Visual enhancement method and system for network threat intelligence knowledge graph

Abstract

The invention belongs to the technical field of network security, and discloses a visual enhancement method and system for a network threat intelligence knowledge graph, and the method comprises the steps: determining the professional field and range of the construction of a network threat intelligence ontology; constructing a seven-step method ontology based on a feedback mechanism according to the professional field and range constructed by the network threat intelligence ontology; according to a seven-step method ontology based on a feedback mechanism, main terms in the field of network threat intelligence are concluded; according to the summarized main terms of the network threat intelligence field, main classes and corresponding relations of the network threat intelligence field are expanded; according to the expanded network threat intelligence domain main class and the corresponding relation, defining attributes of the network threat intelligence domain main class; constructing and correcting a network threat intelligence ontology according to the defined attributes of the main classes in the network threat intelligence field; and according to the constructed network threat intelligence ontology, constructing a Neo4j-based network threat intelligence knowledge graph and carrying out application analysis.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for enhancing the visualization of a network threat intelligence knowledge graph. Background Art

[0002] With the rapid development of information technology and the widespread popularity of the Internet, network security threats are becoming increasingly complex and diverse. Various means of network attacks emerge in an endless stream, and threats such as hacker organizations, malware, and vulnerability exploits have brought huge challenges to the security, integrity, and availability of information systems. Cyber ​​Threat Intelligence (CTI), as an important security information resource, helps network security experts identify, detect, and respond to potential security threats by collecting, analyzing, and sharing network threat data. However, network threat intelligence data comes from a wide range of sources, has diverse formats, and has redundant information. How to efficiently store, manage, and utilize this data has become an urgent problem to be solved. Traditional network threat intelligence analysis methods mainly rely on manual processing and simple data retrieval, which is difficult to cope with the rapid growth and complex associations of massive data, and lacks effective visualization methods, resulting in low analysis efficiency and insufficient accuracy. Knowledge Graph, as an emerging artificial intelligence technology, can effectively organize and manage complex network threat intelligence data through structured representation of entities and their relationships. Using graph database technology, multi-source heterogeneous threat intelligence data can be uniformly stored and quickly retrieved, and the data can be deeply analyzed through graph algorithms to reveal the potential relationships and laws. In addition, through the visual display of the knowledge graph, the multi-dimensional information of network threat intelligence can be presented intuitively, helping security experts better understand and analyze network threats. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a visualization enhancement method and system for a network threat intelligence knowledge graph. The method uses the graph database Neo4j to construct a network threat intelligence knowledge graph, and realizes the structured representation and association analysis of network threat intelligence by processing and integrating network threat intelligence data sets. The multidimensional relationship of threat intelligence data is displayed through visualization technology, and in-depth analysis is performed using graph algorithms to provide efficient threat detection and protection strategies. The method aims to improve the efficiency and accuracy of network threat intelligence analysis and provide strong technical support and decision-making basis for the field of network security.

[0004] The present invention provides a visualization enhancement method for a network threat intelligence knowledge graph, the method comprising:

[0005] S1: Determine the professional field and scope of cyber threat intelligence ontology construction;

[0006] S2: According to the professional fields and scope of the cyber threat intelligence ontology, a seven-step ontology based on the feedback mechanism is constructed;

[0007] S3: According to the seven-step ontology based on the feedback mechanism, the main terms in the field of cyber threat intelligence are summarized;

[0008] S4: Based on the summarized main terms in the field of cyber threat intelligence, expand the main categories and corresponding relationships in the field of cyber threat intelligence;

[0009] S5: Based on the main categories and corresponding relationships in the expanded network threat intelligence field, define the attributes of the main categories in the network threat intelligence field;

[0010] S6: Based on the attributes of the main categories in the defined cyber threat intelligence field, the cyber threat intelligence ontology is constructed and revised;

[0011] S7: Based on the constructed network threat intelligence ontology, build a Neo4j-based network threat intelligence knowledge graph and conduct application analysis.

[0012] Preferably, the professional fields and scopes for constructing the cyber threat intelligence ontology include:

[0013] Conduct a systematic analysis of current cyber threat intelligence-related literature, technical reports, industry standards, and practices to obtain the core concepts, terms, and corresponding relationships in this field;

[0014] Through analysis with cybersecurity experts and practitioners, we further clarified the specific areas and scope that the ontology construction needs to cover, especially identifying the key requirements for the integration of multi-source heterogeneous cyber threat intelligence data;

[0015] Analyze the functional requirements of existing network security threat intelligence systems and determine the application scenarios that the ontology needs to support, where the application scenarios include: threat identification, situational awareness, and incident response.

