic item of each cyberspace space-time entity and its change data with the map symbols can be achieved, thereby reflecting the corresponding relationship between each cyberspace space-time entity and the symbol.

[0104] Furthermore, the visualization of discrete change features mainly adopts the method of multi-modal symbols, mapping the changes of feature items through the changes of symbolic visual variables, such as using the changes of symbol type, texture, and shape to represent the changes of the entity form in the cyberspace, using different colors to represent the changes of its state, and using different sizes to represent the changes of its quantitative characteristics. The visualization process of discrete changes in the target cyberspace change layer is as follows:

[0105] Divide the target cyberspace entity layer into cyberspace spatiotemporal entity subclasses according to application scenarios;

[0106] Specifically, based on the division of the target cyberspace change layer, it is subdivided into several cyberspace spatiotemporal entity subcategories according to the application scenarios, such as the router, email account, link and other subcategories in Table 1. Generally, the characteristic items of similar entities are similar and the symbol styles are relatively consistent.

[0107] Based on the discrete changes of the features in the cyberspace spatiotemporal entity subclasses, setting corresponding mapping rules;

[0108] Specifically, according to the changes in the features in the cyberspace space-time entity subclass, set the corresponding judgment rules {feature item name, operator, value}, such as Figure 5 The judgment rule of the router class is defined in {state, ==, 0}, which means that the router is in an interrupted state.

[0109] Binding the multimodal symbol to the mapping rules of the features in the cyberspace spatiotemporal entity subclass;

[0110] Specifically, the mapping rules of multi-mode symbols and feature items are bound, that is, {object subclass, {feature item name, operator, value}, symbol}. For a single cyberspace spatiotemporal entity, it is only necessary to configure different multi-mode symbols in its time version sequence according to the changes in the feature value of the entity, thereby realizing the dynamic visualization of discrete change features. For example, if a router is in normal state at time T1, the blue symbol in Table 1 is configured, and if it is interrupted at time T2, the gray symbol in Table 1 is configured.

[0111] Furthermore, because the data of continuously changing features has a high frequency of change and strong regularity, such as visualization of network attack and defense behaviors, visualization of dynamic attributes, etc., the configuration method using multi-mode symbols will cause data access and scheduling to be too frequent and inefficient. Therefore, the embodiment of the present invention provides visualization of continuous changes in the target network space change layer, and the process is as follows:

[0112] Load the continuous changes of each feature of the target network space-time entity, and obtain the start time, end time and process simulation function of the feature;

[0113] Specifically, the continuous change process of each feature of the target cyberspace space-time entity is loaded. Taking network attack behavior as an example, the start time, end time and process simulation function of the process are obtained.

[0114] The continuously changing features of the target network space-time entities are classified, and different types of features are distinguished by different symbolic static visual variables; among them, symbolic static visual variables refer to the changes in the most basic graphic factors that can cause visual differences under static conditions, such as the color, shape, size, direction, etc. of the symbol.

[0115] Specifically, the feature types of continuously changing features are classified, and different types are distinguished by static visual variables. Taking network attacks as an example, static visual variables are used to distinguish network attack types, such as Figure 6As shown, the attack type is distinguished by the symbol color visual variable, and the attack direction is expressed by the moving direction of the line symbol. The thickness of the line symbol can indicate the attack frequency or scale.

[0116] Add parameter settings for change types and related dynamic visual variables based on symbolic static visual variables;

[0117] Specifically, on the basis of the static visual variables of the symbol, the parameter settings of the change type and related dynamic visual variables are added to realize the visualization of dynamic symbols. Figure 6 As shown, the dynamic change type is the displacement of the linear symbol. When implementing it, first set the path points, direction and duration of the linear symbol; then call the process simulation function according to the current time displayed to dynamically modify the coordinate position of the linear symbol to achieve a dynamic effect; finally, set the loop visualization until the entire network attack process is completed.

[0118] Furthermore, the visualization content of relational features in the target network spatial feature layer includes relation type, relation strength and relation direction, which are expressed by different visual variables of symbols;

[0119] Among them, Figure 7 As shown in the figure, the relationship type is visualized by the shape, hue and texture variables of the symbol; the relationship strength is visualized by the size, transparency and rate of change of the symbol; the relationship direction is visualized by the arrow of the line symbol, the gradient of the line symbol or the direction of the line symbol movement. It should be noted that the relationship characteristics can also change dynamically over time.

[0120] It can be understood that in addition to general spatial and temporal relationships, cyberspace spatiotemporal entities also include attribute relationships, that is, relationships with certain semantic properties. When visualizing, the relationship features are mainly expressed as the connection between two cyberspace spatiotemporal entities.

