A test environment equivalence quantification method and system based on graph similarity measure

Abstract

The present application belongs to but is not limited to the technical field of information security, and discloses a test environment equivalence quantification method and system based on graph similarity measurement, which uses a test environment data acquisition module to perform multidimensional data acquisition on a simulation environment and a real installation environment respectively; uses an environment detection conversion module to construct an environment corresponding knowledge graph instance using the collected data; performs similarity calculation on the knowledge graph based on a graph similarity calculation method; and performs weighted calculation on the similarity calculation result. The calculation method comprehensively considers global and local features between different environments, has good extensibility in the calculation process, can provide reasonable support for test environment equivalence judgment, and solves the problem of dependence on supervisor judgment and lack of quantitative description in the existing test work.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to a test environment equivalence quantification method and system based on graph similarity measurement. BACKGROUND

[0002] There are cases of equivalent environment-based network security SY implementation. In this case, the equivalence calculation and judgment between the simulation environment and the actual implementation environment are an important part of network security SY work, which involves SY personnel verifying whether a specific simulation environment can accurately simulate the actual implementation system or process, i.e., whether the simulation system accurately reflects the behavior and characteristics of the actual implementation system under the same input.

[0003] Currently, the management and guarantee of test environment equivalence are mainly based on the functional structure similarity principle or output result difference principle between simulation models and simulation objects, among which the former is more commonly used. A common approach is that the responsible unit of the equipment being tested simplifies and abstracts the spatial sequence structure (spatial arrangement, combination, and contact method) and functional sequence structure (various functions exhibited by system elements in the interaction process) of the simulated object to obtain an equivalent environment, and then experts judge whether the simulation environment can achieve equivalence and the acceptance of the results after the subsequent SY subject implementation according to the SY purpose.

[0004] The existing technology has the following technical problems in the test environment comparison method:

[0005] 1. Insufficient accuracy

[0006] Traditional test environment comparison methods often rely on simple numerical calculations or manual analysis, which cannot fully process complex environment data, resulting in insufficient accuracy of the comparison results. Traditional methods have limited processing capacity for multi-dimensional and heterogeneous data, and cannot fully reflect the subtle differences between environments.

[0007] 2. Insufficient data fusion

[0008] Existing technologies usually cannot effectively fuse data types from different tools or sources (such as assets, topology, vulnerabilities, source code defects, etc.), so that the relevance and integrity between different data cannot be fully utilized, affecting the effectiveness and accuracy of the overall comparison.

[0009] 3. Limitations of environment comparison

[0010] Traditional methods have difficulty in adapting to the diversity of environment data types and scales, especially in complex environments. Existing technologies often cannot effectively capture all important information or find potential risks and abnormalities in the environment.

[0011] 4. Lack of intelligent analysis capability

[0012] Many existing methods rely on manual analysis and rule-based processing, lacking intelligent data processing capabilities and failing to automate environmental similarity quantification. Traditional methods cannot fully utilize deep learning techniques for data feature extraction and dynamic processing, resulting in low levels of environmental equivalence quantification intelligence.

[0013] 5. Low computational efficiency

[0014] Existing methods often use static, computationally intensive algorithms, resulting in low efficiency in large-scale data processing. Especially when the amount of environmental data is large, traditional methods take too long to process, making it difficult to meet the needs of real-time processing and dynamic analysis.

[0015] These problems lead to the limitations of traditional test environment comparison methods in complex environmental data processing and similarity quantification, affecting the comprehensiveness, accuracy, and efficiency of environmental comparison. SUMMARY

[0016] To address the problems of existing technologies, the present application provides a test environment equivalence quantification method and system based on graph similarity measurement, providing a calculation method for quantifying the similarity between simulated and actual environments for network security personnel.

[0017] The present application is implemented as follows: a test environment equivalence quantification method based on graph similarity measurement, comprising the following steps:

[0018] Step one, use the test environment data acquisition module to collect multi-dimensional data from the simulation environment and the actual environment respectively;

[0019] Step two, use the environment detection conversion module to construct the corresponding knowledge graph instance of the environment using the collected data;

[0020] Step three, calculate the similarity of the knowledge graph based on the graph similarity calculation method;

[0021] Step four, weighted calculation of the similarity calculation result.

[0022] Further, the test environment data acquisition module in step one includes the same type, configuration of asset scanning tools, security baseline checking tools, vulnerability scanning tools and penetration testing tools, and the collected data includes asset, topology, vulnerability, source code defect, backdoor and other data; the scanning results obtained in step one are all structured data. Optionally, in the absence of actual environment conditions, historical data obtained from other projects can be used as the basis for subsequent graph data establishment and calculation.