[0016] Preferably, the method of constructing the seven-step method ontology based on the feedback mechanism includes:

[0017] Determine the professional fields and scope of the ontology;

[0018] Based on the professional field and scope of the ontology, the characteristics of the existing network threat intelligence data set are analyzed;

[0019] Based on the analysis of the characteristics of existing network threat intelligence data sets, the construction of a network threat intelligence ontology conceptual system, namely the construction of a seven-step ontology based on a feedback mechanism, is realized. The network threat intelligence ontology conceptual system includes the definition and hierarchical classification of network threat intelligence domain classes and the determination of class attribute sets.

[0020] Preferably, the main terms in the field of cyber threat intelligence include:

[0021] Threat types, attackers, attack modes, attack consequences, and protection countermeasures provide guidance for the construction of network threat intelligence ontology.

[0022] Preferably, the expansion of the main categories and corresponding relationships in the field of network threat intelligence includes:

[0023] Reuse the existing network security domain ontology, where the existing network security domain ontology includes: UCO, intrusion detection domain ontology, security event domain ontology, and malware domain ontology;

[0024] On the basis of the existing network security ontology, classes are divided and expanded in the field of network threat intelligence, especially on the UCO ontology. The expanded classes include Consequence, CourseOfAction, HackerGroup, Location, Malware, MalwareFamily, OperatingSystem, Organization, Software, ThreatActor, Tool, and Vulnerability, covering all aspects of threat types, attackers, attack modes, attack consequences, and protection countermeasures.

[0025] Preferably, the attributes of the main categories in the field of network threat intelligence are defined as follows:

[0026] Define the properties of each class; among them,

[0027] The attribute set of the vulnerability class in the ontology is defined as:

[0028]

[0029] Among them, vul name is the name of the vulnerability, vul id is the vulnerability number, vul alias Another name for vulnerability, vul type Is the type of vulnerability, vul affected_entity is the entity affected by the vulnerability, vul severity_level is the threat level of the vulnerability, vul publish_time is the release time of the vulnerability, vul update_time is the update time of the vulnerability, vul patch For the patch information of the vulnerability, vul solutions Response measures for vulnerabilities;

[0030] The attributes of the attack method class are defined as:

[0031]

[0032] Among them, mean name is the name of the attack method, mean id is the attack method number, mean desc is the attack method description, mean mitigation Mitigation measures for attack methods, mean weak is the vulnerability and weakness associated with the attack method, mean tactic is the tactical intention of the attack means, mean platform Application platform for attack means, mean com_target Common attack targets of attack methods, mean com_group is a common hacker organization corresponding to the attack method, mean com_tool Common tools used as attack methods, mean affected_service Information about servers affected by the attack;

[0033] Based on the attribute definition, a network threat intelligence ontology that meets the preset requirements is constructed.

[0034] Preferably, the construction and modification of the network threat intelligence ontology includes:

[0035] Define and classify the entities and concepts of cyber threat intelligence and establish semantic relationships; reason about cyber threat knowledge by using the cyber threat intelligence domain ontology as the knowledge graph;

[0036] In the process of building the cyber threat intelligence ontology, concepts, relationships and related attributes were defined, and a preliminary domain ontology of cyber threat intelligence ontology was created and iterated repeatedly;

[0037] Protege's built-in reasoner HermiT is used for reasoning verification to form a more complete and systematic network threat intelligence domain ontology.

[0038] Preferably, building a Neo4j-based network threat intelligence knowledge graph and performing application analysis includes:

[0039] The graph database Neo4j is used to store network threat intelligence knowledge data, and a knowledge graph is constructed for the network threat intelligence dataset CS13K. Specifically:

[0040] The knowledge graph is represented as:

[0041] KG=(E,R,T),

[0042] Among them, E, R, and T represent entity sets, relationship sets, and triple sets, respectively;

[0043] Represent an entity collection as:

[0044] E={e1,e2,…,e |E|},

[0045] Among them, e i Represents the i-th entity in the entity set;

[0046] The relationship in the knowledge graph is represented as:

[0047] R={r1,r2,…,r |R|},

[0048] Among them, r i represents the i-th relation in the relation set;

[0049] The set of triples is represented as:

[0050]

[0051] For network attacks, we use knowledge graphs to classify network attacks into multiple subcategories, link them to specific attack strategies, and associate network attacks with threatened systems, applications, and corresponding defense measures. We use Cypher statements to query the exploitation frequency of each vulnerability, obtain the vulnerabilities used by attackers, and visualize them, and identify potential threats and attacks.

[0052] Ranking vulnerabilities in the knowledge graph based on PageRank:

[0053]

[0054] Where PR(v) is the PR value of node v in the knowledge graph; d is the damping factor, which is 0.85 and is used to simulate the probability of random jumps; N is the total number of nodes in the knowledge graph; M(v) is the set of all nodes pointing to node v; L(u) is the out-degree of node u;

[0055] Initially, the PR values ​​of all nodes in the knowledge graph are equal, usually initialized to Through iterative operations until convergence, in each iteration, the PR values ​​of all nodes are updated according to the PR(v) formula, which is expanded as follows:

[0056]

[0057] Among them, u1, u2, ..., u m are all nodes pointing to node v;

[0058] Integrate vulnerabilities, attacks, and defense mechanisms into the knowledge graph. When facing an attack, associate intrusion alerts with attack paths, display attack methods, attack indicators, and attack results in the form of a graph, and propose the best mitigation measures.

