Test environment equivalence quantification method and system based on graph similarity measurement

Abstract

The invention belongs to but is not limited to the technical field of information security, and discloses a test environment equivalence quantification method and system based on graph similarity measurement, and the method comprises the steps: carrying out the multi-dimensional data collection of a simulation environment and a real installation environment through a test environment data collection module; using an environment detection conversion module to construct a knowledge graph instance corresponding to the environment by using the collected data; performing similarity calculation on the knowledge graph based on a graph similarity calculation method; and carrying out weighted calculation on a similarity calculation result. According to the calculation method, global and local features among different environments are comprehensively considered, the expansibility of the calculation process is good, reasonable support can be provided for test environment equivalence judgment, and the problems that in existing test work, environment equivalence judgment depends on supervisor judgment, and quantitative description is lacked are solved.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of information security technology, and in particular relates to a test environment equivalence quantification method and system based on graph similarity measurement. Background Art

[0002] The implementation of network security SY is sometimes carried out based on an equivalent environment. In this case, the calculation and judgment of the equivalence between the simulation environment and the actual environment is an important part of the network security SY work, which involves SY personnel verifying whether a specific simulation environment can accurately simulate the actual system or process, that is, whether the simulation system accurately reflects the behavior and characteristics of the actual system under the same input.

[0003] At present, the management and guarantee of the equivalence of the test environment are mainly based on the principle of functional structure similarity between the simulation model and the simulation object or the principle of output result difference. The former is more widely used. The common practice is that the responsible unit of the tested equipment simplifies and abstracts the spatial sequence structure (spatial arrangement, combination and connection methods) and functional sequence structure (the various functions exhibited by system elements in the process of interaction) of the simulated object to obtain an equivalent environment. Then, experts judge whether the simulation environment can achieve the equivalent procedure according to the SY purpose and the acceptance of the results after the implementation of subsequent SY subjects.

[0004] The existing technology has the following technical problems in the test environment comparison method:

[0005] 1. Lack of accuracy

[0006] Traditional test environment comparison methods often rely on simple numerical calculations or manual analysis. This method cannot fully handle complex environmental data, resulting in insufficient accuracy of the comparison results. Traditional methods have limited processing capabilities for multi-dimensional and heterogeneous data and cannot fully reflect the subtle differences between environments.

[0007] 2. Insufficient data fusion

[0008] Existing technologies usually cannot effectively integrate data types (such as assets, topologies, vulnerabilities, source code defects, etc.) from different tools or sources, so that the correlation and integrity between different data cannot be fully utilized, thus affecting the effect and accuracy of the overall comparison.

[0009] 3. Limitations of environmental comparison

[0010] Traditional methods have difficulty adapting to the diversity of types and sizes of environmental data when processing heterogeneous environmental data. Especially in complex environments, existing technologies are usually unable to effectively capture all important information or find potential risks and anomalies in the environment.

[0011] 4. Lack of intelligent analysis capabilities

[0012] Many existing methods rely on manual analysis and rule-based processing, lack intelligent data processing capabilities, and cannot automatically quantify environmental similarity. Traditional methods cannot fully utilize deep learning technology for data feature extraction and dynamic processing, resulting in a low level of intelligence in environmental equivalence quantification.

[0013] 5. Inefficient calculation

[0014] Existing methods often use static, computationally intensive algorithms, which leads to inefficiency in large-scale data processing. Especially when the amount of environmental data is huge, traditional methods take too long to process and cannot meet the needs of real-time processing and dynamic analysis.

[0015] These problems lead to the limitations of traditional test environment comparison methods in complex environmental data processing and similarity quantification, thus affecting the comprehensiveness, accuracy and efficiency of environmental comparison. Summary of the invention

[0016] In view of the problems existing in the prior art, the present invention provides a method and system for quantifying the equivalence of test environments based on graph similarity measurement, and provides network security personnel with a calculation method for quantifying the similarity between a simulation environment and an actual installation environment.

[0017] The present invention is implemented as follows: a method for quantifying the equivalence of test environments based on graph similarity measurement, comprising the following steps:

[0018] Step 1: Use the test environment data acquisition module to collect multi-dimensional data for the simulation environment and the actual installation environment;

[0019] Step 2: Use the environment detection conversion module to build a knowledge graph instance corresponding to the environment using the collected data;

[0020] Step 3: Calculate the similarity of the knowledge graph based on the graph similarity calculation method;

[0021] Step 4: Perform weighted calculation on the similarity calculation results.

