Knowledge graph construction method and device of network security event, equipment and medium

Abstract

The invention provides a knowledge graph construction method and device for a network security event, equipment and a medium. The method comprises the following steps: acquiring network security data of a plurality of network security events; and risk information and asset information of a target network security event in the plurality of network security events; wherein the risk information comprises vulnerability information and / or threat information, and the asset information comprises hardware information and / or software information; associating the risk information with the asset information, and constructing an initial knowledge graph of the target network security event based on an association relationship between the risk information and the asset information; and extracting risk data corresponding to the risk information and asset data corresponding to the asset information from the network security data, and filling the initial knowledge graph based on the risk data and the asset data to obtain a target knowledge graph of the target network security event. Therefore, the efficiency of network security operation can be improved, and the network security of the electronic equipment is guaranteed.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a method, device, equipment and medium for constructing a knowledge graph of network security events. Background Art

[0002] Network security is a very important task in ensuring the safety of electronic devices (such as vehicles). The goal of network security is to protect electronic devices from threats caused by malicious attacks, destruction, data leakage or illegal use. Therefore, how to improve the efficiency of network security operations and ensure the network security of electronic devices is an urgent problem to be solved. Summary of the invention

[0003] In view of this, the present application provides a method, apparatus, device and medium for constructing a knowledge graph of network security events, which can improve the efficiency of network security operations and ensure the network security of electronic equipment.

[0004] In a first aspect, the present application provides a method for constructing a knowledge graph of a network security event, comprising: obtaining network security data of multiple network security events; and risk information and asset information of a target network security event among the multiple network security events; wherein the risk information includes vulnerability information and / or threat information, and the asset information includes hardware information and / or software information; associating the risk information and the asset information, and constructing an initial knowledge graph of the target network security event based on the association relationship between the risk information and the asset information; extracting risk data corresponding to the risk information and asset data corresponding to the asset information from the network security data, and filling the initial knowledge graph based on the risk data and the asset data to obtain a target knowledge graph of the target network security event.

[0005] In a second aspect, the present application provides a device for constructing a knowledge graph of network security events, including: an acquisition module, used to acquire network security data of multiple network security events; and risk information and asset information of a target network security event among the multiple network security events; wherein the risk information includes vulnerability information and / or threat information of the target network security event, and the asset information includes hardware information and / or software information of the target network security event; an association module, used to associate risk information and asset information; a construction module, used to construct an initial knowledge graph of the target network security event based on the association relationship between risk information and asset information; an extraction module, used to extract risk data corresponding to risk information and asset data corresponding to asset information from network security data; and a filling module, used to fill the initial knowledge graph based on risk data and asset data to obtain a target knowledge graph of the target network security event.

[0006] In a third aspect, the present application provides an electronic device comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store one or more executable instructions, and the executable instructions enable the processor to execute the method described in the first aspect above.

[0007] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by one or more processors, it implements the method described in the first aspect.

[0008] In a fifth aspect, the present application provides a computer program product, comprising computer program instructions, which enable a computer to execute the method described in the first aspect above.

[0009] In a sixth aspect, the present application provides a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect above.

[0010] The present application provides a method for constructing a knowledge graph of a network security event, which can obtain network security data of multiple network security events; as well as risk information and asset information of a target network security event in multiple network security events; associate risk information and asset information, and construct an initial knowledge graph of the target network security event based on the association relationship between risk information and asset information; extract risk data corresponding to risk information and asset data corresponding to asset information from network security data, and fill the initial knowledge graph based on risk data and asset data to obtain a target knowledge graph of the target network security event. In this way, different from the chain data structure of a traditional database, the target knowledge graph constructed based on risk data and asset data can visualize the association relationship between risk data and asset data, which is convenient for tracking and tracing in network security operations, thereby significantly improving the operational efficiency of network security and ensuring the network security of electronic equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0012] Figure 1 It is a flowchart of a method for constructing a knowledge graph of network security events provided in an embodiment of the present application;

[0013] Figure 2It is a schematic diagram of constructing an initial knowledge graph provided in an embodiment of the present application;