[0059] The present invention also discloses a visualization enhancement system for a network threat intelligence knowledge graph, the system being used to implement any one of the methods described above, a professional field and scope determination module, a seven-step ontology construction module, a terminology induction module, an attribute extension module, an attribute definition module, an intelligence ontology construction module, and an intelligence knowledge graph construction module;

[0060] The professional field and scope determination module is used to determine the professional field and scope of the network threat intelligence ontology construction;

[0061] The seven-step ontology construction module is used to construct a seven-step ontology based on a feedback mechanism according to the professional field and scope of the network threat intelligence ontology construction;

[0062] The terminology summarization module is used to summarize the main terms in the field of network threat intelligence according to the seven-step ontology based on the feedback mechanism;

[0063] The attribute extension module is used to expand the main categories and corresponding relationships in the field of network threat intelligence based on the summarized main terms in the field of network threat intelligence;

[0064] The attribute definition module is used to define the attributes of the main categories in the network threat intelligence field according to the expanded main categories and corresponding relationships in the network threat intelligence field;

[0065] The intelligence ontology construction module is used to realize the construction and modification of the network threat intelligence ontology according to the attributes of the main categories in the defined network threat intelligence field;

[0066] The intelligence knowledge graph construction module is used to construct a Neo4j-based network threat intelligence knowledge graph and perform application analysis based on the constructed network threat intelligence ontology.

[0067] Compared with the prior art, the present invention has the following beneficial effects:

[0068] The present invention proposes a visualization enhancement method and system for a network threat intelligence knowledge graph, aiming to help network security professionals understand and respond to network threats more effectively. The method first expands the existing ontology model and constructs a domain ontology suitable for the field of network threat intelligence by deeply analyzing the characteristics of network threat intelligence data. Secondly, the network threat intelligence knowledge graph is constructed using the Neo4j graph database, and the visualization and analysis functions of the knowledge graph are realized. Finally, the application of the knowledge graph in network security threat identification and situational awareness is demonstrated through case analysis. The innovation of this method lies in the combination of ontology modeling and graph database technology to achieve comprehensive analysis and visualization of network threat intelligence. Through the present invention, network security professionals can identify potential threats more quickly and take corresponding measures in a timely manner, thereby improving the efficiency and accuracy of network security protection. This patent has a wide range of applications and can play an important role in enterprises, governments, military and other fields, with significant commercial value and social significance. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0070] Figure 1 A schematic diagram of a visualization enhancement method for a network threat intelligence knowledge graph according to an embodiment of the present invention;

[0071] Figure 2 A schematic diagram of a seven-step ontology construction process based on a feedback mechanism according to an embodiment of the present invention;

[0072] Figure 3 A schematic diagram of a network threat intelligence ontology according to an embodiment of the present invention;

[0073] Figure 4 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention.

[0075] 1010, processor; 1020, memory; 1030, input / output interface; 1040, communication interface; 1050, bus. DETAILED DESCRIPTION

[0076] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0077] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0078] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0079] Embodiment 1

[0080] like Figure 1 As shown, an embodiment of the present invention provides a visualization enhancement method for a network threat intelligence knowledge graph, the method comprising:

[0081] S1: Determine the professional field and scope of the construction of the cyber threat intelligence ontology. Determine the cyber threat intelligence field as the professional field to be constructed, with the goal of integrating multi-source heterogeneous cyber threat intelligence data.

[0082] S2: Seven-step ontology construction based on feedback mechanism. Use the seven-step method to construct the cyber threat intelligence ontology, including the steps of determining the scope of the field, examining the reuse of existing ontologies, constructing the conceptual system of the cyber threat intelligence ontology, and evaluating and verifying the accuracy and consistency of the ontology. Determine the conceptual system of the cyber threat intelligence field, including the definition and classification of cyber threat intelligence field classes, and the determination of attribute sets. Examine the reuse of existing domain ontologies to improve the efficiency of ontology construction. Evaluate and verify the accuracy and consistency of the constructed ontology, and make appropriate corrections.

[0083] S3: Summary of main terms in the field of cyber threat intelligence. Systematically sort out the important terms in the field of cyber threat intelligence, including threat types, attackers, attack modes, attack consequences, and protection countermeasures, to provide guidance for ontology construction.

[0084] S4: Extension of main categories and their relationships in the field of cyber threat intelligence. Based on the existing ontology, the knowledge categories related to cyber threat intelligence are expanded, such as Consequence, CourseOfAction, HackerGroup, etc., to cover all aspects of cyber security.