[0022] Furthermore, the test environment data collection module in step 1 includes asset scanning tools, security baseline checking tools, vulnerability scanning tools and penetration testing tools of the same type and configuration, and the collected data includes assets, topology, vulnerabilities, source code defects, backdoors and other data; the scanning results obtained in step 1 are all structured data. Optionally, if there is no actual installation environment, historical data obtained in other projects can be used as the basis for subsequent graph data establishment and calculation.

[0023] Furthermore, the construction of the knowledge graph instance in step two includes: extracting entities and attributes from the data according to a preset knowledge graph structure; while constructing the knowledge graph instance, receiving data information from the threat intelligence knowledge base, and associating and expanding the data collected in step one.

[0024] Furthermore, the knowledge graph similarity in step 3 uses node features (local) and global feature data; the similarity calculation includes:

[0025] (1) The input knowledge graph is embedded into the model to obtain the node feature vector.

[0026] (2) Using a graph convolutional neural network (GCN) to update the node vector, the updated node feature vector encodes the attributes of each node and its surrounding structural information;

[0027] (3) Perform pairwise similarity judgment on nodes of different knowledge graphs to obtain a node-level similarity matrix.

[0028] Furthermore, the Word2Vec model is used to vectorize the nodes and attributes in the knowledge graph. The Bert model is cascaded after the output of the Word2Vec model to perform a second round of embedding on the variable-length input to obtain a fixed-length vector representation.

[0029] GCN is used to aggregate the neighbor features of each node to update the node representation. For each node, its new representation is calculated by weighted summing of the features of its neighbor nodes. The specific calculation is shown in the following formula:

[0030]

[0031] Where N(n) is the set of adjacent nodes of node n, d n d m are the degrees of n and m respectively (the sum of out-degree and in-degree), is the weight matrix of the lth layer, σ is the activation function, and the ReLu function is used as the activation function.

[0032] Furthermore, the requirements for the number of convolution layers in the knowledge graph are as follows: when the number of nodes in the knowledge graph is in the range of [0,100], the number of graph convolution layers is not less than 4; when the number of nodes is in the range of [100-1000], the number of graph convolution layers is not less than 6; when the number of nodes is above 1000, the number of graph convolution layers is the number of nodes in the longest path in the graph.

[0033] Furthermore, after completing the multi-layer graph convolution operation, a new set of node quantization results v is obtained for each knowledge graph. topo , which contains node topology information; use the pre-trained Bert model to train each knowledge graph v topoThe global expression h of the knowledge graph corresponding to each environment is obtained by embedding. The h of the actual environment and the equivalent environment are simultaneously input into a multi-layer convolutional neural network. The network can use a general binary classification network, that is, to determine whether the two input vectors are similar. The confidence level of the binary classification results is used as the global similarity result, and this value always falls within the interval [0,1].

[0034] Furthermore, according to the v of the actual environment and the equivalent environment topo In addition, the node-level similarity matrix is ​​calculated. The number of nodes in each knowledge graph is n and m respectively, so a (n, m)-dimensional matrix can be constructed. The value at any position in the matrix represents the similarity between the two nodes in the corresponding dimension. The similarity between nodes is calculated as follows:

[0035]

[0036] In the formula, represents the constructed matrix, and f represents the v of the multi-layer neural network for different environments. topo To calculate the similarity, f can also use a general two-classification multi-layer neural network.

[0037] Furthermore, the weighted calculation in step 4 includes:

[0038] (1) Obtain the full set of nodes in the actual and equivalent environment knowledge graphs, and then assign weights to the nodes in the full set, thereby affecting the final calculation result of the node-level similarity matrix obtained in step 3;

[0039] (2) A pyramid pooling layer (SSP) is used to pool the node-level similarity matrix. After the SSP output, a cascade convolutional neural network is used to calculate the node-level similarity result. The convolutional neural network adopts a general binary classification multi-layer convolutional neural network, and the confidence of the similarity judgment is used as the equivalent quantitative result of the node level.

[0040] Another object of the present invention is to provide a test environment equivalence quantification calculation system based on graph similarity measurement and a test environment equivalence quantification method based on graph similarity measurement, comprising:

[0041] The test environment data acquisition module is used to collect multi-dimensional data of the simulation environment and the actual installation environment;

[0042] The environment detection conversion module uses the collected data to build a knowledge graph instance corresponding to the environment;

[0043] Similarity calculation module, which performs similarity calculation on knowledge graphs based on graph similarity calculation method;

[0044] The weighted calculation module performs weighted calculation on the similarity calculation results.