[0014] Figure 3 It is a schematic diagram of constructing a target knowledge graph provided in an embodiment of the present application;

[0015] Figure 4 It is a schematic diagram of the composition structure of a knowledge graph construction device for network security events provided in an embodiment of the present application;

[0016] Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0019] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0020] It should also be pointed out that the terms "first\second\third" involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0021] In addition, the term "and / or" in the embodiments of the present application is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0022] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0023] Network security is a very important task in ensuring the safety of electronic devices (such as vehicles). The goal of network security is to protect electronic devices from threats caused by malicious attacks, destruction, data leakage or illegal use. Therefore, how to improve the efficiency of network security operations and ensure the network security of electronic devices is an urgent problem to be solved.

[0024] Based on this, the embodiment of the present application provides a method for constructing a knowledge graph of a network security event, which can obtain network security data of multiple network security events; as well as risk information and asset information of a target network security event in multiple network security events; associate the risk information and asset information, and construct an initial knowledge graph of the target network security event based on the association relationship between the risk information and the asset information; extract the risk data corresponding to the risk information and the asset data corresponding to the asset information from the network security data, and fill the initial knowledge graph based on the risk data and the asset data to obtain a target knowledge graph of the target network security event. In this way, different from the chain data structure of the traditional database, the target knowledge graph constructed based on the risk data and the asset data can visualize the association relationship between the risk data and the asset data, which is convenient for tracking and tracing in network security operations, thereby significantly improving the operational efficiency of network security and ensuring the network security of electronic devices.

[0025] To facilitate understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The above related technologies can be combined arbitrarily with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

[0026] Figure 1 : is a flow chart of a method for constructing a knowledge graph of network security events provided in an embodiment of the present application, such as Figure 1 As shown, the method may include the following steps.

[0027] S110. Obtain risk information and asset information of a target network security event among multiple network security events.

[0028] Among them, risk information includes vulnerability information and / or threat information of the target network security event, and asset information includes hardware information and / or software information of the target network security event.

[0029] It should be noted that in the embodiments of the present application, the knowledge graph construction method of the network security incident can be applied to the knowledge graph construction device of the network security incident, or an electronic device integrated with the device. Among them, the electronic device can be implemented in various forms, for example, the electronic device can include such as vehicles, smart phones, tablet computers, laptops, PDAs, portable media players (Personal Digital Assistant, PMP), etc., which are not limited here.

[0030] It should be understood that vulnerability information refers to weaknesses or defects in network systems, software applications or hardware devices that may be exploited by attackers. These vulnerabilities may lead to unauthorized access, data leakage, service interruption and other security issues.

[0031] It should also be understood that threat information refers to external or internal factors that pose potential hazards to network security, including malware, malicious attacks, internal personnel misoperation, etc. These threats may lead to data leakage, system paralysis, service interruption and other consequences.

[0032] It should also be understood that hardware information refers to the physical devices that make up the network system and their configuration information, including servers, routers, switches, firewalls, etc. The performance, configuration and security of these physical devices directly affect the overall security level of the network system.

[0033] It should also be understood that software information refers to software applications running on the network system and their version information, including operating systems, databases, middleware, application software, etc. The security and stability of these software directly affect the function and security of the network system.

[0034] Exemplarily, an Over-The-Air (OTA) attack event on a vehicle refers to an event in which a vehicle is attacked remotely through a wireless communication network. This attack method exploits the wireless communication function of the vehicle and performs unauthorized operations or data tampering on the vehicle through the air interface, thereby threatening the safety and functionality of the vehicle. Taking the OTA attack event where the target network security event is a vehicle as an example, vulnerability information may include update management vulnerabilities and software management vulnerabilities of the OTA system, threat information may include the relationship between attackers, the attacker's attack on the vehicle by some means of attack, hardware information may include the attacked vehicle, and software information may include the OTA system and the attacked software.

[0035] In some embodiments, obtaining risk information and asset information of a target network security event among multiple network security events may include: obtaining alternative risk information and alternative asset information of the target network security event from a network security information library or preset rules; and fusing and disambiguating the alternative risk information and alternative asset information respectively to obtain risk information and asset information.