[0085] S5: Definition of attributes of major categories in the field of cyber threat intelligence. Define the attributes of key categories, such as vulnerability attributes and attack method attributes, to ensure a clear description of the ontology structure and the accuracy and completeness of the information.

[0086] S6: Construction and revision of the network threat intelligence ontology. Based on the construction of the main classes and their relationships in the field of network threat intelligence, associate and integrate the classes and their relationships, instantiate some classes, and build a complete system of network threat intelligence ontology. Define and constrain classes and relationships, establish semantic relationships, and form a hierarchical and standardized knowledge system to describe the concepts of network threat intelligence and the relationships between them.

[0087] S7: Construction and application analysis of network threat intelligence knowledge graph based on Neo4j. The graph database Neo4j is selected as the storage software for network threat intelligence knowledge data to construct a knowledge graph for the network threat intelligence dataset. Neo4j can quickly represent, retrieve and visualize threat intelligence data. And Neo4j's Cypher statement can perform pattern matching in a declarative way and present it in a human-readable format, which is easy to learn.

[0088] In this embodiment, the professional fields and scopes for constructing the network threat intelligence ontology include:

[0089] First, conduct a demand analysis in the field of cyber threat intelligence to clarify the scope of knowledge that needs to be covered by ontology construction. Specific steps include: 1. Conduct a systematic survey of current cyber threat intelligence-related literature, technical reports, industry standards, and practices to understand the core concepts, terms, and their relationships in this field; 2. Through interviews with cybersecurity experts and practitioners, further clarify the specific areas and scopes that need to be covered by ontology construction, especially identifying the key needs of multi-source heterogeneous cyber threat intelligence data integration; 3. Analyze the functional requirements of existing cybersecurity threat intelligence systems and determine the application scenarios that the ontology needs to support, such as threat identification, situational awareness, and incident response.

[0090] In this embodiment, if Figure 2As shown in Figure 1, the method of constructing a seven-step method ontology based on a feedback mechanism includes:

[0091] First, it is necessary to determine the professional fields and scope involved in the ontology. This patent focuses on the field of network threat intelligence, and aims to integrate multi-source heterogeneous network threat intelligence data to provide a top-level model for the construction of a network threat intelligence knowledge graph. Secondly, based on the determination of the professional fields and scope of the ontology, the possibility of reusing existing domain ontologies is examined, which will help improve the efficiency of building the network threat intelligence ontology. Subsequently, based on the analysis of the characteristics of existing network threat intelligence data sets, the construction of the network threat intelligence ontology conceptual system is realized, including the definition and hierarchical division of network threat intelligence domain classes, and the determination of class attribute sets. Finally, the accuracy and consistency of the ontology are evaluated and verified, and appropriate corrections are made to ensure that the constructed ontology is fully applicable to existing data.

[0092] In this embodiment, the main terms in the field of network threat intelligence include:

[0093] First, this field involves rich and complex professional terms, which form the basis of cyber threat intelligence and are also the key to guiding the construction of cyber threat intelligence ontology. Secondly, cybersecurity professionals need to understand and clarify these terms in order to more accurately analyze, predict and respond to various cyber threats. Then, this section systematically sorts out the important terms in the field of cyber threat intelligence, including threat types, attackers, attack patterns, attack consequences, protection countermeasures, etc., to provide guidance for the construction of cyber threat intelligence ontology. Finally, the classification of threat types is one of the basic concepts in the field of cyber threat intelligence, and concepts such as attackers, attack patterns and protection countermeasures are also crucial.

[0094] In this embodiment, the main categories and corresponding relationships in the field of network threat intelligence are expanded to include:

[0095] First, the existing network security domain ontology is reused to improve the efficiency of ontology construction. Existing ontologies such as UCO, intrusion detection domain ontology, security event domain ontology, and malware domain ontology cover most of the concepts related to network security, but due to different focuses and poor relevance, they cannot fully cover a wider range of data sources. Secondly, based on the existing ontology, the categories are divided and expanded for the network threat intelligence field, especially on the UCO ontology. Then, the expanded classes include Consequence, CourseOfAction, HackerGroup, Location, Malware, MalwareFamily, OperatingSystem, Organization, Software, ThreatActor, Tool, and Vulnerability. These categories cover various aspects such as threat types, attackers, attack modes, attack consequences, and protection countermeasures. Finally, through this classification and expansion, the structure and content of the network threat intelligence knowledge system can be more comprehensively understood and mastered, thereby improving the ability of network security professionals to analyze, predict, and respond to various network threats.

[0096] In this embodiment, the attributes of the main categories in the field of network threat intelligence are defined as follows:

[0097] First, by clearly defining the attributes of each class, a clear description of the structure of the ontology is provided to ensure the accuracy and completeness of the information. Second, the attribute set of the vulnerability class in the ontology can be defined as:

[0098]

[0099] These attributes are based on in-depth analysis and standardized representation of domestic and international information security vulnerability libraries.

