Network security dynamic early warning method and system based on knowledge graph
Through the dynamic early warning method of network security based on knowledge graphs, traditional network security protection is solved, and multi-dimensional knowledge integration and efficient graph database construction is realized, intelligent early warning and accurate query functions are provided, the applicability and user experience of the system are improved, and the timeliness and accuracy of the system is ensured through continuous optimization and update.
Patent Information
- Application Number
- CN202411921935.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-03-18
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Traditional network security protection methods are difficult to deal with complex and hidden cyber attacks. During the construction of knowledge graphs, they face problems such as data quality, integrity and update frequency, resulting in limited accuracy and timeliness.
The dynamic early warning method of network security based on knowledge graph is adopted, and knowledge graph is built through multi-dimensional network security knowledge acquisition and integration, so as to realize dynamic early warning and query of network security, and ensure timeliness through system optimization and update.
It realizes the integration of multi-dimensional knowledge and efficient graph database construction, provides intelligent early warning and accurate query functions, improves the applicability and user experience of the system, and ensures the timeliness and accuracy of the system through continuous optimization and update.
Smart Images
Figure CN119652645A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and specifically to a knowledge graph-based network security dynamic early warning method and system. Background Art
[0002] With the rapid development and popularization of network technology, network attack methods are becoming more complex and hidden. Traditional network security protection methods are often difficult to deal with these advanced attack methods. Therefore, more intelligent and dynamic protection strategies are needed. As an emerging information representation and processing technology, knowledge graph technology provides new ideas and methods for network security protection.
[0003] This method relies on data in relational databases, such as network security attack data information databases, location information data databases corresponding to attack source IP addresses, etc. However, these data may be limited by data quality, data integrity, and data update frequency, thus affecting the accuracy and timeliness of the knowledge graph. During data processing, when converting relational databases into triples, there may be the complexity of data conversion and the risk of data loss. In addition, the processing of nested structures may also increase the difficulty and computational cost of data processing. Constructing a knowledge graph requires extracting entity names and relationship names and converting them into a structured knowledge framework in the form of triples. This process may involve a lot of data cleaning, data integration, and data conversion work, which increases the complexity and workload of knowledge graph construction. When constructing a graph database, it is necessary to index the stored data tables and create edge relationships. These operations may also face technical challenges and performance bottlenecks. Although this method provides query and information acquisition functions based on knowledge graphs, the accuracy and integrity of the query results may be affected by the quality of knowledge graph construction, query algorithms, and query conditions. For complex query requirements, more complex query algorithms and query strategies may need to be designed to improve query accuracy and efficiency. Summary of the invention
[0004] The purpose of the invention provided by the present invention is to provide a network security dynamic early warning method and system based on knowledge graph to solve the problems in the above-mentioned background technology.
[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network security dynamic early warning method based on knowledge graph, comprising the following steps:
[0006] S1. Acquisition and integration of multi-dimensional network security knowledge.
[0007] S2. Knowledge graph construction.
[0008] S3. Dynamic network security warning and query.
[0009] S4. System optimization and update.
[0010] Further, according to the operation steps in S1,
[0011] S101. Network security attack data collection.
[0012] S102. Construction of domain knowledge base.
[0013] Further, according to the operation steps in S2,
[0014] S201, conversion from relational database to triples.
[0015] S202: Build graph database.
[0016] S203. Index and relationship optimization.
[0017] Further, according to the operation steps in S3,
[0018] S301. Dynamic early warning mechanism.
[0019] S302. Accurate query and intelligent analysis.
[0020] Further, according to the operation steps in S4,
[0021] S401. Data update and maintenance.
[0022] S402. User feedback and iteration.
[0023] Further, according to the operation steps in S101-S102, the network security attack data collection utilizes advanced intrusion detection systems and network log analysis tools to capture and analyze network security attack events in real time, including attack types, attack source IPs, and attack target IPs.
[0024] The domain knowledge base construction includes an attack source IP location information base, an attack target IP enterprise industry information base and an attack type information base.
[0025] Further, according to the operation steps in S201-S203, the conversion of triples recursively processes the nested data structure to ensure that all information can be accurately converted into triples.
[0026] The graph database selects the efficient graph database Neo4j as the storage platform, imports the converted triple data into the graph database, and constructs the association network between entities and relationships.
[0027] A network security dynamic early warning system based on knowledge graph, applied to any one of the network security dynamic early warning methods based on knowledge graph described above, comprising:
[0028] Application module, used for data processing and application program running.
[0029] Data source module, obtains data.
[0030] Data processing module, data processing.
[0031] Knowledge graph module, establishment of knowledge graph.