[0036] It should be noted that the Cybersecurity Information Database is a database specifically used to store and manage cybersecurity-related information. The Cybersecurity Information Database enables rapid identification, analysis, and response to cybersecurity incidents.

[0037] It should also be noted that the preset rules can be set manually or in other ways, and the embodiments of the present application are not limited to this.

[0038] It should be understood that the preset rules may include a mapping relationship between multiple network security events and the corresponding candidate risk information and candidate asset information. Therefore, after obtaining the target network security event, the candidate risk information and candidate asset information corresponding to the target network security event can be obtained based on the mapping relationship.

[0039] It should also be understood that in addition to obtaining alternative risk information and alternative asset information of the target network security event from the network security information library or preset rules, alternative risk information and alternative asset information can also be obtained by other means, and the embodiments of the present application are not limited to this.

[0040] Through this method, by fusing the alternative risk information and the alternative asset information respectively, a comprehensive information set can be obtained, making the fused risk information and asset information more accurate and complete, and avoiding the omission of important information; by disambiguating the fused risk information and asset information respectively, the duplicate information in the fused risk information and asset information can be removed, thereby simplifying the amount of information of the final risk information and asset information, and improving the efficiency of subsequent processing of the risk information and asset information.

[0041] S120: Associating risk information with asset information, and constructing an initial knowledge graph of the target network security event based on the association relationship between the risk information and the asset information.

[0042] It should be noted that by associating risk information with asset information, it is possible to obtain asset information associated with the risk information after the risk information is acquired, making it easier to take certain repair measures for the asset information.

[0043] For example, taking the target network security event as an OTA attack event for a vehicle, after knowing that the attacker attacks the vehicle using some attack means, we can further obtain the attacked vehicle, the OTA system in the attacked vehicle, and the attacked software.

[0044] It should be understood that the risk information and asset information involved in the target network security incident can be obtained through the initial knowledge graph, but the risk data corresponding to the risk information and the asset data corresponding to the asset information cannot be obtained.

[0045] For example, taking the OTA attack event of a vehicle as an example, through the initial knowledge graph, it can be obtained that the attacker attacks the vehicle with some attack means, but the identity of the attacker, the type and identification of the attacked vehicle, the specific attack means, etc. cannot be known.

[0046] In some embodiments, risk information may include multiple risk keywords, and asset information may include multiple sub-asset information; associating risk information and asset information may include: based on multiple sub-asset information, obtaining attribute information that matches the multiple sub-asset information respectively from the asset information library; extracting from the attribute information that matches the multiple sub-asset information respectively: target attribute information associated with a target risk keyword among the multiple risk keywords; and associating the target risk keyword with the target attribute information.

[0047] Exemplarily, when the asset information includes information 1, information 2, and information 3, the multiple sub-asset information may be information 1, information 2, and information 3. For example, taking the OTA attack event of a vehicle as an example, the asset information may include the attacked vehicle, OTA system, and attacked software, and the multiple sub-asset information may be: the attacked vehicle, OTA system, and attacked software.

[0048] Exemplarily, the risk keywords may be extracted from the risk information. For example, taking the target network security event as an OTA attack event of a vehicle as an example, the risk information may include the relationship between the attackers, and the attackers' attack on the vehicle by a certain attack method. Then, the multiple risk keywords may include the attackers, the attackers' relationship, and the attack methods.

[0049] It should be noted that the asset information database is used to centrally manage asset information, facilitating unified query and analysis of asset information.

[0050] It should also be noted that the attribute information matched by the sub-asset information may include the identifier of the sub-asset information, the type of the sub-asset information, the version of the sub-asset information, etc., which is not limited in this embodiment of the present application.

[0051] It can be understood that for a sub-asset information, the attribute information of the sub-asset information may include multiple types. In this case, it is necessary to extract target attribute information associated with the target risk keyword from the multiple types of attribute information.

[0052] For example, taking the OTA attack event in which the target cybersecurity event is a vehicle as an example, the sub-asset information may be the attacked vehicle, the target risk keyword may include the attacker, and the attribute information of the attacked vehicle may include the type, logo, color, size, etc. of the vehicle, so that the logo of the vehicle associated with the attacker can be extracted as the target attribute information, and the attacker can be associated with the logo of the vehicle.

