A method and system for secure identification of network data assets based on entity alignment

Abstract

This invention provides a method and system for secure identification of network data assets based on entity alignment, relating to the field of network security technology. The method includes: acquiring network data assets and their historical asset states and corresponding state markers; establishing associations among the network data assets; generating a first embedded representation of a conceptual entity and a second embedded representation of an instance entity; integrating the first and second embedded representations to obtain the target entity; extracting the entity features and entity labels of the target entity; constructing a random forest model; acquiring real-time entity features, i.e., real-time asset states, of the target entity in the network data assets; inputting the real-time asset states into the random forest model and outputting the identification result of the real-time asset states; outputting that the target entity is abnormal if the identification result is an abnormal state, otherwise outputting that the target entity is normal. This enables rapid cross-source collaborative defense and improves data security.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for secure identification of network data assets based on entity alignment. Background Technology

[0002] Entity alignment refers to identifying and matching different entities representing the same object from different data sources, integrating them into a unified representation. It is widely used in knowledge graphs, data integration, and other scenarios to ensure that data from different sources can be analyzed and used uniformly. Network data assets refer to valuable and meaningful data resources in the network environment, including device information (such as servers, routers, etc.), log information, user account information, etc. These assets provide crucial support for enterprises' daily operations and decision-making.

[0003] In today's complex network environment, network data assets face numerous potential security risks, such as data breaches, unauthorized access, and malicious attacks. Network data asset security identification can identify abnormal data activity and protect the security of network data assets.

[0004] However, network data contains a large amount of homogeneous and heterogeneous data. In cross-organizational collaboration, especially when sharing threat intelligence, different organizations may use different naming methods or formats to record threat sources and events. Existing asset security identification solutions do not take into account the heterogeneity between different data sources, which hinders the sharing of data security issues and cross-organizational threat retrieval, reduces the joint defense capability of network data assets, and can also cause the same threat source or security event to be regarded as multiple different events, resulting in false alarms or false alarms, which greatly increases the security risks of network data assets. Summary of the Invention

[0005] To address the issue of heterogeneous data, including both homogeneous and heterogeneous data, existing asset security identification schemes do not consider the heterogeneity between different data sources. This hinders data security issue sharing and cross-organizational threat retrieval, reduces the joint defense capability of network data assets, and can lead to the same threat source or security event being treated as multiple different events, resulting in false positives or false negatives and greatly increasing the security risks of network data assets. This invention provides a network data asset security identification method and system based on entity alignment.

[0006] The technical solutions provided by the embodiments of the present invention are as follows:

[0007] First aspect:

[0008] This invention provides a method for secure identification of network data assets based on entity alignment, comprising:

[0009] S1: Obtain network data assets and their historical asset status and corresponding status markers, including abnormal status markers and normal status markers;

[0010] S2: Establish the association relationship of network data assets, treat network data assets as conceptual entities, and extract network data assets with objects as instance entities;

[0011] S3: Use the BERT module to generate the first embedded representation of the concept entity, and use the GAN module to generate the second embedded representation of the instance entity;

[0012] S4: Use the GCN module to integrate the first and second embedding representations to obtain the target entity;

[0013] S5: Extract the entity features and entity labels of the target entity to establish a target entity training set. The entity features are the historical asset states corresponding to the target entity, and the entity labels are the state labels corresponding to the historical asset states.

[0014] S6: Combine information entropy to construct a random forest model based on the target entity training set;

[0015] S7: Obtain the real-time entity characteristics of the target entity to be identified in the network data assets, i.e., the real-time asset status corresponding to the target entity to be identified;

[0016] S8: Input the real-time asset status into the random forest model and output the identification results of the real-time asset status, which include normal status and abnormal status.

[0017] S9: If the identification result is abnormal, output that the target entity to be identified in the network data asset is abnormal; otherwise, output that the target entity to be identified in the network data asset is normal.

[0018] The second aspect:

[0019] This invention provides a network data asset security identification system based on entity alignment, comprising:

[0020] processor;

[0021] A memory storing computer-readable instructions that, when executed by the processor, implement the entity-aligned network data asset security identification method as described in the first aspect.

[0022] Third aspect:

[0023] The present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the entity-aligned network data asset security identification method as described in the first aspect.

[0024] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0025] In this invention, network data assets are divided into generalized conceptual entities and detailed instance entities with objects. Embedded representations of conceptual and instance entities are then generated using BERT and GAN modules, respectively. Based on these embeddings, a graph structure is used to align the entities and obtain the target entities. BERT captures the deep semantic relationships of conceptual entities, enhancing the understanding of abstract data; while the instance embeddings generated by GAN effectively protect data privacy and address interference from distributional differences. Alignment using a graph structure integrates global relationships, ensuring accurate matching of different entities, improving alignment accuracy and robustness, and simultaneously protecting data privacy. After alignment, a random forest model incorporating information entropy is used to identify the real-time asset state and output the data state. The introduction of information entropy dynamically adjusts feature weights, enhancing the model's sensitivity to abnormal data, accurately separating normal and abnormal states, enabling the model to capture data diversity and uncertainty, effectively reducing the false positive rate, and providing more accurate real-time monitoring and risk warning functions. By combining entity alignment, abnormal data activities from different sources can be identified and correlated in a timely manner, helping enterprises effectively monitor their cybersecurity posture, improve the accuracy and real-time nature of asset protection, thereby significantly reducing security risks to data assets. In the event of a security issue, a unified, cross-organizational, and cross-source rapid security response can be completed in a timely manner, enhancing joint defense capabilities, avoiding false alarms and missed alarms, and improving the security of network data assets. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 A flowchart illustrating a network data asset security identification method based on entity alignment provided in an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of the structure of an entity alignment model provided in an embodiment of the present invention;

[0029] Figure 3This is a schematic diagram of the structure of a network data asset security identification system based on entity alignment, provided in an embodiment of the present invention. Detailed Implementation

[0030] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0031] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0032] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, their intended meanings are consistent. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, their intended meanings are consistent.