[0121] The embodiment of the present invention further provides a spatiotemporal entity visualization system for a cyberspace map, comprising:

[0122] The entity layer construction module is used to classify the original cyberspace space-time entities and construct the cyberspace entity layer;

[0123] The feature layer construction module is used to extract the features of each cyberspace spatiotemporal entity in the cyberspace entity layer and construct the cyberspace feature layer;

[0124] The change layer construction module is used to record the changes of various characteristics of different cyberspace spatiotemporal entities in the cyberspace characteristic layer and construct the cyberspace change layer;

[0125] The map visualization module is used to map the cyberspace entity layer, cyberspace feature layer and cyberspace change layer into the map to realize the visualization of spatiotemporal entities on the map.

[0126] like Figure 8 As shown, an embodiment of the present invention further provides an electronic device, which may include: a processor 801, a communications interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communications interface 802 and the memory 803 communicate with each other through the communication bus 804. The processor 801 may call the logic instructions in the memory 803 to execute the method provided by the above embodiment, for example, including: expressing the cyberspace spatiotemporal entity data from the entity layer, the feature layer and the change layer, specifically including: step 101: classifying the acquired cyberspace spatiotemporal entity data to construct a cyberspace entity layer; step 102: extracting the features of each cyberspace spatiotemporal entity in the cyberspace entity layer to construct a cyberspace feature layer; step 103: recording the feature changes of different cyberspace spatiotemporal entities in the cyberspace feature layer to construct a cyberspace change layer.

[0127] For example, it also includes: Step 201: Processing the original cyberspace entity data according to an entity-based cyberspace map expression method provided in the above embodiment to obtain cyberspace spatiotemporal object data; wherein the cyberspace spatiotemporal object data is a target cyberspace entity layer, a target cyberspace feature layer, and a target cyberspace change layer corresponding to the target cyberspace spatiotemporal entity; Step 202: Mapping the target cyberspace entity layer, the target cyberspace feature layer, and the target cyberspace change layer to the real geographic space through map symbols or visualization charts to obtain a visualization result of the target cyberspace spatiotemporal entity.

[0128] In addition, when the logic instructions in the above-mentioned memory 803 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0129] In order to verify the rationality and effectiveness of the visualization method provided by the embodiment of the present invention, the feasibility of visualization of cyberspace maps is verified by using cyberspace spatiotemporal object data, taking the visualization expression of typical national cybersecurity events as an example. The cyberattack event data in the experiment were collected from more than 900 web pages of Internet news, involving 53 different countries and 213 cybersecurity events from 1972 to 2022, and the network equipment data were mainly simulated data. The above is batch converted into cyberspace spatiotemporal object data through multi-granularity spatiotemporal object collection and editing tools.

[0130] Based on the full-space spatiotemporal object access engine, a set of object visualization systems based on Web browsers is implemented using the Cesium front-end 3D geographic information visualization framework. Fig. 9 As shown in the figure, using the above visualization method, the "timeline-map" shows the changes in cyber attacks and network device connections between typical countries at different times. The secondary screen uses charts to express the changes in attribute information such as attack types and proportions, number of security incidents, etc. over time. Clicking the event symbol at the corresponding position under a certain time version on the map can link to detailed information on the cyberspace security incident that occurred in the country at that time.

[0131] like Figures 10-12 As shown, the network security incidents and changes in network equipment status in 2017, 2021 and 2022 are shown respectively. Fig.13 In addition to displaying network devices and their connection relationships on the map, by selecting a router device, other network devices connected to the router can also be displayed. Based on the idea of ​​materialization, this prototype system realizes the multi-dimensional, dynamic, and associated visual expression of spatiotemporal object data in cyberspace.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network space map expression method based on entity, characterized in that: The cyberspace spatiotemporal entity data is expressed from the entity layer, feature layer and change layer, including: Step 101: classify the acquired cyberspace spatiotemporal entity data and construct a cyberspace entity layer; Step 102: extracting the features of each cyberspace spatiotemporal entity in the cyberspace entity layer, and constructing a cyberspace feature layer; Step 103: Record the characteristic changes of different cyberspace spatiotemporal entities in the cyberspace characteristic layer to construct a cyberspace change layer.

2. The entity-based network space map expression method according to claim 1, characterized in that: Step 1 specifically includes: dividing the cyberspace spatiotemporal entity data into physical facility entities, logical network entities and network user entities; The above classification results of network spatiotemporal entity data are expressed as: E={E i |E i ∈{P,L,U},i=1,2,L,n} Among them, E i It represents the i-th cyberspace spatiotemporal entity that needs to be expressed in the cyberspace map, n represents the number of cyberspace spatiotemporal entities in the cyberspace map, P represents the set of physical facility entities, L represents the set of logical network entities, and U represents the set of network user entities.