[0053] It can be understood that the target risk keyword may be all risk keywords among the multiple risk keywords, or may be some risk keywords among the multiple risk keywords, and the embodiments of the present application are not limited to this.

[0054] Through this method, the risk information and asset information of the target network security event can be associated, so that the association relationship can be used as an auxiliary tool to construct an initial knowledge graph to improve the operational efficiency of network security through the initial knowledge graph.

[0055] In some embodiments, extracting from the attribute information respectively matched by multiple sub-asset information: target attribute information associated with a target risk keyword among multiple risk keywords can include: establishing a mapping relationship between multiple preset risk keywords and the attribute information respectively matched by multiple sub-asset information, and based on the similarity between the target risk keyword and each of the multiple preset risk keywords, obtaining the target attribute information associated with the target risk keyword from the mapping relationship.

[0056] It should be noted that the preset risk keyword and the target risk keyword have the same semantics but different names, or the same semantics and names. In this case, the similarity between the preset risk keyword and the target risk keyword is relatively high. In the mapping relationship, the attribute information matched by the sub-asset information corresponding to the preset risk keyword is the target attribute information associated with the target risk keyword.

[0057] For example, taking the target network security event as an OTA attack event for a vehicle as an example, the mapping relationship includes a mapping relationship between the attacker and the identification of the vehicle associated with the attacker. The target risk keyword may be an attacker, and the attacker and the attacker have a high degree of similarity, so the identification of the vehicle associated with the attacker can be obtained from the mapping relationship.

[0058] Through this method, by establishing a mapping relationship between multiple preset risk keywords and attribute information that matches multiple sub-asset information respectively, the target attribute information associated with the target risk keyword can be obtained more quickly, thereby improving the efficiency of subsequent construction of the initial knowledge graph.

[0059] Figure 2 Schematic diagram of constructing an initial knowledge graph provided in an embodiment of the present application. Figure 2 As shown, taking the OTA attack event of the vehicle as an example of the target network security event, the vulnerability information may include the update management vulnerability and software management vulnerability of the OTA system, the threat information may include the relationship between the attackers, the attacker's attack on the vehicle with a certain attack method, the hardware information may include the attacked vehicle, and the software information may include the OTA system and the attacked software. Based on this, the target risk keywords may include attackers, attacker relationships, attack methods, software management vulnerabilities, and update management vulnerabilities of the OTA system. The target attribute information associated with the target risk keywords may include: the identification of the attacked vehicle, the identification of the attacked software, and the version of the OTA system. Based on the association between the target risk keywords and the target attribute information, a Figure 2 The initial knowledge graph shown.

[0060] S130: Acquire network security data of multiple network security events, and extract risk data corresponding to the risk information and asset data corresponding to the asset information from the network security data.

[0061] It should be noted that, in actual applications, network security data of different network security events are usually integrated together, and the network security data may include risk data, asset data, etc., which is not limited in the embodiments of the present application.

[0062] It should also be noted that obtaining network security data of multiple network security events may include: obtaining network security data from at least one of the following data sources: vehicle network, driving data recording system, cloud data processing platform, user equipment, network security log, network security database.

[0063] Through this method, since network security data is obtained from at least one data source, cross-domain data fusion can be achieved, and network security data from different data sources can be presented in the same target knowledge graph, thereby providing support for subsequent network security operations through the target knowledge graph.

[0064] S140. Fill in the initial knowledge graph based on the risk data and the asset data to obtain a target knowledge graph of the target network security event.

[0065] It should be noted that after filling the initial knowledge graph with risk data and asset data, the relationship between risk data and asset data can be visualized from the obtained target knowledge graph, which facilitates tracking and tracing in network security operations.