[0033] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0034] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0035] Reference manual attached Figure 1 The diagram illustrates a flowchart of a network data asset security identification method based on entity alignment provided by an embodiment of the present invention.

[0036] Reference manual attached Figure 2 The diagram shows a structural schematic of an entity alignment model provided by an embodiment of the present invention.

[0037] This invention provides a method for secure identification of network data assets based on entity alignment. This method can be implemented by a network data asset security identification device based on entity alignment, which can be a terminal or a server. The processing flow of the network data asset security identification method based on entity alignment may include the following steps:

[0038] S1: Obtain network data assets and their historical asset status and corresponding status markers.

[0039] The status flags include abnormal status flags and normal status flags.

[0040] It should be noted that acquiring basic information about network data assets, including their historical status and status markers, provides a basis for subsequent security identification. By collecting behavioral data and status markers (normal or abnormal) of each asset at different points in time, a behavioral baseline for network assets is constructed, ensuring that the system can identify and assess abnormal asset situations and achieve accurate risk warnings.

[0041] In one possible implementation, network data assets include web servers, database servers, file servers, routers, switches, firewalls, applications, employee accounts, administrator accounts, and customer accounts.

[0042] Historical asset status includes the number of requests, accesses, network connections, access devices, and active users within a preset time period.

[0043] S2: Establish the association relationship of network data assets, treat network data assets as conceptual entities, and extract network data assets with objects as instance entities.

[0044] Entity instance alignment refers to unifying different representations of the same specific object from different sources within a knowledge graph. For example, the same server might be recorded as "Server A," "Server_A," or "DB_Server_A" in different data sources. Instance alignment identifies and matches these different representations, integrating them into a unified entity node. Conceptual entities are abstract concepts, while instance entities are concrete concepts; for example, an application is a conceptual entity, while application A, application B, etc., are instance entities. Abstract asset types are treated as conceptual entities, and concrete asset instances are treated as instance entities, thus achieving alignment and integration of data from different sources. For instance, by identifying different names for the same asset from different sources, the system can unify them into a single node, ensuring data consistency and accuracy. This process lays the foundation for subsequent embedding generation and entity alignment, facilitating more comprehensive asset monitoring and analysis across cross-source data.

[0045] In one possible implementation, the association is a knowledge graph. S2 specifically includes:

[0046] S201: Establish a knowledge graph of network data assets using Neo4j software.

[0047] Neo4j is a graph database management system specifically designed for storing and processing graph-structured data, efficiently managing nodes and relationships between them. Using the query language Cypher, Neo4j supports rapid searching of relationships and patterns in complex networks, making it ideal for knowledge graph construction and analysis. A knowledge graph is a structured representation of information, visually displaying the network of relationships within data through a graph composed of nodes (entities) and edges (relationships). Knowledge graphs are widely used in search, recommendation, and data integration, helping to reveal the structural relationships hidden within data. By constructing a knowledge graph of network data assets using Neo4j software, various network assets (such as servers, routers, and user accounts) are treated as nodes, and the relationships between assets are treated as edges, forming a relational graph. This approach visually displays the relationship network of network data assets, providing a structured foundation for subsequent data analysis and alignment operations, enabling the system to more efficiently discover and identify relationships between network assets.

[0048] S202: Clustering knowledge graph nodes based on the graph Laplacian matrix to obtain multiple node clusters;

[0049] In one possible implementation, S202 specifically includes:

[0050] S2021: Calculate the adjacency matrix and degree matrix of knowledge graph nodes. The elements of the adjacency matrix represent the connection relationship between any two knowledge graph nodes. If a connection relationship exists, the corresponding element has a value of one; otherwise, the value is zero. The elements of the degree matrix represent the number of connections between a knowledge graph node and other knowledge graph nodes.

[0051] S2022: Determining the Graph Laplacian Matrix of Knowledge Graph Nodes Based on Adjacency and Degree Matrices:

[0052] L=DA

[0053] Where L represents the graph Laplacian matrix obtained based on the adjacency matrix A and the degree matrix D.

[0054] S2023: Calculate the normalized graph Laplacian matrix of the graph:

[0055]

[0056] Among them, L norm This represents the normalized graph Laplacian matrix.

[0057] S2024: Perform eigenvalue decomposition on the standardized graph Laplacian matrix, retain a preset number of eigenvalues ​​smaller than the preset eigenvalues, and calculate the eigenvectors of each retained eigenvalue.

[0058] It should be noted that those skilled in the art can set the preset feature values ​​and preset quantities according to actual needs, and this invention does not limit them.

[0059] S2025: Use the feature vector as the embedded representation of the corresponding knowledge graph node.

[0060] S2026: Multiple node clusters are obtained by clustering the embedded representation using the k-means algorithm.