[0045] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0046] First, the present invention solves the problem that environmental equivalence judgment in existing experimental work relies on subjective judgment and lacks quantitative description. The calculation method comprehensively considers the global and local characteristics between different environments, and the calculation process has good scalability, which can provide reasonable support for the equivalence judgment of the experimental environment.

[0047] The working principle of this method starts with the multi-dimensional collection of test environment data. Through the test environment data collection module, data is collected for the simulation environment and the actual environment respectively. The collection tools include asset scanning tools, security baseline inspection tools, vulnerability scanning tools and penetration testing tools. The collected data types cover assets, topology, vulnerabilities, source code defects, backdoors and other information. These data are standardized and stored in the form of structured data, providing a basis for the subsequent knowledge graph construction.

[0048] Based on the collected structured data, the preset knowledge graph structure is used for data processing, including extracting entities and attributes. Each knowledge graph instance represents the overall picture of a test environment, with nodes representing key entities such as assets, vulnerabilities, and topological relationships, and edges representing the relationships between entities. In addition, to improve the integrity and relevance of the data, the system will obtain additional information from the threat intelligence knowledge base, associate it with the collected data, and generate a more comprehensive knowledge graph instance.

[0049] After the knowledge graph instance is constructed, the Word2Vec model is used to vectorize each node and its attributes in the knowledge graph. The Word2Vec model generates feature vectors by learning the contextual information of nodes and attributes to capture their semantic features. To further improve the embedding quality, the Bert model is connected after vectorization to perform secondary embedding on the variable-length input and output a fixed-length vector representation. The node feature vector generated at this stage not only contains the semantic information of the node, but also maintains consistency in the high-dimensional space.

[0050] Based on node vectorization, the node features are updated using graph convolutional neural network (GCN). GCN encodes the node attributes and local structure information by aggregating the features of each node's neighbor nodes.

[0051] Using the updated feature vectors from GCN, the system performs node similarity calculations on the knowledge graphs of the simulation environment and the actual environment, generating a node-level similarity matrix. Each element in the matrix represents the semantic similarity and structural similarity between the nodes in the two graphs. The similarity is calculated based on the cosine similarity or Euclidean distance between the node feature vectors. The node-level similarity matrix provides the basis for subsequent global similarity calculations.

[0052] Based on the node similarity, the system further considers the global characteristics of the knowledge graph, including the distribution of nodes, the density of edges, and the topological structure. Through weighted calculation, the local and global similarity results are merged into the final similarity value to measure the overall similarity of the two test environments in data semantics and structure. This result is used to quantify the equivalence of the simulation environment and the actual environment.

[0053] To ensure the accuracy of similarity calculation, this method dynamically adjusts the number of graph convolution layers according to the number of nodes in the knowledge graph. When the number of nodes is small (such as less than 100), 4 layers of convolution are used; when the number of nodes increases to 100-1000, 6 layers of convolution are used; when the number of nodes exceeds 1000, the number of convolution layers is based on the number of nodes in the longest path. This optimization strategy ensures a balance between information propagation depth and computational efficiency.

[0054] The final similarity value is output in a visual form, such as a heat map or similarity matrix to represent the equivalence between the two test environments. This result can be used for simulation environment design verification, installation environment safety assessment, and optimization and adjustment of the test environment. The precise quantification of similarity results provides a scientific basis for performance comparison and migration between different environments.

[0055] Second, the test environment equivalence quantification method based on graph similarity measurement provided by the present invention aims to solve the problems of insufficient accuracy and insufficient fusion processing of different environment data types in traditional test environment comparison methods. This method can effectively improve the accuracy and intelligence level of test environment equivalence quantification by constructing a graph-based knowledge structure and combining deep learning technologies such as graph convolutional neural network (GCN), Word2Vec and Bert model, and solve the limitations of existing technologies, which are specifically reflected in the following aspects:

[0056] 1. Accurately compare complex test environment data

[0057] Traditional test environment comparison methods often rely on simple numerical calculations or manual analysis. However, this invention can effectively process heterogeneous data (such as assets, topologies, vulnerabilities, source code defects, etc.) by converting test environment data into a graph data structure, and accurately quantify the equivalence between different environments through graph similarity measurement calculation. In this way, the subtle differences between environments can be more comprehensively captured and reflected, avoiding the accuracy problems caused by the lack of multidimensional data fusion in traditional methods.