[0066] For example, Figure 3 Schematic diagram of constructing a target knowledge graph provided by an embodiment of the present application. Figure 3 As shown, Figure 2 Taking the initial knowledge graph of the OTA attack event of the constructed vehicle as an example, the risk data corresponding to the risk information may include: the attackers are external personnel x1 and employee y1, external personnel x1 and employee y1 share Internet Protocol (IP) address 1, external personnel x1 and employee y1 both use version downgrade attack, the software has a vulnerability in which the upgrade package is tampered with, and the OTA system has a vulnerability in which there is a lack of monitoring records. The asset data corresponding to the asset information may include: external personnel x1 attacked zombie car 1 and official car 1, employee y1 attacked official car 1 and official car 2, the software attacked by external personnel x1 includes software with version 1 and OTA system with version 1, and the software attacked by employee y1 includes software with version 1, OTA system with version 1, software with version 2, and OTA system with version 2. By filling the initial knowledge graph with the above risk data and asset data, we can get Figure 3 The target knowledge graph shown in the figure. Through the target knowledge graph, it can be obtained that the OTA attack event of the vehicle has a downgrade attack link threat, and it is suspected that there is a certain relationship between employee y1 and external person x1. Therefore, based on the target knowledge graph, it can be known that certain security vulnerability repair measures need to be taken for software version 1, OTA system version 1, software version 2, and OTA system version 2, and employee y1 can be warned, fired, and compensated for losses, and external person x1 can be warned and compensated for losses.

[0067] It should be noted that after obtaining the target knowledge graph, the target knowledge graph can be updated and the network security of the electronic device can be guaranteed based on the updated target knowledge graph.

[0068] Furthermore, updated network security data of multiple network security events can be obtained; updated risk data corresponding to the risk information and updated asset data corresponding to the asset information are extracted from the updated network security data, and the initial knowledge graph is filled based on the updated risk data and the updated asset data to obtain an updated target knowledge graph of the target network security event.

[0069] Exemplarily, the network security data may be updated at intervals of a preset duration, wherein the preset duration may be set based on empirical rules, may be set manually, or may be set in other ways, and the present application embodiment does not limit this.

[0070] Through this method, the target knowledge graph can be updated with updated risk data and updated asset data, so as to track and trace the source based on the updated target knowledge graph and improve the timeliness of network security operations.

[0071] Through the technical solution provided in the embodiment of the present application, the network security data of multiple network security events can be obtained; as well as the risk information and asset information of the target network security event in the multiple network security events; the risk information and the asset information are associated, and based on the association relationship between the risk information and the asset information, the initial knowledge graph of the target network security event is constructed; the risk data corresponding to the risk information and the asset data corresponding to the asset information are extracted from the network security data, and the initial knowledge graph is filled based on the risk data and the asset data to obtain the target knowledge graph of the target network security event. In this way, different from the chain data structure of the traditional database, the target knowledge graph constructed based on the risk data and the asset data can visualize the association relationship between the risk data and the asset data, which is convenient for tracking and tracing in network security operations, thereby significantly improving the operational efficiency of network security and ensuring the network security of electronic equipment.

[0072] The preferred embodiments of the present application are described in detail above in conjunction with the accompanying drawings. However, the present application is not limited to the specific details in the above embodiments. Within the technical concept of the present application, the technical solution of the present application can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the present application. For example, the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present application will not further explain various possible combinations. For another example, the various different embodiments of the present application can also be arbitrarily combined, as long as they do not violate the idea of ​​the present application, they should also be regarded as the contents disclosed in the present application. For another example, under the premise of no conflict, the various embodiments and / or the technical features in the various embodiments described in the present application can be arbitrarily combined with the prior art, and the technical solution obtained after the combination should also fall within the protection scope of the present application.

[0073] It should also be understood that in the various method embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0074] Based on the same inventive concept as the above embodiments, Figure 4 : is a schematic diagram of the composition structure of a knowledge graph construction device for network security events provided in an embodiment of the present application, such as Figure 4 As shown, the knowledge graph construction device 400 for network security events may include an acquisition module 410, an association module 420, a construction module 430, an extraction module 440, and a filling module 450, wherein:

[0075] Acquisition module 410, used to acquire network security data of multiple network security events; and risk information and asset information of a target network security event among the multiple network security events; wherein the risk information includes vulnerability information and / or threat information of the target network security event, and the asset information includes hardware information and / or software information of the target network security event;

[0076] An association module 420, for associating risk information with asset information;

[0077] A construction module 430 is used to construct an initial knowledge graph of a target network security event based on the association relationship between risk information and asset information;

[0078] An extraction module 440 is used to extract risk data corresponding to the risk information and asset data corresponding to the asset information from the network security data;

[0079] The filling module 450 is used to fill the initial knowledge graph based on the risk data and the asset data to obtain a target knowledge graph of the target network security event.