[0100] The meaning of the vulnerability attribute set is shown in Table 1.

[0101] Table 1 Vulnerability class attributes and their descriptions

[0102]

[0103] The attributes of the attack method class are defined as:

[0104]

[0105] The meaning of the attack method class set is shown in Table 2.

[0106] Table 2 Description of attack method attributes

[0107]

[0108]

[0109] These attributes are expressed by integrating and standardizing the attack tactics, attack techniques, and attack processes related to the attack means. Finally, based on these attribute definitions, a comprehensive and standardized network threat intelligence ontology is constructed to ensure that the ontology can accurately describe all aspects of network threat intelligence and provide more effective attack prevention and response. Figure 3 In the example of , hacker groups use malware when conducting attacks. Malware exploits various vulnerabilities in the operating system or software, and the exploitation of these vulnerabilities may lead to a series of consequences, such as denial of service, memory corruption, and privilege escalation. The network security domain ontology is the basis for the construction of knowledge graphs. Therefore, it is very important to build an ontology that is suitable for existing data sources and more universal.

[0110] In this embodiment, the construction and modification of the network threat intelligence ontology includes:

[0111] First, the network threat intelligence ontology covers various network security-related concepts, entities and relationships. By associating and fusing classes and their relationships and instantiating some classes, a complete and systematic network threat intelligence ontology is constructed. This ontology aims to provide a structured and unified semantic model to describe the concepts of network threat intelligence and the relationships between them, thereby improving the efficiency and accuracy of network threat intelligence analysis and providing comprehensive, accurate and timely information support for the network security field. Secondly, in the process of ontology construction, it is necessary to define and classify the entities and concepts of network threat intelligence and establish semantic relationships between them. By using the network threat intelligence domain ontology as the knowledge system of the knowledge graph, network threat knowledge can be reasoned. For example, when a malware is detected in the network, if the malware is confirmed to be a typical attack tool of an attacker, it can be inferred that the initiator of the attack activity belongs to the attacker and may use the attacker's usual attack methods to launch the attack, thereby enhancing the defense against the attack and improving the level of network security. Then, in the process of constructing the network threat intelligence ontology, concepts, relationships and related attributes are defined, and a preliminary network threat intelligence domain ontology is created. However, since the ontology is still imperfect, as the number of concepts and attributes increases, some errors will inevitably occur, such as illogical or contradictory descriptions in the definition. At the same time, some categories, relationships or descriptions may be missing or redundant. Therefore, the development, verification and revision of the ontology is an iterative process. Finally, in order to ensure the accuracy and logical consistency of the ontology, Protege's built-in reasoner HermiT is used for reasoning verification to find any errors that cause logical inconsistencies and make necessary corrections to form a more complete and systematic cyber threat intelligence domain ontology. Through this process, a cyber threat intelligence ontology that is suitable for existing data sources and has strong versatility is constructed to better serve the field of network security.

[0112] In this embodiment, building a Neo4j-based network threat intelligence knowledge graph and performing application analysis includes:

[0113] First, we use the graph database Neo4j as the storage software for network threat intelligence knowledge data to build a knowledge graph for the network threat intelligence dataset CS13K. Neo4j can quickly represent, retrieve, and visualize threat intelligence data. Its Cypher statements can perform pattern matching in a declarative way and present them in a human-readable format, which is easy to learn and use. Specifically:

[0114] The knowledge graph is represented as:

[0115] KG=(E,R,T), (3)

[0116] Among them, E, R, and T represent entity sets, relationship sets, and triple sets, respectively.

[0117] Represent an entity collection as:

[0118] E={e1,e2,…,e |E|}, (4)

[0119] where e i Represents the i-th entity in the entity set.

[0120] The relationship in the knowledge graph is represented as:

[0121] R={r1,r2…,r |R|}, (5)

[0122] where r i Represents the i-th relation in the relation set.

[0123] The set of triples is represented as:

[0124]

[0125] Secondly, for common malware network attacks, the knowledge graph is used to divide them into multiple subcategories (such as Trojans, worms, spyware, etc.), link them to specific attack strategies (such as ransomware, stealing user information, etc.), and associate them with potentially threatened systems, applications, and corresponding defense measures. By analyzing this information in the knowledge graph, security experts can more accurately predict and prevent various network attacks. By querying the frequency of exploitation of each vulnerability through Cypher statements, vulnerabilities that are frequently used by attackers can be quickly discovered, visualized, and potential threats and attacks can be identified.