[0061] The graph Laplacian matrix is ​​a matrix used to describe graph structure and is widely used in graph theory, especially in graph segmentation and clustering tasks. This paper describes clustering nodes in a knowledge graph based on the graph Laplacian matrix. First, the adjacency matrix and degree matrix of each node are calculated, and then the graph Laplacian matrix is ​​generated. Then, through standardization and eigenvalue decomposition, important eigenvectors are used as node embeddings, and the k-means algorithm is used to cluster the embeddings, generating multiple node clusters. This process effectively separates different types of nodes in the knowledge graph, laying the foundation for accurately defining concepts and instance entities.

[0062] S203: Calculate the combined centrality of each node cluster using associative centrality, proximity centrality, and betweenness centrality:

[0063]

[0064] C composite (v)=αC d (v)+βC c (v)+γC b (v)

[0065] α+β+γ=1

[0066]

[0067] Among them, C composite cluster C represents the overall centrality of node cluster S. composite (v) represents the overall centrality of knowledge graph node v in node cluster S, and α, β, and γ represent the degree centrality C of knowledge graph node v in node cluster S, respectively. d (v) Proximity Centrality C c (v) and betweenness centrality C b The weights of (v) are given by deg(v), where deg(v) represents the degree of knowledge graph node v, i.e., the number of connections to other knowledge graph nodes, and d(v,u) represents the shortest path distance between knowledge graph node v and knowledge graph node u. σ st σ represents the total number of shortest paths from knowledge graph node s to knowledge graph node t. st(v) represents the number of shortest paths passing through node v, N represents the total number of knowledge graph nodes, and V represents the set of knowledge graph nodes.

[0068] S204: Output knowledge graph nodes in node clusters with a comprehensive centrality greater than the preset comprehensive centrality as concept entities, and output knowledge graph nodes in node clusters with a comprehensive centrality less than or equal to the preset comprehensive centrality as instance entities.

[0069] Specifically, the relationships between network data assets are represented using a knowledge graph. The steps include: First, using Neo4j software to construct a knowledge graph of network data assets to visually represent the relationships between different assets. Then, clustering the knowledge graph nodes based on the graph Laplacian matrix yields node clusters, clarifying the clustering characteristics of various asset types. Within each node cluster, the overall centrality of the nodes is calculated by combining degree centrality, proximity centrality, and betweenness centrality. Finally, nodes with an overall centrality greater than a preset value are defined as concept entities, and nodes with a centrality less than or equal to this value are defined as instance entities, thus accurately distinguishing asset representations at different levels. This process ensures the accuracy of asset classification, laying the foundation for subsequent data analysis and identification.

[0070] It should be noted that those skilled in the art can set the preset comprehensive centrality according to actual needs, and this invention does not limit this.

[0071] S3: Use the BERT module to generate the first embedding representation of the concept entity, and use the GAN module to generate the second embedding representation of the instance entity.

[0072] The BERT (Bidirectional Encoder Representations from Transformers) module is a pre-trained language model based on deep learning, capable of capturing the deep semantics of words by understanding context. It excels at extracting abstract concepts from text and generating high-quality embedding representations for the semantic expression of conceptual entities. The Generative Adversarial Network (GAN) module is a model for data generation, consisting of a generator and a discriminator. The generator is responsible for generating near-realistic fake data, while the discriminator judges the authenticity of the data. Here, GAN is used to generate embedding representations of instance entities, enabling the generation of diverse data expressions while protecting data privacy. Embedding representation is a way of mapping high-dimensional data such as text and images to a low-dimensional space, making similar concepts closer in space, thus facilitating subsequent analysis or computation.

[0073] It's important to note that the BERT module generates embedded representations of conceptual entities, while the GAN module generates embedded representations of instance entities, enabling deep semantic understanding of entities and privacy protection. This dual embedding method addresses the issue of insufficient data, ensuring that raw data is not exposed during entity alignment. This achieves accurate alignment while protecting data privacy, enhancing the system's security and flexibility. Furthermore, it overcomes the problem of insufficient data making accurate alignment based on relational structures difficult, and also protects data privacy by not directly exposing raw data during the alignment process.

[0074] In one possible implementation, the first embedded representation of the conceptual entity is generated using a BERT module, specifically including:

[0075] S301: Obtain external data about conceptual entities, where external data includes general knowledge graphs and web documents.

[0076] Optionally, the general knowledge graph can be selected from the DBpedia general knowledge graph.

[0077] S302: Extract descriptive text about conceptual entities from external data.

[0078] S303: Topic distribution for generating descriptive text using LDA topic modeling:

[0079]

[0080] K opt =argmin K Perplexity(D,K)

[0081]

[0082] Wherein, P(w|d,K) opt P(w|d,K) represents the probability of word w in descriptive text d given the number of topics Kopt, where K is the number of topics Kopt. opt This represents the total number of topics generated by the LDA topic model based on the perplexity (D,K) for a set of descriptive texts, where Perplexity (D,K) represents the perplexity of D when the number of topics is K, and argmin K Perplexity(D,K) represents the optimal number of topics K such that the number of topics K minimizes Perplexity(D,K). opt P(w|z=k) represents the probability distribution of word w in the current topic z, i.e., the k-th topic; P(z=k|d) represents the topic distribution of d; log represents the logarithmic function; exp represents the natural exponential function; N dThis represents the number of words in d, i.e., the length of the descriptive text d.

[0083] Among them, LDA (Latent Dirichlet Allocation) is a generative statistical model used for topic modeling.

[0084] Here, P(z=k|d) describes the probability that a word in the descriptive text d is assigned to a topic. This distribution represents the topic distribution of the document, that is, the proportion of topics in the document.