[0080] In some embodiments, the risk information includes multiple risk keywords, and the asset information includes multiple sub-asset information; the acquisition module 410 is also used to obtain attribute information that matches the multiple sub-asset information from the asset information library based on the multiple sub-asset information; the extraction module 440 is also used to extract: target attribute information associated with the target risk keyword among the multiple risk keywords from the attribute information that matches the multiple sub-asset information; the association module 420 is also used to associate the target risk keyword with the target attribute information.

[0081] In some embodiments, the construction module 430 is further used to establish a mapping relationship between multiple preset risk keywords and attribute information that respectively matches multiple sub-asset information; the association module 420 is further used to obtain target attribute information associated with the target risk keyword from the mapping relationship based on the similarity between the target risk keyword and each of the multiple preset risk keywords.

[0082] In some embodiments, Figure 4 As shown, the knowledge graph construction device 400 for network security events may further include a processing module 460, wherein:

[0083] The acquisition module 410 is further used to acquire candidate risk information and candidate asset information of the target network security event from the network security information library or preset rules;

[0084] The processing module 460 is used to fuse and disambiguate the candidate risk information and the candidate asset information to obtain risk information and asset information.

[0085] In some embodiments, the acquisition module 410 is further used to obtain network security data from at least one of the following data sources: an in-vehicle network, a driving data recording system, a cloud data processing platform, a user device, a network security log, and a network security database.

[0086] In some embodiments, the acquisition module 410 is also used to obtain updated network security data of multiple network security events; the extraction module 440 is also used to extract updated risk data corresponding to the risk information and updated asset data corresponding to the asset information from the updated network security data; the filling module 450 is also used to fill the initial knowledge graph based on the updated risk data and the updated asset data to obtain an updated target knowledge graph of the target network security event.

[0087] In the scheme of the embodiment of the present application, different from the chain data structure of the traditional database, the target knowledge graph constructed based on risk data and asset data can visualize the correlation between risk data and asset data, which is convenient for tracking and tracing in network security operations, thereby significantly improving the operational efficiency of network security and ensuring the network security of electronic equipment.

[0088] Those skilled in the art should understand that the relevant description of the knowledge graph construction device for the above-mentioned network security events in the embodiment of the present application can be understood by referring to the relevant description of the knowledge graph construction method for network security events in the embodiment of the present application.

[0089] Figure 5 It is a structural diagram of an electronic device provided in an embodiment of the present application. The electronic device 500 may include: a processor (Processor) 510, a communication interface (Communications Interface) 520, a memory (Memory) 530 storing a program 550, and a communication bus 540.

[0090] The processor 510 , the communication interface 520 , and the memory 530 communicate with each other via the communication bus 540 .

[0091] The communication interface 520 is used to communicate with other electronic devices or servers.

[0092] The processor 510 is used to execute the program 550, and specifically can execute the relevant steps in the above method embodiment.

[0093] Specifically, the program 550 may include a program 550 code, which includes one or more executable computer operation instructions.

[0094] The processor 510 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0095] The memory 530 is used to store one or more executable instructions. The memory 530 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (Non-Volatile Memory), such as one or more disk memories.

[0096] One or more executable instructions may be specifically used to enable the processor 510 to execute the method provided in the embodiment of the present application.

[0097] In addition, the specific implementation of each step in one or more executable instructions can refer to the corresponding description of the corresponding steps and units in the above method embodiments, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the above method embodiments, which will not be repeated here.

[0098] An embodiment of the present application also provides a computer-readable storage medium for storing a computer program.

[0099] In some embodiments, the computer-readable storage medium can be applied to the electronic device in the embodiments of the present application, and when the computer program is executed by one or more processors, it implements the corresponding processes implemented by the electronic device in the various methods of the embodiments of the present application. For the sake of brevity, they are not repeated here.