[0126] Ranking vulnerabilities in the knowledge graph based on PageRank:

[0127]

[0128] Where PR(v) is the PR value of node v in the knowledge graph; d is the damping factor, which is 0.85 and is used to simulate the probability of random jumps; N is the total number of nodes in the knowledge graph; M(v) is the set of all nodes pointing to node v; L(u) is the out-degree of node u;

[0129] Initially, the PR values ​​of all nodes in the knowledge graph are equal, usually initialized to Through iterative operations until convergence, in each iteration, the PR values ​​of all nodes are updated according to the PR(v) formula, which is expanded as follows:

[0130]

[0131] Among them, u1, u2, ..., u m are all nodes pointing to node v;

[0132] By integrating vulnerabilities, attacks, defense mechanisms, etc. into the knowledge graph, when facing an attack, the intrusion alert can be associated with the attack path, and the attack methods, attack indicators and attack results can be clearly displayed in the form of a graph, and the best mitigation measures can be proposed; in attack forensics, it is also easy to display the vulnerable paths that need to be focused on, and create an overall picture of the attack activities, which is convenient for the analysis, detection, classification and attribution of various network threats.

[0133] The technical solution of the present invention,

[0134] The network threat intelligence knowledge graph visualization and analysis method proposed in this invention can help network security professionals identify, predict and respond to network threats more efficiently. Through the knowledge graph built based on the Neo4j graph database, combined with a rich ontology model, it is possible to structure the network threat intelligence data and provide clear visualization and in-depth multi-dimensional analysis. In practical applications, this method can be widely used in enterprises, governments, military and other fields, and specific applications include:

[0135] (1) Threat identification and situational awareness: Through comprehensive visualization of network threat intelligence, security experts can quickly identify potential threats in the current network environment. For example, in the network security protection of an enterprise, this method can be used to monitor and identify signs of intrusion activities in real time, and provide effective threat warnings and protection strategies. Through the correlation analysis of threat types, attackers and their strategies in the graph, the dynamic changes of network attacks can be grasped in real time, and preventive measures can be taken in advance.

[0136] (2) Vulnerability management and protection strategy optimization: This method can effectively analyze the exploitation frequency and attack path of different vulnerabilities through the structured representation of knowledge graphs, thereby helping network security personnel to discover potential security vulnerabilities and put forward targeted protection suggestions. For example, for high-frequency vulnerabilities discovered, the attacker path of vulnerability exploitation can be displayed through a visual interface, and appropriate defense strategies can be proposed based on the attack path, such as strengthening the patching of specific vulnerabilities and optimizing firewall strategies.

[0137] (3) Attack path analysis and prediction: After a network attack occurs, security experts can use knowledge graphs to track the attacker’s attack path, identify the attack source and target, and further predict possible subsequent attack methods and target systems. This path analysis can help security personnel respond quickly, prevent the attack from expanding, and improve the efficiency of network defense.

[0138] (4) Cybersecurity incident response and evidence collection: When a cybersecurity incident occurs, the knowledge graph analysis function of this method can help security experts quickly determine the attacker's attack intention, implementation process and attack target, thereby supporting the rapid response and evidence collection of cybersecurity incidents. By correlating multi-dimensional information in the graph, the security team can obtain accurate judgment basis at the early stage of the incident, thereby improving the efficiency of incident handling.

[0139] Through this invention, network security professionals can more quickly identify potential threats and take corresponding measures in a timely manner, thereby improving the efficiency and accuracy of network security protection. This patent has a wide range of applications and can play an important role in the fields of enterprises, governments and the military, with significant commercial value and social significance.

[0140] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0141] It should be noted that some embodiments of the present disclosure are described above. Other embodiments are within the scope of the attached claims. In some cases, it should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention. The actions or steps recorded in the claims can be performed in an order different from that in the above embodiment and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0142] Embodiment 2

[0143] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present invention further discloses a visualization enhancement system for a network threat intelligence knowledge graph, the system being used to implement any of the methods described, a professional field and scope determination module, a seven-step ontology construction module, a terminology induction module, an attribute extension module, an attribute definition module, an intelligence ontology construction module, and an intelligence knowledge graph construction module;

[0144] The professional field and scope determination module is used to determine the professional field and scope of the network threat intelligence ontology construction;

[0145] The seven-step ontology construction module is used to construct the seven-step ontology based on the feedback mechanism according to the professional field and scope of the network threat intelligence ontology construction;

[0146] The terminology induction module is used to summarize the main terms in the field of cyber threat intelligence according to the seven-step ontology based on the feedback mechanism;

[0147] The attribute extension module is used to expand the main categories and corresponding relationships in the field of network threat intelligence based on the summarized main terms in the field of network threat intelligence;

[0148] The attribute definition module is used to define the attributes of the main categories in the network threat intelligence field according to the extended main categories and corresponding relationships in the network threat intelligence field;

[0149] The intelligence ontology construction module is used to realize the construction and modification of the network threat intelligence ontology according to the attributes of the main categories in the defined network threat intelligence field;

[0150] The intelligence knowledge graph construction module is used to build a Neo4j-based network threat intelligence knowledge graph and perform application analysis based on the constructed network threat intelligence ontology.