[0085] S304: Generating low-dimensional semantic embeddings of topic distributions of concept entities using principal component analysis algorithm:

[0086] θ' d =PCA(θ) d )

[0087] θ d =P(z=k|d)

[0088] Where, θ' d This indicates that the information about the intermediate variable θ obtained using the principal component analysis algorithm (PCA) is... d Low-dimensional semantic embedding.

[0089] S305: Generating BERT semantic embeddings with low-dimensional semantic embeddings using BERT modules:

[0090] h(e i ) = BERT(e i )

[0091] Where h(e) i ) represents the i-th conceptual entity e i The BERT semantic embedding, where BERT stands for BERT module.

[0092] S306: By fusing low-dimensional semantic embeddings and BERT semantic embeddings, the first embedding representation of the concept entity is obtained:

[0093] h final (e i )=ηh(e i )+(1-η)θ' d

[0094] Among them, h final (e i ) represents e i The first embedding representation, where η represents the fusion weight coefficient.

[0095] Optionally, η = 0.5.

[0096] It's important to note that LDA topic modeling maps the descriptive text of conceptual entities to topic distributions, generating topic vectors to represent the semantic features of each conceptual entity. These topic distribution vectors can reflect the semantic similarity between different conceptual entities. For example, "database server" and "data storage" might have similar weights on the topic of "data processing," indicating similar semantics. The output of LDA (i.e., the topic distribution vector) can serve as a feature for each conceptual entity, reflecting its weights across different topics and helping us identify which conceptual entities are semantically similar. For instance, if two conceptual entities have similar topic distributions, we can consider them potentially semantically related.

[0097] This process first acquires external data (such as DBpedia and web documents) of the conceptual entities, extracting descriptive text from it. Next, a topic distribution of the descriptive text is generated using an LDA topic model, with topic vectors reflecting the semantic features of the conceptual entities. Principal Component Analysis (PCA) is then used to reduce the dimensionality. Finally, BERT semantic embeddings of low-dimensional semantic embeddings are generated using a BERT model, and these are fused to obtain the first embedding representation of the conceptual entity. This method not only captures the deep semantic relationships of conceptual entities but also improves the semantic recognition ability of similar concepts, providing high-quality embedding support for subsequent entity alignment.

[0098] In one possible implementation, the second embedded representation of the instance entity is generated using a GAN module, specifically including:

[0099] S307: The goal is to generate entity embeddings that conform to real-world instances. The GAN module is trained under the supervision of an adversarial loss function, which is specifically:

[0100]

[0101] Where, min G max D The adversarial objectives of generator G and discriminator D are represented by G that minimizes the function and D that maximizes the function, respectively. data (x) represents the distribution of real instance entities with respect to real instance entity x, p s Let $(s)$ represent the noise distribution of $s$, $D(x)$ represent the probability that $x$ output by the discriminator $D$ is a real instance entity, $G(s)$ represent the generated instance entity generated by the generator with respect to $s$, and $D(G(s))$ represent the probability that $G(s)$ output by the discriminator $D$ is a real instance entity. Represents the distribution p of real-world entities. data The average value of all real instance entities x sampled from (x), Represents the noise distribution p sThe average value of all noise s sampled in (s).

[0102] S308: Utilize the trained GAN module to output multiple generated instance entity embeddings, i.e., the second embedding representation:

[0103] s i =G(s)

[0104] Among them, s i This represents the embedding of the i-th generated instance entity based on noise s.

[0105] It should be noted that the second embedding representation of instance entities is generated using the GAN module. Through adversarial training between the generator and discriminator, generative embeddings that approximate real instance embeddings are generated. The generator produces instance embeddings based on noisy data, while the discriminator judges the realism of the generated embeddings, ensuring that the embeddings closely approximate real instance data. The final output embedding representations are privacy-preserving because they are generated based on noise and do not directly expose the original data, thus achieving data privacy protection and diverse representation, laying the foundation for subsequent instance entity alignment.

[0106] S4: Use the GCN module to integrate the first and second embedding representations to obtain the target entity.

[0107] The GCN module is a type of neural network specifically designed for processing graph-structured data. It aggregates features of nodes and their neighbors to achieve a deep representation of each node in the graph. GCN offers significant advantages in processing interconnected data such as knowledge graphs and social networks, integrating and propagating node feature information to obtain a more comprehensive embedding representation. The GCN module integrates the embedding representations of conceptual entities and instance entities to generate a unified target entity embedding representation. By aggregating node features layer by layer, the GCN module connects conceptual entities and instance entities within the graph structure, ultimately forming an accurate entity-aligned representation. This helps capture the semantic and structural relationships of network assets in the global graph, enhancing the overall consistency of the data.

[0108] In one possible implementation, S4 specifically includes:

[0109] S401: Assign the first embedding representation to the concept entity node in the knowledge graph, and assign the second embedding representation to the instance entity node in the knowledge graph.

[0110] S402: Calculate the adjacency matrix and weight matrix of the allocated knowledge graph respectively:

[0111] S403: Integrating the knowledge graph within the GCN module based on the adjacency matrix and weight matrix:

[0112] H (l+1) =σ(A'H (l) W (l) )

[0113] H (0) =h final (e i )+s i

[0114] Among them, H (l) and H (l+1) Let A' represent the node embedding matrices of the L-th and L+1-th GCNs, respectively, of the GCN modules including the first and second embedding representations. Let W represent the adjacency matrix of the assigned knowledge graph. (l) H represents the learnable weight matrix used to transform the node embeddings of layer l into node embeddings of layer l+1, σ represents the ReLU activation function, and H represents the learning weight matrix used to transform the node embeddings of layer l+1. (0) Let s represent the initial node embedding matrix. i h represents the embedding of the i-th generated instance entity based on noise s. final (e i ) represents e i The first embedding representation.