[0058] 2. Using deep learning to improve the automation and intelligence of environmental equivalence calculations

[0059] The application of the graph convolutional neural network (GCN) and multimodal embedding model (such as Word2Vec combined with Bert model) of the present invention significantly improves the intelligent level of quantification of experimental environment equivalence. Through the combined use of these deep learning models, the system can automatically perform data feature extraction, node feature update and graph data fusion calculation, reducing manual intervention and improving processing efficiency and accuracy.

[0060] 3. Multi-level and comprehensive data integration and optimization

[0061] By adopting a parallel embedding method and combining graph convolution operations at different levels, the present invention can not only perform similarity calculations at the node level, but also perform overall comparisons of environmental equivalence at the global level. Through this comprehensive processing method, data of different dimensions and complexities can be effectively integrated, avoiding the limitation that traditional methods can only process a single type of data.

[0062] 4. Flexibility and scalability

[0063] The method of the present invention flexibly adjusts the computational complexity according to the data characteristics and scale of the actual environment by setting different numbers of graph convolution layers and network architectures. This enables the method to run efficiently in a small-scale environment, maintain good performance in a large-scale environment, and adapt to experimental environments of different types and scales.

[0064] 5. Improve environmental monitoring and safety protection capabilities

[0065] Since the equivalence of test environments can be quantified and compared accurately in real time, the technical solution of the present invention has wide application potential in the fields of environmental monitoring, vulnerability management, attack protection, etc. It can help organizations better identify and respond to potential security risks, thereby optimizing security protection strategies and improving overall security levels.

[0066] In summary, the present invention not only improves the accuracy and efficiency of the quantification of the equivalence of the experimental environment by introducing a deep learning method based on graph similarity measurement, but also introduces more data fusion, intelligent calculation and automatic processing capabilities on the basis of traditional methods, thereby solving the technical bottlenecks of the existing technology in a variety of practical applications and achieving significant technological progress. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 It is a flow chart of a test environment equivalence quantification method based on graph similarity measurement provided by an embodiment of the present invention;

[0068] Figure 2 It is a structural diagram of a test environment equivalence quantitative calculation system based on graph similarity measurement provided by an embodiment of the present invention;

[0069] Figure 3 It is a schematic diagram of the data transmission transformation process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0071] The working principle of this method starts with the multi-dimensional collection of test environment data. Through the test environment data collection module, data is collected for the simulation environment and the actual environment respectively. The collection tools include asset scanning tools, security baseline inspection tools, vulnerability scanning tools and penetration testing tools. The collected data types cover assets, topology, vulnerabilities, source code defects, backdoors and other information. These data are standardized and stored in the form of structured data, providing a basis for the subsequent knowledge graph construction.

[0072] Based on the collected structured data, the preset knowledge graph structure is used for data processing, including extracting entities and attributes. Each knowledge graph instance represents the overall picture of a test environment, with nodes representing key entities such as assets, vulnerabilities, and topological relationships, and edges representing the relationships between entities. In addition, to improve the integrity and relevance of the data, the system will obtain additional information from the threat intelligence knowledge base, associate it with the collected data, and generate a more comprehensive knowledge graph instance.

[0073] After the knowledge graph instance is constructed, the Word2Vec model is used to vectorize each node and its attributes in the knowledge graph. The Word2Vec model generates feature vectors by learning the contextual information of nodes and attributes to capture their semantic features. To further improve the embedding quality, the Bert model is connected after vectorization to perform secondary embedding on the variable-length input and output a fixed-length vector representation. The node feature vector generated at this stage not only contains the semantic information of the node, but also maintains consistency in the high-dimensional space.

[0074] Based on node vectorization, the node features are updated using graph convolutional neural network (GCN). GCN encodes the node attributes and local structure information by aggregating the features of each node's neighbor nodes.

[0075] Using the updated feature vectors from GCN, the system performs node similarity calculations on the knowledge graphs of the simulation environment and the actual environment, generating a node-level similarity matrix. Each element in the matrix represents the semantic similarity and structural similarity between the nodes in the two graphs. The similarity is calculated based on the cosine similarity or Euclidean distance between the node feature vectors. The node-level similarity matrix provides the basis for subsequent global similarity calculations.