[0151] The system of the above embodiment is used to implement a corresponding visualization enhancement method of a network threat intelligence knowledge graph in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0152] It should be noted that the above-mentioned visualization enhancement system of the network threat intelligence knowledge graph is embodied in the form of a functional unit. The term "module" here can be implemented in the form of software and / or hardware, and is not specifically limited to this.

[0153] For example, a "module" may be a software program, a hardware circuit, or a combination of the two that implements the above functions. The hardware circuit may include an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor, or a group processor, etc.) and a memory for executing one or more software or firmware programs, a combined logic circuit, and / or other suitable components that support the described functions.

[0154] Embodiment 3

[0155] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for visual enhancement of a network threat intelligence knowledge graph as described in any of the above embodiments is implemented.

[0156] Figure 4 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0157] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0158] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0159] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0160] The communication interface 1040 is used to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB (Universal Serial Bus), network cable, etc.), or through a wireless mode (such as mobile network, WIFI (Wireless Fidelity), Bluetooth, etc.).

[0161] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0162] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0163] The system of the above embodiment is used to implement a corresponding visualization enhancement method of a network threat intelligence knowledge graph in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0164] Embodiment 4

[0165] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute a visualization enhancement method of a network threat intelligence knowledge graph as described in any of the above embodiments.

[0166] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0167] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute a visualization enhancement method for a network threat intelligence knowledge graph as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0168] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0169] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present disclosure difficult to understand, the known power / ground connections to the integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present disclosure difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present disclosure will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that the embodiments of the present disclosure can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0170] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0171] Therefore, the units of each example described in the embodiments of the present application can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0172] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A visualization enhancement method for a network threat intelligence knowledge graph, characterized in that: The method comprises: S1: Determine the professional field and scope of cyber threat intelligence ontology construction; S2: According to the professional fields and scope of the cyber threat intelligence ontology, a seven-step ontology based on the feedback mechanism is constructed; S3: According to the seven-step ontology based on the feedback mechanism, the main terms in the field of cyber threat intelligence are summarized; S4: Based on the summarized main terms in the field of cyber threat intelligence, expand the main categories and corresponding relationships in the field of cyber threat intelligence; S5: Based on the main categories and corresponding relationships in the expanded network threat intelligence field, define the attributes of the main categories in the network threat intelligence field; S6: Based on the attributes of the main categories in the defined cyber threat intelligence field, the cyber threat intelligence ontology is constructed and revised; S7: Based on the constructed network threat intelligence ontology, build a Neo4j-based network threat intelligence knowledge graph and conduct application analysis.

2. The method according to claim 1, characterized in that The professional fields and scope of cyber threat intelligence ontology construction include: Conduct a systematic analysis of current cyber threat intelligence-related literature, technical reports, industry standards, and practices to obtain the core concepts, terms, and corresponding relationships in this field; Through analysis with cybersecurity experts and practitioners, we further clarified the specific areas and scope that the ontology construction needs to cover, especially identifying the key requirements for the integration of multi-source heterogeneous cyber threat intelligence data; Analyze the functional requirements of existing network security threat intelligence systems and determine the application scenarios that the ontology needs to support, where the application scenarios include: threat identification, situational awareness, and incident response.

3. The method according to claim 1, characterized in that The method of constructing the seven-step method ontology based on the feedback mechanism includes: Determine the professional fields and scope of the ontology; Based on the professional field and scope of the ontology, the characteristics of the existing network threat intelligence data set are analyzed; Based on the analysis of the characteristics of existing network threat intelligence data sets, the construction of a network threat intelligence ontology conceptual system, namely the construction of a seven-step ontology based on a feedback mechanism, is realized. The network threat intelligence ontology conceptual system includes the definition and hierarchical classification of network threat intelligence domain classes and the determination of class attribute sets.

4. The method according to claim 1, characterized in that Key terms in the cyber threat intelligence field include: Threat types, attackers, attack modes, attack consequences, and protection countermeasures provide guidance for the construction of network threat intelligence ontology.

5. The method according to claim 1, characterized in that The expansion of the main categories and corresponding relationships in the field of network threat intelligence includes: Reuse the existing network security domain ontology, where the existing network security domain ontology includes: UCO, intrusion detection domain ontology, security event domain ontology, and malware domain ontology; On the basis of the existing network security ontology, classes are divided and expanded in the field of network threat intelligence, especially on the UCO ontology. The expanded classes include Consequence, CourseOfAction, HackerGroup, Location, Malware, MalwareFamily, OperatingSystem, Organization, Software, ThreatActor, Tool, and Vulnerability, covering all aspects of threat types, attackers, attack modes, attack consequences, and protection countermeasures.