[0032] System optimization and update module, used for monitoring data flow and system optimization and update.
[0033] There is a signal connection between the data source module and the data processing module, a signal connection between the data processing module and the knowledge graph module, a signal connection between the knowledge graph module and the application module, a signal connection between the application module and the system optimization and update module, and the data source module, the data processing module, and the knowledge graph module are all signal connected to the system optimization and update module.
[0034] Furthermore, the application module includes a dynamic warning module and a precise query and intelligent analysis module, and the data source module includes an intrusion monitoring module, a network log analysis module and a third-party data module.
[0035] Furthermore, the data processing module includes a data integration module, a relational database to triple conversion tool and a third-party data module, the knowledge graph module includes a graph database and index and relationship optimization module, and the system optimization and update module includes a data update and maintenance module, a performance optimization module, a one-way monitoring module and a user feedback and iteration module.
[0036] The present invention provides a network security dynamic early warning method and system based on knowledge graph, which has the following beneficial effects:
[0037] (1) Multi-dimensional knowledge integration: By integrating multi-dimensional knowledge in the field of network security, a comprehensive and accurate knowledge graph is constructed to provide a solid foundation for early warning and query.
[0038] (2) Efficient graph database construction: Use advanced graph database technology and index optimization strategies to improve the construction efficiency and query performance of the knowledge graph.
[0039] (3) Intelligent warning and query: Combining real-time monitoring and intelligent analysis technology to achieve dynamic network security warning and accurate query functions, improving the system's applicability and user experience.
[0040] (4) Continuous optimization and iteration: Based on user feedback and developments and changes in the field of network security, the system is continuously optimized and updated to ensure its timeliness and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 This is a general system diagram of a network security dynamic early warning method and system based on a knowledge graph of the present invention;
[0042] Figure 2 A schematic diagram of a knowledge graph-based network security dynamic early warning method and system application module of the present invention;
[0043] Figure 3 A schematic diagram of a knowledge graph-based network security dynamic early warning method and a system data source module of the present invention;
[0044] Figure 4 A schematic diagram of a network security dynamic early warning method based on a knowledge graph and a system data processing module of the present invention;
[0045] Figure 5 A schematic diagram of a knowledge graph-based network security dynamic early warning method and a system knowledge graph module of the present invention;
[0046] Figure 6 This is a schematic diagram of the system optimization and update module of a knowledge graph-based network security dynamic early warning method and system of the present invention.
[0047] In the figure: 1. Application module; 2. Data source module; 3. Data processing module; 4. Knowledge graph module; 5. System optimization and update module. DETAILED DESCRIPTION
[0048] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.
[0049] Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.
[0050] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:
[0051] See also Figure 1-6 The present invention provides a technical solution: a network security dynamic early warning method based on knowledge graph, comprising the following steps:
[0052] Step 1: Multi-dimensional network security knowledge acquisition and integration, network security attack data collection: using advanced intrusion detection system ID and network log analysis tools, real-time capture and analysis of network security attack events, including attack type, attack source IP, attack target IP key information, domain knowledge base construction: attack source IP location information database: based on the attack source IP address, combined with the geographic information system GI and third-party data sources, build a detailed attack source location information database, including cities, regions and countries, attack target IP enterprise industry information database: through IP address reverse resolution and enterprise registration information, establish the association between the attack target IP and the enterprise name and industry type information, attack Type information library: According to the attack methods and characteristics, common network security attack types are classified and sorted, including DDoS attacks, QL injection, and malware propagation. Step 2: Knowledge graph construction. Conversion from relational database to triples: Use custom conversion tools to convert data in relational databases into triples, i.e. {entity 1, relationship, entity 2}. Recursively process nested data structures to ensure that all information can be accurately converted into triples. Graph database construction: Select an efficient graph database such as Neo4j as a storage platform, import the converted triple data into the graph database, and build an association network between entities and relationships. Index and relationship optimization: Establish indexes for entities and relationships in the graph database to improve query efficiency. According to the characteristics of the network security field, optimize the connection between entities and relationships to ensure the accuracy and completeness of the graph database. Step 3: Dynamic network security warning and query. Dynamic warning mechanism: Real-time monitoring of network attack events, combined with historical data and domain knowledge in the knowledge graph, attack pattern recognition and trend prediction. According to the warning rules, real-time warnings are issued for potential security threats, including attack type, attack source location, and key information of the target industry. Accurate query and intelligent analysis: Provide query functions based on keywords, relationships, and question words, support user-defined query conditions, and use graph databases. The connected subgraph matching algorithm in the system can quickly locate and extract the information required by users. Combined with natural language processing (NLP) technology, the query results can be intelligently analyzed and interpreted to improve the accuracy and readability of the query results. Step 4: System optimization and update, data update and maintenance: Regularly update network security attack data and domain knowledge base to ensure the timeliness and accuracy of the knowledge graph, optimize the performance of the graph database, and improve the operating efficiency and stability of the system. User feedback and iteration: Collect user feedback, continuously improve and optimize the system, and continuously update warning rules and query algorithms according to the development and changes in the field of network security to improve the practicality and adaptability of the system.