[0076] Based on the node similarity, the system further considers the global characteristics of the knowledge graph, including the distribution of nodes, the density of edges, and the topological structure. Through weighted calculation, the local and global similarity results are merged into the final similarity value to measure the overall similarity of the two test environments in data semantics and structure. This result is used to quantify the equivalence of the simulation environment and the actual environment.

[0077] To ensure the accuracy of similarity calculation, this method dynamically adjusts the number of graph convolution layers according to the number of nodes in the knowledge graph. When the number of nodes is small (such as less than 100), 4 layers of convolution are used; when the number of nodes increases to 100-1000, 6 layers of convolution are used; when the number of nodes exceeds 1000, the number of convolution layers is based on the number of nodes in the longest path. This optimization strategy ensures a balance between information propagation depth and computational efficiency.

[0078] The final similarity value is output in a visual form, such as a heat map or similarity matrix to represent the equivalence between the two test environments. This result can be used for simulation environment design verification, installation environment safety assessment, and optimization and adjustment of the test environment. The precise quantification of similarity results provides a scientific basis for performance comparison and migration between different environments.

[0079] like Figure 1 As shown, an embodiment of the present invention provides a test environment equivalence quantification method based on graph similarity measurement, comprising the following steps:

[0080] Step 1: Use the test environment data acquisition module to collect multi-dimensional data for the simulation environment and the actual installation environment;

[0081] Step 2: Use the environment detection conversion module to build a knowledge graph instance corresponding to the environment using the collected data;

[0082] Step 3: Calculate the similarity of the knowledge graph based on the graph similarity calculation method;

[0083] Step 4: Perform weighted calculation on the similarity calculation results.

[0084] The working principle of the test environment equivalence quantification method based on graph similarity measurement provided by the embodiment of the present invention is as follows:

[0085] 1. Test environment data collection

[0086] First, the test environment data collection module is used to collect multi-dimensional data for the simulation environment and the actual installation environment. The dimensions of data collection include but are not limited to information such as asset configuration, topology, vulnerabilities, and source code defects. This process uses a variety of scanning tools and inspection tools such as asset scanning tools, security baseline inspection tools, and vulnerability scanning tools to collect key data in different environments, and convert these data into structured information, providing a basis for subsequent graph construction and similarity calculation.

[0087] 2. Build a knowledge graph instance

[0088] In step 2, the collected data is processed using the environment detection conversion module to construct the corresponding knowledge graph instance. The knowledge graph structure can be designed according to preset standards, mainly including nodes (representing different entities, such as system components, vulnerabilities, assets, etc.) and edges (representing the relationship between these entities). The key to this step is to effectively extract entities, assign attributes, and represent relationships from the original data, and expand the information content of the graph instance by combining environmental data with threat intelligence, thereby improving the integrity and accuracy of the graph.

[0089] 3. Graph Similarity Calculation

[0090] In step three, similarity calculation is performed on the constructed knowledge graph instance through graph similarity calculation method. At this time, the similarity calculation method adopted not only considers the characteristics of the nodes (such as the attributes and types of the nodes), but also considers the structural relationship between the nodes (such as the connection and path information between the nodes). The purpose of similarity calculation is to judge the structural and content differences between the simulation environment and the actual environment, identify the similarity between the two in actual applications, and provide a basis for subsequent equivalence evaluation.

[0091] 4. Weighted calculation

[0092] In step 4, the graph similarity calculation results obtained in step 3 are weighted. Different environmental features may have different influences on the final equivalence quantification, so it is necessary to adjust the weights of different features through weighting strategies. Weighted calculation can flexibly adjust the contribution of various data dimensions (such as assets, topology, vulnerabilities, etc.) according to actual needs, ensuring that the final similarity score can truly reflect the equivalence of the simulation environment and the actual environment.

[0093] 5. Optimization and evaluation

[0094] After obtaining the weighted similarity calculation results, the present invention can further perform optimization analysis to identify important factors that may affect the equivalence of the test environment and make adjustments according to the actual application scenario. For example, in different industries and different application fields, some environmental features may be more critical than other features. By optimizing the weighting strategy, the equivalence between different environments can be quantified more accurately.

[0095] 6. Generate equivalence quantitative report

[0096] Finally, the test environment equivalence quantification method based on graph similarity measurement of the present invention can generate a detailed equivalence quantification report. The report contains the similarities and differences between the simulation environment and the actual installation environment in various dimensions, helping engineers to better understand the environmental differences during the test process and provide decision support for environmental matching and optimization.