[0115] Optionally, the learnable weight matrix can be calculated as follows:

[0116] The learnable weight matrix is ​​randomly initialized.

[0117] During each integration process, based on the principle of backpropagation, the gradient descent method is used to update the initialized learnable weight matrix until the rate of change of the learnable weight matrix is ​​less than the preset rate of change.

[0118]

[0119] Where λ represents the learning rate. The cross-entropy loss function L represents the cross-entropy loss function L with respect to W before the update. (l) gradient, This represents finding the partial derivative, y i and Let i represent the true label and the predicted label of node i, respectively, and N represent the total number of knowledge graph nodes in the knowledge graph.

[0120] The knowledge graph is integrated using the integrated learnable weight matrix.

[0121] It's important to note that the learnable weight matrix is ​​updated using gradient descent. Specifically, backpropagation calculates the gradient of the loss function with respect to the weight matrix, thus determining the direction of weight adjustment and enabling the model to classify nodes more accurately. First, the weight matrix is ​​randomly initialized. Through multiple iterations, the difference between the predicted values ​​and the true labels is calculated based on the loss function. Backpropagation is then used to calculate the gradient of the weight matrix, updating the weights and gradually reducing the error. These optimized weights are then used to integrate semantic relationships between knowledge graph nodes, enabling the model to achieve stronger recognition accuracy and robustness on new data.

[0122] S404: Output each knowledge graph node in the integrated knowledge graph as the target entity.

[0123] It's important to note that within each layer of the GCN, the embeddings of concept entities and instance entities aggregate the features of their respective neighboring nodes layer by layer. This means that the features of concept entities will propagate to instance entities to some extent, and the features of instance entities will also influence concept entities. Through multi-layer convolutional computation, concept and instance embeddings gradually merge into a unified embedding space, achieving the semantic associations required for alignment.

[0124] Specifically, in S4, the first and second embedding representations are first assigned to concept entity nodes and instance entity nodes in the knowledge graph, respectively. Then, the adjacency matrix and weight matrix of the knowledge graph are calculated to support embedding integration in the GCN module. Through multi-layer graph convolution, features of neighboring nodes are aggregated at each layer, gradually merging concept entities and instance entities in the embedding space, ultimately generating a unified target entity embedding representation. This method ensures that the semantic relationships between concepts and instance entities are fully explored, providing a solid structural foundation for achieving accurate alignment.

[0125] S5: Extract the entity features and entity labels of the target entity to establish a target entity training set.

[0126] Among them, the entity feature is the historical asset status corresponding to the target entity, and the entity label is the status marker corresponding to the historical asset status.

[0127] It's important to note that the state labels in the target entity's training set remain unchanged, representing the asset state. The historical asset states of the target entity are used as entity features, and the corresponding state labels (e.g., normal or abnormal) are used as entity tags to build the training set. By integrating the target entity's behavioral history with its state labels into training data, the model can better learn the characteristic behavior of the target entity in different states, thereby improving the accuracy of identifying future asset states. This process provides a reliable data foundation for subsequent anomaly detection models, helping to accurately locate security risks in network assets.

[0128] S6: Combine information entropy to construct a random forest model based on the target entity training set.

[0129] Information entropy, a concept in information theory, measures the uncertainty or information content of data. A higher entropy value indicates a greater degree of data disorder. In classification tasks, information entropy can be used to measure the contribution of features to class distinction, helping decision trees select the optimal split point. Random forests are ensemble learning models that perform classification or regression by constructing multiple decision trees. Each tree randomly selects a portion of data and features for training, and the final prediction is obtained through the voting results or average of all trees. The advantages of random forests include reducing the bias and variance of a single decision tree, improving model stability and generalization ability. Using information entropy to guide the construction of random forest models helps determine the optimal splitting strategy, thereby training a model that accurately identifies anomalies on the target entity training set. By ensembling multiple decision trees, random forests avoid the bias problems of a single tree and, by learning feature patterns from historical data, detect and label anomalies in new data, improving the model's robustness and sensitivity to anomalous data. This approach ensures efficient monitoring of network data assets, reducing false positives and false negatives.

[0130] In one possible implementation, S6 specifically includes:

[0131] S601: Initialize a random forest with multiple decision trees, where the decision tree parameters are different for each decision tree:

[0132] T j =DecisionTree(X j ,Y j ,d j ,s j ), j = 1, 2, ..., m

[0133] Among them, T j Let d represent the j-th decision tree in the random forest. j and s j T represents respectively j The depth and segmentation threshold are the minimum number of sample splits, m represents the number of decision trees, and X j and Y j They represent the components used to construct T. j Entity features and entity labels in the training subset.

[0134] Optionally, the specific calculation methods for decision tree depth, decision tree splitting threshold, and number of decision trees are as follows:

[0135]

[0136] Where m,d,s minLet represent the number of decision trees, the depth of each decision tree, and the minimum split threshold, respectively. δ = 0.05 represents the error probability under the PAC learning framework, ε = 0.01 represents the error magnitude, VCdim(m) represents the VC dimension measuring the complexity of the random forest at the current number of decision trees m, N' represents the total number of training samples consistent with the total number of knowledge graph nodes, τ = 0.5 represents the adjustment factor controlling the scaling range of the decision tree depth, VCdim(d) represents the VC dimension measuring the complexity of the random forest at the current decision tree depth d, R(d) represents the Rademacher complexity measuring the generalization ability of the random forest at the current decision tree depth d, ξ = 0.1 represents the adjustment factor controlling the number of decision tree splits, and ψ represents the minimum split threshold s. min The tolerance error probability, calculated using Hoeffding's inequality, is denoted as CRB(Y), representing the tolerance error probability at the current minimum segmentation threshold s. min The lower metric random forest model for entity label Y j Cramer-Rao lower bound for prediction accuracy.