[0053] A network security dynamic early warning system based on knowledge graph, a network security dynamic early warning method based on knowledge graph applied to any of the above, comprising: an application module 1, used for data processing and application program operation, a data source module 2, for acquiring data, a data processing module 3, for data processing, a knowledge graph module 4, for establishing a knowledge graph, a system optimization and update module 5, for monitoring data flow and system optimization and update, a signal connection between the data source module 2 and the data processing module 3, a signal connection between the data processing module 3 and the knowledge graph module 4, a signal connection between the knowledge graph module 4 and the application module 1, a signal connection between the application module 1 and the system optimization and update module 5, a data source module 2, a data processing module 3, a knowledge graph module 4, a signal connection between the knowledge graph module 4 and the application module 1, a signal connection between the application module 1 and the system optimization and update module 5, a data source module 2, a data processing module 3, a knowledge graph module 4, a signal connection between the knowledge graph module 4 and the application module 1, a signal connection between the application module 1 and the system optimization and update module 5, The spectrum module 4 is connected to the system optimization and update module 5 by signals. The application module 1 includes a dynamic warning module and a precise query and intelligent analysis module. The data source module 2 includes an intrusion detection module, a network log analysis module and a third-party data module. The data processing module 3 includes a data integration module, a relational database to triple conversion tool and a third-party data module. The knowledge graph module 4 includes a graph database and an index and relationship optimization module. The system optimization and update module 5 includes a data update and maintenance module, a performance optimization module, a one-way monitoring module and a user feedback and iteration module. Application module 1, dynamic warning module: based on the abnormal patterns and behaviors in the knowledge graph, generates and issues network security warnings. Precise query and intelligent analysis module: provides feedback on knowledge The ability to accurately query and intelligently analyze data in the knowledge graph supports users to conduct in-depth mining and analysis based on their needs. Data source module 2: Intrusion detection module: Real-time monitoring of network traffic and events, detection of potential intrusion behaviors. Network log analysis module: Collect and analyze log files of network devices, extract key information and abnormal behaviors. Third-party data module: Integrate data from other security systems or databases, enrich data sources and improve warning accuracy. Data processing module 3: Data integration module: Integrate and clean data from different data sources, remove redundant and erroneous data. Relational database to triple conversion tool: Convert the integrated data into the triple form required by the knowledge graph. Third-party data processing module: Process third-party data. Perform specific processing and analysis to meet the needs of knowledge graph construction, Knowledge Graph Module 4, Graph Database: Store and manage entities, relationships and attribute information in the knowledge graph, Index and Relationship Optimization Module: Index and optimize relationships in the knowledge graph to improve query and analysis efficiency, System Optimization and Update Module 5, Data Update and Maintenance Module: Regularly update data in the knowledge graph to ensure the timeliness and accuracy of the data, Performance Optimization Module: Monitor system performance, optimize resource allocation and algorithm efficiency, and improve system response speed and processing capabilities, One-way Monitoring Module: Monitor data flow and system status to ensure data integrity and system stability, User Feedback and Iteration Module: Collect user feedback and suggestions, and iteratively optimize and improve the system,The data source module 2 obtains data from the network environment, including intrusion monitoring data, network logs and third-party data. The data processing module 3 integrates, cleans and converts the acquired data to generate the triple data required for the knowledge graph. The knowledge graph module 4 builds the knowledge graph based on the processed data and performs indexing and relationship optimization. The application module 1 uses the knowledge graph for dynamic early warning, precise query and intelligent analysis, and provides users with early warning information and data analysis results. The system optimization and update module 5 monitors data flow and system performance, regularly updates data and maintains the system to ensure the stability and accuracy of the system.
[0054] In a relational database, data is usually stored in the form of tables. Each table consists of rows and columns, where each row represents a record and each column represents a field. In order to convert data in a relational database into triples, we need to understand the entities, attributes, and relationships in the table.
[0055] Suppose we have a simple relational database table with the following structure:
[0056] Entity1_ID Entity1_Name relation Entity2_ID Entity2_Name 1 Alice knows 2 Bob 2 Bob works 3 CompanyA 3 CompanyA located 4 CityX
[0057] In this table, we can convert each row of data into a triple in the form of {entity 1, relation, entity 2}. The converted triple is as follows:
[0058] {Alice,knows,Bob}
[0059] {Bob,works,CompanyA}
[0060] {CompanyA,located,CityX}
[0061] To more generally represent the conversion of a relational database to triples, we can use the following formula or steps:
[0062] Select table: Determine the relational database table to be converted.