3. The entity-based network space map expression method according to claim 1, characterized in that: In step 102, the characteristics of the cyberspace spatiotemporal entity include spatial characteristics, attribute characteristics, morphological characteristics, relationship characteristics and behavioral characteristics; Among them, for a single cyberspace space-time entity, its characteristic C is expressed as: C={Pos,Forms,Attrs,Relations,Behaviors} Among them, Pos represents spatial features, Forms represents morphological features, Attrs represents attribute features, Relations represents relationship features, and Behaviors represents behavioral features.

4. The entity-based network space map expression method according to claim 1, characterized in that: In step 3, the feature changes include unchanged, discrete changes and continuous changes; The expression of the discrete changes adopts the form of version sequence, which specifically includes: when the characteristics of the cyberspace space-time entity change once, it is necessary to record the time of the characteristic change and the corresponding characteristic item that changes, forming a version of the entity; The discrete change process is expressed as: E i ={V i1 ,V i2 ,L,V im }={[T i1 ,C i1 ],[T i2 ,C i2 ],L,[T im ,C im ]} Among them, {V i1 ,V i2 ,L,V im } means E i version sequence, m represents the number of versions in the version sequence, [T i1 ,T im ] means E i The entire life cycle from creation to disappearance, i1 ,C i2 ,L,C im } means E i The feature set of each version, and the difference between two adjacent versions is E i The feature set C i There is a difference, C i Only the changed features are recorded; The continuous change process is expressed as: E i (t)={C i (t)|t∈[T a ,T b ]} Where t represents the time step, C i (t) represents the feature change at time step t, [T a ,T b ] indicates the start time and end time of the continuous change.

5. A method for visualizing spatiotemporal entities for cyberspace maps, characterized in that: include: Step 201: Processing the original cyberspace entity data according to the method of claim 4 to obtain cyberspace spatiotemporal object data; wherein the cyberspace spatiotemporal object data is a target cyberspace entity layer, a target cyberspace feature layer, and a target cyberspace change layer corresponding to the target cyberspace spatiotemporal entity; Step 202: Map the target network space entity layer, the target network space feature layer and the target network space change layer to the real geographic space through map symbols or visualization charts to obtain a visualization result of the target network space spatiotemporal entity.

6. A method for visualizing spatiotemporal entities for cyberspace maps according to claim 5, characterized in that: The visualization process of discrete changes in the target network spatial change layer is as follows: Dividing the target cyberspace entity layer into cyberspace spatiotemporal entity subclasses according to application scenarios; Based on the discrete changes of the features in the cyberspace spatiotemporal entity subclasses, setting corresponding mapping rules; Binding multimodal symbols to mapping rules of features in the cyberspace spatiotemporal entity subclasses.

7. The method for visualizing spatiotemporal entities for cyberspace maps according to claim 5, characterized in that: The visualization process of continuous changes in the target network spatial change layer is as follows: Load the continuous change process of each feature of the target network space-time entity, and obtain the start time, end time and process simulation function of the feature; Classifying the continuously changing features of the target network space-time entity, and distinguishing different types of features by different symbolic static visual variables; Based on the symbol static visual variables, parameter settings for the change type and related dynamic visual variables are added.

8. The method for visualizing spatiotemporal entities for cyberspace maps according to claim 5, characterized in that: The relationship feature visualization content in the target network space feature layer includes relationship type, relationship strength and relationship direction, which are expressed by different visual variables of symbols; Among them, the relationship type is visualized through the shape, hue and texture variables of the symbol; the relationship strength is visualized through the size, transparency and rate of change of the symbol; the relationship direction is visualized through the arrow of the linear symbol, the gradient of the linear symbol or the moving direction of the linear symbol.

9. A spatiotemporal entity visualization system for cyberspace maps, characterized in that: include: The entity layer construction module is used to classify the original cyberspace space-time entities and construct the cyberspace entity layer; A feature layer construction module, used to extract the features of each cyberspace spatiotemporal entity in the cyberspace entity layer and construct a cyberspace feature layer; A change layer construction module is used to record the characteristic changes of different cyberspace spatiotemporal entities in the cyberspace characteristic layer to construct a cyberspace change layer; The map visualization module is used to map the cyberspace entity layer, the cyberspace feature layer and the cyberspace change layer into the real geographic space to obtain the visualization result of the target cyberspace spatiotemporal entity.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

Images