[0137] It's important to note that the VC dimension and training sample number are used to ensure reasonable complexity in the random forest model, avoiding overfitting and underfitting, and helping to select an appropriate number of decision trees to achieve a balance between accuracy and computational efficiency. Depth is constrained by the VC dimension and Rademacher complexity, both of which measure the model's generalization ability and complexity, ensuring high accuracy without sacrificing stability and avoiding overfitting due to excessive depth. The minimum splitting threshold is set using the Cramer-Rao lower bound and Hoeffding's inequality error constraints to ensure robustness to small data fluctuations while maintaining prediction accuracy. Overall, this parameter selection method leverages the foundations of statistical learning theory to dynamically adjust the model structure, achieving higher generalization ability and stable prediction results on complex data. This not only improves the model's sensitivity to anomalies but also reduces the false positive rate, making random forests more reliable in complex network data asset security identification tasks.

[0138] S602: Divide the training set according to the number of decision trees to obtain multiple training subsets.

[0139] S603: Number the samples in each training subset.

[0140] S604: Calculate the information gain for samples with different numbers as split nodes:

[0141]

[0142] Where H(Y) represents the information entropy of the training subset Y, H(Y q) represents the subsets Y obtained by using the sample corresponding to the number q as the split node. q The sum of information entropy.

[0143] It should be noted that the entropy decreases significantly after segmentation (i.e., the information gain is large), indicating that this feature can segment the dataset well. Therefore, the greater the information gain, the more suitable this feature is for splitting nodes.

[0144] S605: Select the sample corresponding to the number whose information gain value is greater than the preset information gain value as the splitting criterion of the decision tree to train the decision tree and obtain the random forest model.

[0145] It's important to note that Random Forest enhances the model's generalization ability and accuracy by initializing multiple decision trees with different parameters. By sampling the training set multiple times, each decision tree independently evaluates different data slices, enhancing its understanding of the data. This approach effectively reduces model bias because different trees can capture data features from their respective perspectives, mitigating the risk of overfitting. Information gain, as the criterion for selecting the optimal split, ensures the optimal split at each node of the decision tree, minimizing uncertainty after each split and improving the overall model's prediction accuracy.

[0146] S7: Obtain the real-time entity characteristics of the target entity to be identified in the network data assets, that is, the real-time asset status corresponding to the target entity to be identified.

[0147] S8: Input the real-time asset status into the random forest model and output the identification result of the real-time asset status.

[0148] The identification results include normal and abnormal states.

[0149] S9: If the identification result is abnormal, output that the target entity to be identified in the network data asset is abnormal; otherwise, output that the target entity to be identified in the network data asset is normal.

[0150] In one possible implementation, the process after S9 includes:

[0151] In the event of an anomaly in the target entity to be identified, a warning message is sent to the source entity aligned with the target entity to initiate the defense mode.

[0152] In this context, the source entity refers to other entities aligned with the target entity. With a unified target entity to be identified, cross-source early warnings can be quickly generated upon anomaly detection, enabling rapid response and execution of collaborative defenses, thereby enhancing the security of network data assets.

[0153] In practical applications, based on entity alignment technology, network data assets are divided into abstract conceptual entities (such as applications) and concrete instance entities (such as applications A and B). Embedded representations are generated using BERT and GAN modules respectively, thus integrating information from different data sources while protecting privacy. Subsequently, graph structure alignment is performed using the GCN module to ensure accurate matching of entities from different sources and generate the target entity. A random forest model optimized with information entropy is used to monitor the real-time asset status. The model weights can be dynamically adjusted based on the diversity and uncertainty of the data status, improving the sensitivity of anomaly detection. This method not only improves the real-time performance and accuracy of network data asset security monitoring but also enables cross-organizational collaborative defense, effectively reducing false positives and false negatives, and providing strong support for network security monitoring.

[0154] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0155] In this invention, network data assets are divided into generalized conceptual entities and detailed instance entities with objects. Embedded representations of conceptual and instance entities are then generated using BERT and GAN modules, respectively. Based on these embeddings, a graph structure is used to align the entities and obtain the target entities. BERT captures the deep semantic relationships of conceptual entities, enhancing the understanding of abstract data. The instance embeddings generated by GAN effectively protect data privacy and address interference from distributional differences. Alignment using a graph structure integrates global relationships, ensuring accurate matching of different entities, improving alignment accuracy and robustness, while simultaneously protecting data privacy. After alignment, a random forest model incorporating information entropy is used to identify the real-time asset state and output the data state. The introduction of information entropy dynamically adjusts feature weights, enhancing the model's sensitivity to abnormal data, accurately separating normal and abnormal states, enabling the model to capture data diversity and uncertainty, effectively reducing the false positive rate, and providing more accurate real-time monitoring and risk warning functions. By combining entity alignment, abnormal data activities from different sources can be identified and correlated in a timely manner, helping enterprises effectively monitor their cybersecurity posture, improve the accuracy and real-time nature of asset protection, thereby significantly reducing security risks to data assets. In the event of a security issue, a unified, cross-organizational, and cross-source rapid security response can be completed in a timely manner, enhancing joint defense capabilities, avoiding false alarms and missed alarms, and improving the security of network data assets.