[0063] Identify entity and relationship columns:
[0064] Entity 1 column: Usually the primary key or a unique column in the table, used to identify the first entity.
[0065] Relationship columns: Columns that represent a connection or relationship between two entities.
[0066] Entity 2 column: corresponds to the entity 1 column and is used to identify the second entity.
[0067] Convert triples:
[0068] For each row in the table, create a triple {entity1, relation, entity2}.
[0069] The value of entity 1 comes from the entity 1 column, the value of the relationship comes from the relationship column, and the value of entity 2 comes from the entity 2 column.
[0070] Handling nested data structures (if applicable):
[0071] If the table contains nested data structures (such as JSON fields), these structures need to be processed recursively to extract all relevant information and convert them into triples.
[0072] Store triples: Store the transformed triples into the selected graph database.
[0073] The above are only preferred embodiments of the present invention. It should be pointed out that a person skilled in the art can make several modifications and improvements without departing from the inventive concept of the present invention, and these all fall within the protection scope of the present invention.
Claims
1. A network security dynamic early warning method based on knowledge graph, characterized in that: The following steps are involved: S1. Multi-dimensional network security knowledge acquisition and integration; S2, knowledge graph construction; S3. Network security dynamic warning and query; S4. System optimization and update.
2. According to claim 1, a knowledge graph-based network security dynamic early warning method is characterized in that: The following steps are involved: According to the operation steps in S1, S101, network security attack data collection; S102. Construction of domain knowledge base.
3. According to claim 1, a network security dynamic early warning method based on knowledge graph is characterized in that: The method comprises the following steps: according to the operation steps in S2, S201, conversion from relational database to triples; S202, graph database construction; S203. Index and relationship optimization.
4. According to claim 1, a knowledge graph-based network security dynamic early warning method is characterized in that: The following steps are involved: According to the operation steps in S3, S301, dynamic early warning mechanism; S302. Accurate query and intelligent analysis.
5. According to claim 1, a knowledge graph-based network security dynamic early warning method is characterized in that: The following steps are involved: According to the operation steps in S4, S401, data update and maintenance; S402. User feedback and iteration.
6. According to claim 2, a knowledge graph-based network security dynamic early warning method is characterized in that: The following steps are involved: According to the operation steps in S101-S102, the network security attack data collection utilizes advanced intrusion detection systems and network log analysis tools to capture and analyze network security attack events in real time, including attack types, attack source IPs, and attack target IPs; The domain knowledge base construction includes an attack source IP location information base, an attack target IP enterprise industry information base and an attack type information base.
7. According to claim 3, a knowledge graph-based network security dynamic early warning method is characterized in that: The following steps are involved: According to the operation steps in S201-S203, the conversion of the triples recursively processes the nested data structure to ensure that all information can be accurately converted into triples; The graph database selects the efficient graph database Neo4j as the storage platform, imports the converted triple data into the graph database, and constructs the association network between entities and relationships.
8. A network security dynamic early warning system based on knowledge graph, characterized in that: A knowledge graph-based network security dynamic early warning method applied to any one of claims 1 to 7, comprising: Application module (1), used for data processing and running application programs; Data source module (2), obtaining data; Data processing module (3), data processing; Knowledge graph module (4), establishment of knowledge graph; A system optimization and update module (5), used for monitoring data flow and system optimization and update; There is a signal connection between the data source module (2) and the data processing module (3), there is a signal connection between the data processing module (3) and the knowledge graph module (4), there is a signal connection between the knowledge graph module (4) and the application module (1), there is a signal connection between the application module (1) and the system optimization and update module (5), and there is a signal connection between the data source module (2), the data processing module (3), and the knowledge graph module (4) and the system optimization and update module (5).
9. A knowledge graph-based network security dynamic early warning system according to claim 8, characterized in that: The application module (1) comprises a dynamic warning module and a precise query and intelligent analysis module, and the data source module (2) comprises an intrusion detection module, a network log analysis module and a third-party data module.
10. A network security dynamic early warning system based on knowledge graph according to claim 8, characterized in that: The data processing module (3) includes a data integration module, a relational database to triple conversion tool and a third-party data module; the knowledge graph module (4) includes a graph database and an index and relationship optimization module; the system optimization and update module (5) includes a data update and maintenance module, a performance optimization module, a one-way monitoring module and a user feedback and iteration module.