[0097] Through this process, the present invention can accurately and intelligently quantify the equivalence of different test environments, overcome the limitations of traditional methods, and provide more comprehensive and reliable environmental comparison analysis results.

[0098] Furthermore, the test environment data collection module in step 1 includes asset scanning tools, security baseline checking tools, vulnerability scanning tools and penetration testing tools of the same type and configuration, and the collected data includes assets, topology, vulnerabilities, source code defects, backdoors and other data; the scanning results obtained in step 1 are all structured data. Optionally, if there is no actual installation environment, historical data obtained in other projects can be used as the basis for subsequent graph data establishment and calculation.

[0099] Furthermore, the construction of the knowledge graph instance in step two includes: extracting entities and attributes from the data according to a preset knowledge graph structure; while constructing the knowledge graph instance, receiving data information from the threat intelligence knowledge base, and associating and expanding the data collected in step one.

[0100] Furthermore, the knowledge graph similarity in step 3 uses node features (local) and global feature data; the similarity calculation includes:

[0101] (1) The input knowledge graph is embedded into the model to obtain the node feature vector.

[0102] (2) Using a graph convolutional neural network (GCN) to update the node vector, the updated node feature vector encodes the attributes of each node and its surrounding structural information;

[0103] (3) Perform pairwise similarity judgment on nodes of different knowledge graphs to obtain a node-level similarity matrix.

[0104] Furthermore, the weighted calculation in step 4 includes:

[0105] (1) Obtain the full set of nodes in the actual and equivalent environment knowledge graphs, and then assign weights to the nodes in the full set, thereby affecting the final calculation result of the node-level similarity matrix obtained in step 3;

[0106] (2) A pyramid pooling layer (SSP) is used to pool the node-level similarity matrix. After the SSP output, a cascade convolutional neural network is used to calculate the node-level similarity result. The convolutional neural network adopts a general binary classification multi-layer convolutional neural network, and the confidence of the similarity judgment is used as the equivalent quantitative result of the node level.

[0107] like Figure 2 As shown, the embodiment of the present invention provides a test environment equivalence quantification calculation system based on graph similarity measurement and a test environment equivalence quantification method based on graph similarity measurement, including:

[0108] The test environment data acquisition module is used to collect multi-dimensional data of the simulation environment and the actual installation environment;

[0109] The environment detection conversion module uses the collected data to build a knowledge graph instance corresponding to the environment;

[0110] Similarity calculation module, which performs similarity calculation on knowledge graphs based on graph similarity calculation method;

[0111] The weighted calculation module performs weighted calculation on the similarity calculation results.

[0112] Example 1

[0113] S1, use the test environment data acquisition module to collect multi-dimensional data for the simulation environment and the actual installation environment;

[0114] When the test personnel are faced with the actual environment and the equivalent environment, they first use the asset scanning tool to detect the target environment. Taking the general asset detection tool as an example, the tool is connected to different environments and the corresponding scanning network segment is entered to obtain a list of information such as the IP address, MAC address, region, operating system, host name, etc. of the assets in different environments.

[0115] Use vulnerability scanning tools to scan the target environment, connect the tools to different environments, and configure the target address / network segment, weak password dictionary, etc. required by the host weak password scanning tool. When the test personnel complete the input of the information required for the scanning task, each vulnerability scanning engine starts to send pre-constructed different types of messages to the target system, analyze and form relevant results based on the returned information.

[0116] Use the security baseline inspection tool to detect the target. Specifically, connect the tool to different environments and use the same inspection items to obtain information such as the system, middleware, database, account configuration, and security software on the host in the target environment. Optionally, in order to accumulate enough data when the present invention is actually applied to the system, the inspection items generally cover identity authority, access control, log monitoring and auditing, security software configuration, password settings, network connections, and other contents.

[0117] S2, using the environment detection conversion module to build a knowledge graph instance corresponding to the environment using the collected data;

[0118] According to the preset knowledge graph structure, entities and attributes are extracted from the data. In addition, in order to improve the accuracy of the subsequent fusion steps, while constructing the knowledge graph instance, the data information in the threat intelligence knowledge base is received, and the data collected in step S1 is associated and expanded. The expansion operation is essentially to amplify the differences and strengthen the same parts. Specifically, when the equivalent environment and the actual environment have the same equipment or software, the two knowledge graphs will get the same expansion; conversely, when only the actual environment has a certain device, only the knowledge graph of the actual environment is expanded, and the difference between the two is further expanded.