[0156] Reference manual attached Figure 3 The diagram shows a structural schematic of a network data asset security identification system based on entity alignment provided by the present invention.

[0157] The present invention also provides a network data asset security identification system 20 based on entity alignment, applied to the above-mentioned network data asset security identification method based on entity alignment, comprising:

[0158] Processor 201.

[0159] The memory 202 stores computer-readable instructions that, when executed by the processor 201, implement the entity-aligned network data asset security identification method as described in the method embodiment.

[0160] The network data asset security identification system 20 based on entity alignment provided by the present invention can execute the above-mentioned network data asset security identification method based on entity alignment and achieve the same or similar technical effects. To avoid duplication, the present invention will not elaborate further.

[0161] It should be understood that the processor in the embodiments of the present invention can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0162] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0163] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0164] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0165] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0166] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0167] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0168] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0169] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0170] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0171] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0172] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0173] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the entity-aligned network data asset security identification method as described in the method embodiment.

[0174] The present invention provides a computer-readable storage medium that can implement the steps and effects of the entity-aligned network data asset security identification method of the above-described method embodiments. To avoid repetition, the present invention will not repeat them.

[0175] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0176] The following points need to be explained:

[0177] (1) The accompanying drawings of the embodiments of the present invention only involve the structures involved in the embodiments of the present invention. Other structures can refer to the general design.

[0178] (2) For clarity, the thickness of layers or regions is enlarged or reduced in the drawings used to describe embodiments of the present invention; that is, these drawings are not drawn to actual scale. It is understood that when an element such as a layer, film, region, or substrate is referred to as being “above” or “below” another element, the element may be “directly” located “above” or “below” the other element, or there may be intermediate elements.

[0179] (3) Where there is no conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other to obtain new embodiments.

[0180] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for secure identification of network data assets based on entity alignment, characterized in that, include: S1: Obtain network data assets and their historical asset status and corresponding status markers, wherein the status markers include abnormal status markers and normal status markers; S2: Establish the association relationship of the network data assets, treat the network data assets as conceptual entities, and extract network data assets with objects as instance entities; S3: Use the BERT module to generate the first embedded representation of the concept entity, and use the GAN module to generate the second embedded representation of the instance entity; S4: Integrate the first embedded representation and the second embedded representation using the GCN module to obtain the target entity; S5: Extract the entity features and entity labels of the target entity to establish a target entity training set, wherein the entity features are the historical asset states corresponding to the target entity, and the entity labels are the state labels corresponding to the historical asset states. S6: Combine information entropy to construct a random forest model based on the target entity training set; S7: Obtain the real-time entity features of the target entity to be identified in the network data assets, wherein the real-time entity features represent the real-time asset status corresponding to the target entity to be identified; S8: Input the real-time asset status into the random forest model and output the identification result of the real-time asset status, wherein the identification result includes normal status and abnormal status; S9: If the identification result is abnormal, output that the target entity to be identified in the network data asset is abnormal; otherwise, output that the target entity to be identified in the network data asset is normal. Wherein, the association relationship is a knowledge graph; S2 specifically includes: S201: Establish a knowledge graph of the network data assets using Neo4j software; S202: Clustering knowledge graph nodes based on the graph Laplacian matrix to obtain multiple node clusters; S203: Calculate the combined centrality of each node cluster using associative centrality, proximity centrality, and betweenness centrality: ； in, Represents a cluster of nodes S The overall centrality, Represents a cluster of nodes S Knowledge graph nodes in v The overall centrality, α , β and γ These represent knowledge graph nodes in the node cluster. v Degree centrality Proximity centrality and betweenness centrality The weight, Represents knowledge graph nodes v The degree, where the degree represents the number of connections to other knowledge graph nodes. Represents knowledge graph nodes v With knowledge graph nodes u The shortest path distance between them Represents knowledge graph nodes s To knowledge graph nodes t The total number of shortest paths, Indicates passing through nodes v The number of shortest paths, N This represents the total number of nodes in the knowledge graph. V Represents a set of knowledge graph nodes; S204: Output the knowledge graph nodes in the node clusters whose comprehensive centrality is greater than the preset comprehensive centrality as the concept entities, and output the knowledge graph nodes in the node clusters whose comprehensive centrality is less than or equal to the preset comprehensive centrality as the instance entities.

2. The network data asset security identification method based on entity alignment according to claim 1, characterized in that, The network data assets include web servers, database servers, file servers, routers, switches, firewalls, applications, employee accounts, administrator accounts, and customer accounts; The historical asset status includes the number of requests, accesses, network connections, access devices, and active users within a preset time period.

3. The network data asset security identification method based on entity alignment according to claim 1, characterized in that, S202 specifically includes: S2021: Calculate the adjacency matrix and degree matrix of the knowledge graph nodes, wherein the elements of the adjacency matrix represent the connection relationship between any two knowledge graph nodes. If a connection relationship exists, the corresponding element has a value of one, otherwise the value is zero. The elements of the degree matrix represent the number of connections between a knowledge graph node and other knowledge graph nodes. S2022: Determine the graph Laplacian matrix of the knowledge graph nodes based on the adjacency matrix and the degree matrix: ； in, Representation based on adjacency matrix A Sum-degree matrix D The obtained graph Laplacian matrix; S2023: Calculate the normalized graph Laplacian matrix of the given graph Laplacian matrix: ； in, Represents the normalized graph Laplacian matrix; S2024: Perform eigenvalue decomposition on the standardized graph Laplacian matrix, retain a preset number of eigenvalues ​​smaller than a preset eigenvalue, and calculate the eigenvector of each retained eigenvalue; S2025: Use the feature vector as the embedded representation of the corresponding knowledge graph node; S2026: Cluster the embedded representation using the k-means algorithm to obtain multiple node clusters.