[0100] An embodiment of the present application also provides a computer program product, including computer program instructions.

[0101] In some embodiments, the computer program product can be applied to the electronic device in the embodiments of the present application, and the computer program instructions enable the computer to execute the corresponding processes implemented by the electronic device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0102] The embodiment of the present application also provides a computer program.

[0103] In some embodiments, the computer program can be applied to the electronic devices in the embodiments of the present application. When the computer program runs on a computer, the computer executes the corresponding processes implemented by the electronic devices in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0104] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of this application.

[0105] It should be noted that, in this application, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0106] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0107] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0108] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0109] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0110] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.

Claims

1. A method for constructing a knowledge graph of network security events, characterized in that: include: Obtain cybersecurity data for multiple cybersecurity events; and, risk information and asset information of a target network security event among the plurality of network security events; wherein the risk information includes vulnerability information and / or threat information, and the asset information includes hardware information and / or software information; Associating the risk information with the asset information, and constructing an initial knowledge graph of the target network security event based on the association relationship between the risk information and the asset information; The risk data corresponding to the risk information and the asset data corresponding to the asset information are extracted from the network security data, and the initial knowledge graph is filled based on the risk data and the asset data to obtain a target knowledge graph of the target network security event.

2. The method according to claim 1, characterized in that The risk information includes a plurality of risk keywords, and the asset information includes a plurality of sub-asset information; The associating the risk information with the asset information includes: Based on the plurality of sub-asset information, acquiring attribute information respectively matching the plurality of sub-asset information from an asset information library; Extracting, from the attribute information respectively matched by the plurality of sub-asset information: target attribute information associated with a target risk keyword among the plurality of risk keywords; The target risk keyword is associated with the target attribute information.

3. The method according to claim 2, characterized in that The extracting, from the attribute information respectively matched by the plurality of sub-asset information, target attribute information associated with the target risk keyword among the plurality of risk keywords includes: A mapping relationship between multiple preset risk keywords and attribute information respectively matching multiple sub-asset information is established, and based on the similarity between the target risk keyword and each of the multiple preset risk keywords, target attribute information associated with the target risk keyword is obtained from the mapping relationship.

4. The method according to any one of claims 1 to 3, characterized in that The obtaining of risk information and asset information of a target network security event among the plurality of network security events includes: Obtaining candidate risk information and candidate asset information of the target network security event from a network security information database or preset rules; The candidate risk information and the candidate asset information are respectively fused and disambiguated to obtain the risk information and the asset information.

5. The method according to any one of claims 1 to 3, characterized in that The obtaining of network security data of multiple network security events includes: The network security data is obtained from at least one of the following data sources: In-vehicle network, driving data recording system, cloud data processing platform, user equipment, network security log, network security database.

6. The method according to any one of claims 1 to 3, characterized in that Also includes: Acquire the updated network security data of the multiple network security events; The updated risk data corresponding to the risk information and the updated asset data corresponding to the asset information are extracted from the updated network security data, and the initial knowledge graph is filled based on the updated risk data and the updated asset data to obtain an updated target knowledge graph for the target network security event.

7. A knowledge graph construction device for network security events, characterized in that: include: An acquisition module, used to acquire network security data of multiple network security events; and, risk information and asset information of a target network security event among the plurality of network security events; wherein the risk information includes vulnerability information and / or threat information of the target network security event, and the asset information includes hardware information and / or software information of the target network security event; An association module, used to associate the risk information with the asset information; A construction module, used to construct an initial knowledge graph of the target network security event based on the association relationship between the risk information and the asset information; An extraction module, used to extract risk data corresponding to the risk information and asset data corresponding to the asset information from the network security data; A filling module is used to fill the initial knowledge graph based on the risk data and the asset data to obtain a target knowledge graph of the target network security event.

8. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store one or more executable instructions, and the executable instructions enable the processor to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer storage medium stores a computer program, and when the computer program is executed by one or more processors, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The method comprises computer program instructions which cause a computer to execute the method according to any one of claims 1 to 6.

Images