[0119] S3, performs similarity calculation on the knowledge graph based on the graph similarity calculation method;

[0120] In the present invention, the knowledge graph similarity adopts node features (local) and global feature data. First, the input knowledge graph is converted into a node feature vector using a graph convolutional network (GCN). The node feature vector encodes the attributes of each node and the structural information around it.

[0121] Specifically, the common Word2Vec model is used to vectorize the nodes and attributes in the knowledge graph. Considering that the number of attributes of different nodes is inconsistent, the length of the vectorization result is inconsistent. The Bert model is cascaded after the output of the Word2Vec model to perform a second round of embedding on the variable-length input to obtain a fixed-length vector representation.

[0122] GCN is used to aggregate the neighbor features of each node to update the node representation. For each node n, its new representation is calculated by weighted summing of the features of its neighbor nodes. The specific calculation is shown in the following formula:

[0123]

[0124] In the above formula, N(n) is the set of adjacent nodes of node n, d n d m are the degrees of n and m respectively (the sum of out-degree and in-degree), is the weight matrix of the lth layer, σ is the activation function, and the common ReLu function is used as the activation function. The above node update is composed of multiple layers of convolution. In the present invention, in order to ensure that the topological structure information in the knowledge graph is fully quantified and learned, the number of convolution layers has the following requirements: when the number of nodes in the knowledge graph is in the range of [0,100], the number of graph convolution layers is not less than 4; when the number of nodes is in the range of [100-1000], the number of graph convolution layers is not less than 6. When the number of nodes is above 1000, the number of the longest path nodes in the graph is the number of graph convolution layers.

[0125] After completing the multi-layer graph convolution operation, a new set of node quantization results v is obtained for each knowledge graph topo , which contains node topology information. Use the pre-trained Bert model to train each knowledge graph v topo The global expression h of the knowledge graph corresponding to each environment is obtained by embedding. The data flow and dimension changes are as follows: Figure 3 As shown, h of the actual environment and the equivalent environment are simultaneously input into a multi-layer convolutional neural network. The network can use a general binary classification network, that is, to determine whether the two input vectors are similar, and the confidence level of the similarity judged in the binary classification results is the global similarity result, which always falls within the interval [0,1].

[0126] According to the actual environment and the equivalent environment v topo In addition, the node-level similarity matrix is ​​calculated. Specifically, the number of nodes in each knowledge graph is n and m respectively, so a (n, m)-dimensional matrix can be constructed. The value at any position in the matrix represents the similarity between the two nodes in the corresponding dimension. The similarity between nodes is calculated as follows:

[0127]

[0128] represents the constructed matrix, and f represents the v of the multi-layer neural network for different environments. topo To calculate the similarity, f can also use a general two-classification multi-layer neural network.

[0129] S4, performing weighted calculation on the similarity calculation results;

[0130] The experimenter can assign node weights to the node similarity matrix obtained in S3 according to the actual situation, which can affect the similarity results of the actual environment and the equivalent environment. By assigning a weight value of 0.1 to the host device A in the equivalent environment, the similarities obtained in the rows or columns corresponding to the device are all reduced.

[0131] The pyramid pooling layer (SSP) is used to pool the node-level similarity matrix. The main purpose of applying SSP is to solve the problem of similarity matrix input of different sizes. After the SSP output, the cascade convolutional neural network calculates the node-level similarity result. The convolutional neural network can use a general two-classification multi-layer convolutional neural network. The confidence of the similarity judgment is also used as the equivalent quantitative result at the node level.

[0132] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0133] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for quantifying the equivalence of test environments based on graph similarity measurement, characterized in that: The following steps are involved: Step 1: Use the test environment data acquisition module to collect multi-dimensional data for the simulation environment and the actual installation environment; Step 2: Use the environment detection conversion module to build a knowledge graph instance corresponding to the environment using the collected data; Step 3: Calculate the similarity of the knowledge graph based on the graph similarity calculation method; Step 4: Perform weighted calculation on the similarity calculation results.

2. The test environment equivalence quantification method based on graph similarity measurement according to claim 1, characterized in that: The test environment data collection module in step one includes asset scanning tools, security baseline checking tools, vulnerability scanning tools and penetration testing tools of the same type and configuration, and the collected data includes assets, topology, vulnerabilities, source code defects, and backdoor data; the scanning results obtained in step one are all structured data.