4. The network data asset security identification method based on entity alignment according to claim 1, characterized in that, The generation of the first embedded representation of the concept entity using the BERT module specifically includes: S301: Obtain external data about the concept entity, wherein the external data includes general knowledge graphs and web documents; S302: Extract descriptive text about the conceptual entity from the external data; S303: Generate the topic distribution of the descriptive text using the LDA topic model: ； in, This indicates that the number of topics is Next word w In descriptive text d The probability, This indicates that the number of topics is K Next word w In descriptive text d The probability, This indicates that the LDA topic model is based on perplexity. The generated descriptive text collection D Total number of topics Indicates the number of topics. K hour D The level of confusion, Indicates taking such that Minimum number of topics K As the optimal number of topics , Indicator w In the current topic z For the first k Probability distribution for each topic express d The topic distribution, where log represents the logarithmic function and exp represents the natural exponential function. express d The number of words in d, where the number of words in d represents the length of the descriptive text d; S304: Generate low-dimensional semantic embeddings of the topic distribution of the said concept entities using principal component analysis algorithm: ； in, This indicates the information about the intermediate variables obtained using the principal component analysis (PCA) algorithm. Low-dimensional semantic embedding; S305: Generate the BERT semantic embedding of the low-dimensional semantic embedding using the BERT module: ； in, Indicates the first i A conceptual entity BERT semantic embedding, Indicates the BERT module; S306: Merge the low-dimensional semantic embedding and the BERT semantic embedding to obtain the first embedding representation of the concept entity: ； in, express The first embedding representation, This represents the fusion weighting coefficient.

5. The network data asset security identification method based on entity alignment according to claim 1 or 4, characterized in that, The generation of the second embedded representation of the instance entity using the GAN module specifically includes: S307: With the goal of generating entity embeddings that conform to real-world instances, the GAN module is trained under the supervision of an adversarial loss function, which is specifically: ； in, Represents generator G and discriminator D The adversarial target, wherein the generator G and discriminator D The adversarial targets are respectively represented by the values ​​that minimize the function. G and when the function reaches its maximum value D , Represents real-world instance entities x Real-world entity distribution This represents the noise distribution with respect to noise s. Discriminator D Output x The probability of a real instance entity. This indicates that the generator produces noise. s Generate instance entities, Discriminator D Output The probability of a real instance entity. Represents the distribution of real-world entity instances. All real-world instance entities obtained from mid-sampling x The average value, Indicates the distribution of noise All noise obtained from mid-sample s The average value; S308: The trained GAN module outputs multiple generated instance entity embeddings, wherein the generated instance entity embeddings represent the second embedding, and the second embedding represents: ； in, Indicates based on noise s The generated first i Each generated instance entity is embedded.

6. The network data asset security identification method based on entity alignment according to claim 4, characterized in that, S4 specifically includes: S401: The first embedded representation is assigned to the concept entity node in the knowledge graph, and the second embedded representation is assigned to the instance entity node in the knowledge graph respectively; S402: Calculate the adjacency matrix and weight matrix of the allocated knowledge graph respectively; S403: Based on the adjacency matrix and the weight matrix, the knowledge graph is integrated in the GCN module: ； in, and These respectively represent the GCN modules including the first embedding representation and the second embedding representation. l Layer GCN and the first l +1 layer GCN node embedding matrix, This represents the adjacency matrix of the assigned knowledge graph. Indicates the use of the first l Layer node embedding transformed into the first l Learnable weight matrix for node embeddings in layer +1. Represents the ReLU activation function. Represents the initial node embedding matrix. Indicates based on noise s The generated first i A generated instance entity embedding, express The first embedded representation; S404: Output each knowledge graph node in the integrated knowledge graph as the target entity.

7. The network data asset security identification method based on entity alignment according to claim 1, characterized in that, S6 specifically includes: S601: Initialize a random forest with multiple decision trees, where the decision tree parameters are different for each decision tree: ； in, Represents the first random forest j A decision tree, and They represent The depth and the segmentation threshold, wherein the depth and the segmentation threshold represent The minimum number of sample splits, m Indicates the number of decision trees. and They represent the components used for construction. Entity features and entity labels in the training subset; S602: Divide the training set according to the number of decision trees to obtain multiple training subsets; S603: Number the samples in each training subset; S604: Calculate the information gain for samples with different numbers as split nodes: ； in, Represents the training subset Y Information entropy Indicated by number q The corresponding samples are used as split nodes to obtain each subset. The sum of information entropy; S605: Select the sample corresponding to the number whose information gain value is greater than the preset information gain value as the splitting criterion of the decision tree to train the decision tree to obtain the random forest model.

8. The network data asset security identification method based on entity alignment according to claim 1, characterized in that, Following S9, the following is also included: In the event of an anomaly in the target entity to be identified, a warning message to activate the defense mode is sent to the source entity aligned with the target entity to be identified.

9. A network data asset security identification system based on entity alignment, characterized in that, include: processor; A memory storing computer-readable instructions, which, when executed by the processor, implement the entity-aligned network data asset security identification method as described in any one of claims 1 to 8.

Images