6. The method according to claim 1, characterized in that The attributes of the main categories in the field of cyber threat intelligence are defined as follows: Define the properties of each class; among them, The attribute set of the vulnerability class in the ontology is defined as: Among them, vul name is the name of the vulnerability, vul id is the vulnerability number, vul alias Another name for vulnerability, vul type Is the type of vulnerability, vul affected_entity is the entity affected by the vulnerability, vul severity_level is the threat level of the vulnerability, vul publish_time is the release time of the vulnerability, vul update_time is the update time of the vulnerability, vul patch For the patch information of the vulnerability, vul solutions Response measures for vulnerabilities; The attributes of the attack method class are defined as: Among them, mean name is the name of the attack method, mean id is the attack method number, mean desc is the attack method description, mean mitigation Mitigation measures for attack methods, mean weak is the vulnerability and weakness associated with the attack method, mean tactic The tactical intention of the attack means platform Application platform for attack means, mean com_tool Common attack targets of attack methods, mean com_group is a common hacker organization corresponding to the attack method, mean com_tool Common tools used as attack methods, mean affected_service Information about servers affected by the attack; Based on the attribute definition, a network threat intelligence ontology that meets the preset requirements is constructed.

7. The method according to claim 1, characterized in that The construction and revision of the cyber threat intelligence ontology includes: Define and classify the entities and concepts of cyber threat intelligence and establish semantic relationships; reason about cyber threat knowledge by using the cyber threat intelligence domain ontology as the knowledge graph; In the process of building the cyber threat intelligence ontology, concepts, relationships and related attributes were defined, and a preliminary domain ontology of cyber threat intelligence ontology was created and iterated repeatedly; Protege's built-in reasoner HermiT is used for reasoning verification to form a more complete and systematic network threat intelligence domain ontology.

8. The method according to claim 1, characterized in that Building a Neo4j-based cyber threat intelligence knowledge graph and conducting application analysis include: The graph database Neo4j is used to store network threat intelligence knowledge data, and a knowledge graph is constructed for the network threat intelligence dataset CS13K. Specifically: The knowledge graph is represented as: KG=(E,R,T), Among them, E, R, and T represent entity sets, relationship sets, and triple sets, respectively; Represent an entity collection as: E={e1,e2,…,e |E| }, Among them, e i Represents the i-th entity in the entity set; The relationship in the knowledge graph is represented as: R＝{r1，r2,…,r |R|}， Among them, r i represents the i-th relation in the relation set; The set of triples is represented as: For network attacks, we use knowledge graphs to classify network attacks into multiple subcategories, link them to specific attack strategies, and associate network attacks with threatened systems, applications, and corresponding defense measures. We use Cypher statements to query the exploitation frequency of each vulnerability, obtain the vulnerabilities used by attackers, and visualize them, and identify potential threats and attacks. Ranking vulnerabilities in the knowledge graph based on PageRank: Where PR(v) is the PR value of node v in the knowledge graph; d is the damping factor, which is 0.85 and is used to simulate the probability of random jumps; N is the total number of nodes in the knowledge graph; M(v) is the set of all nodes pointing to node v; L(u) is the out-degree of node u; Initially, the PR values ​​of all nodes in the knowledge graph are equal, usually initialized to Through iterative operations until convergence, in each iteration, the PR values ​​of all nodes are updated according to the PR(v) formula, which is expanded as follows: Among them, u1, u2, ..., u m are all nodes pointing to node v; Integrate vulnerabilities, attacks, and defense mechanisms into the knowledge graph. When facing an attack, associate intrusion alerts with attack paths, display attack methods, attack indicators, and attack results in the form of a graph, and propose the best mitigation measures.

9. A visualization enhancement system for a network threat intelligence knowledge graph, the system being used to implement the method of any one of claims 1 to 8, characterized in that: Professional field and scope determination module, seven-step ontology construction module, terminology induction module, attribute extension module, attribute definition module, intelligence ontology construction module, intelligence knowledge graph construction module; The professional field and scope determination module is used to determine the professional field and scope of network threat intelligence ontology construction; The seven-step ontology construction module is used to construct a seven-step ontology based on a feedback mechanism according to the professional field and scope of the network threat intelligence ontology construction; The terminology summarization module is used to summarize the main terms in the field of network threat intelligence according to the seven-step ontology based on the feedback mechanism; The attribute extension module is used to expand the main categories and corresponding relationships in the field of network threat intelligence based on the summarized main terms in the field of network threat intelligence; The attribute definition module is used to define the attributes of the main categories in the network threat intelligence field according to the expanded main categories and corresponding relationships in the network threat intelligence field; The intelligence ontology construction module is used to realize the construction and modification of the network threat intelligence ontology according to the attributes of the main categories in the defined network threat intelligence field; The intelligence knowledge graph construction module is used to construct a Neo4j-based network threat intelligence knowledge graph and perform application analysis based on the constructed network threat intelligence ontology.

Images