3. The test environment equivalence quantification method based on graph similarity measurement according to claim 1, characterized in that: The construction of the knowledge graph instance in step two includes: extracting entities and attributes from the data according to the preset knowledge graph structure; while constructing the knowledge graph instance, receiving data information from the threat intelligence knowledge base, and associating and expanding the data collected in step one.

4. The test environment equivalence quantification method based on graph similarity measurement according to claim 1, characterized in that: The knowledge graph similarity described in step 3 uses node features and global feature data; The similarity calculation includes: (1) The input knowledge graph is embedded into the model to obtain the node feature vector. (2) Use the graph convolutional neural network (GCN) to update the node vector. The updated node feature vector encodes the attributes of each node and its surrounding structure information; (3) Perform pairwise similarity judgment on nodes of different knowledge graphs to obtain a node-level similarity matrix.

5. The test environment equivalence quantification method based on graph similarity measurement according to claim 4, characterized in that: Use the Word2Vec model to vectorize the nodes and attributes in the knowledge graph. After the output of the Word2Vec model, cascade the Bert model to perform a second round of embedding on the variable-length input to obtain a fixed-length vector representation. GCN is used to aggregate the neighbor features of each node to update the node representation. For each node, its new representation is calculated by weighted summing of the features of its neighbor nodes. The specific calculation is shown in the following formula: Where N(n) is the set of adjacent nodes of node n, d n d m are the degrees of n and m respectively (the sum of out-degree and in-degree), is the weight matrix of the lth layer, σ is the activation function, and the ReLu function is used as the activation function.

6. The test environment equivalence quantification method based on graph similarity measurement according to claim 4, characterized in that: Requirements for the number of convolution layers in the knowledge graph: When the number of nodes in the knowledge graph is in the range of [0,100], the number of graph convolution layers shall not be less than 4; when the number of nodes is in the range of [100-1000], the number of graph convolution layers shall not be less than 6. When the number of nodes is above 1000, the number of graph convolution layers is the number of nodes in the longest path in the graph.

7. The test environment equivalence quantification method based on graph similarity measurement according to claim 6, characterized in that: After completing the multi-layer graph convolution operation, a new set of node quantization results v is obtained for each knowledge graph. topo , which contains node topology information; use the pre-trained Bert model to train each knowledge graph v topo The global expression h of the knowledge graph corresponding to each environment is obtained by embedding. The h of the actual environment and the equivalent environment are simultaneously input into a multi-layer convolutional neural network. The network can use a general binary classification network, that is, to determine whether the two input vectors are similar. The confidence level of the binary classification results is taken as the global similarity result, and the value falls within the interval [0,1].

8. The test environment equivalence quantification method based on graph similarity measurement according to claim 4, characterized in that: According to the actual environment and the equivalent environment v topo In addition, the node-level similarity matrix is ​​calculated. The number of nodes in each knowledge graph is n and m respectively, that is, a (n, m)-dimensional matrix is ​​constructed. The value at any position in the matrix represents the similarity between the two nodes in the corresponding dimension. The similarity between nodes is calculated as follows: In the formula, represents the constructed matrix, and f represents the v of the multi-layer neural network for different environments. topo To calculate the similarity, f can also use a general two-classification multi-layer neural network.

9. The test environment equivalence quantification method based on graph similarity measurement according to claim 1, characterized in that: The weighted calculation in step 4 includes: (1) Obtain the full set of nodes in the actual and equivalent environment knowledge graphs, and then assign weights to the nodes in the full set, thereby affecting the final calculation result of the node-level similarity matrix obtained in step 3; (2) The node-level similarity matrix is ​​pooled using the pyramid pooling layer SSP. After the SSP output, the cascaded convolutional neural network calculates the node-level similarity result. The convolutional neural network adopts a general binary classification multi-layer convolutional neural network, and the confidence of the similarity judgment is the equivalent quantitative result of the node level.

10. A test environment equivalence quantitative calculation system based on graph similarity measurement according to any one of claims 1 to 9, characterized in that: include: The test environment data acquisition module is used to collect multi-dimensional data of the simulation environment and the actual installation environment; The environment detection conversion module uses the collected data to build a knowledge graph instance corresponding to the environment; The similarity calculation module performs similarity calculation on the knowledge graph based on the graph similarity calculation method; the weighted calculation module performs weighted calculation on the similarity calculation results.

Images