[0023] Further, the knowledge graph instance construction in step two includes: extracting entities and attributes from data according to a preset knowledge graph structure; constructing a knowledge graph instance while receiving data information in the threat intelligence knowledge base, and correlating and expanding the data collected in step one.

[0024] Further, the knowledge graph similarity in step three adopts node features (local) and global feature data; the similarity calculation includes:

[0025] (1) obtaining node feature vectors by using an embedding model for the input knowledge graph,

[0026] (2) updating the node vectors by using a graph convolutional neural network (GCN), and the updated node feature vectors encode the attributes of each node and the surrounding structure information;

[0027] (3) performing pairwise similarity judgment on the nodes of different knowledge graphs to obtain a node-level similarity matrix.

[0028] Further, the nodes and attributes in the knowledge graph are vectorized using a Word2Vec model, and a Bert model is cascaded after the output of the Word2Vec model, which is used for a second round of embedding of variable-length input to obtain fixed-length vector representation;

[0029] The GCN aggregates the neighbor features of each node to update the representation of the node. Specifically, for each node, its new representation is calculated by weighted sum of the features of its neighbor nodes. The specific calculation is as follows:

[0030]

[0031] In the formula, N(n) is the set of adjacent nodes of node n, d n , d m are the degrees (sum of out-degree and in-degree) of n and m respectively, is the weight matrix of the lth layer, and sigma is the activation function, which adopts ReLu function as the activation function.

[0032] Further, the requirement for the number of convolution layers in the knowledge graph: when the number of nodes in the knowledge graph is in the range of [0, 100], the number of graph convolution layers is not less than 4 layers; when the number of nodes is in the range of [100-1000], the number of graph convolution layers is not less than 6 layers, and when the number of nodes is more than 1000, the number of graph convolution layers is equal to the number of nodes in the longest path in the graph.

[0033] Further, after completing the multi-layer graph convolution operation, a new set of node quantization results v topo is obtained, which contains node topology information; the pre-trained Bert model is used to obtain v topoThe embedding representation is performed to obtain the global expression h of the knowledge graph corresponding to each environment, and the h of the implementation environment and the equivalent environment is input into a multi-layer convolutional neural network, which adopts a general binary classification network, that is, whether the input two vectors are similar is judged, and the confidence degree of the similar judgment in the binary classification result is the global similarity result, which always falls in the interval [0, 1].

[0034] Further, according to the v topo In addition, the node level similarity matrix is calculated, the node number of each knowledge graph is n and m respectively, that is, an (n, m) dimensional matrix can be constructed, the value in any position of the matrix represents the similarity between the two nodes in the corresponding dimension, and the node similarity calculation is as follows,

[0035]

[0036] In the formula, The matrix constructed is represented by f, and f represents the multi-layer neural network for the v topo The similarity calculation is performed, and f also uses a general binary classification multi-layer neural network.

[0037] Further, the weighted calculation in step four includes:

[0038] (1) obtaining the full set of nodes in the implementation and equivalent environment knowledge graph, then assigning weights to the nodes in the full set, thereby affecting the final calculation result of the node level similarity matrix obtained in step three;

[0039] (2) using a pyramid pooling layer (SSP) to pool the node level similarity matrix, and the SSP cascades a convolutional neural network to calculate the node level similarity result after output, and the convolutional neural network adopts a general binary classification multi-layer convolutional neural network, and the confidence degree of the similarity judgment is the quantization result of the node level equivalence.

[0040] Another object of the present application is to provide a test environment equivalence quantization calculation system based on graph similarity measurement of a test environment equivalence quantization method based on graph similarity measurement, comprising:

[0041] The test environment data acquisition module is used for multi-dimensional data acquisition of the simulation environment and the implementation environment respectively;

[0042] The environment detection conversion module constructs the knowledge graph instance corresponding to the environment by using the collected data.

[0043] The similarity calculation module calculates the similarity of the knowledge graph based on the graph similarity calculation method.

[0044] The weighting calculation module performs weighted calculation on the similarity calculation result.

[0045] In combination with the technical solutions and the technical problems solved above, the technical solutions to be protected by the application have the following advantages and positive effects:

[0046] Firstly, the application solves the problem that the environmental equivalence judgment in the existing test work depends on the judgment of the supervisor and lacks quantitative description. The calculation method comprehensively considers the global and local characteristics between different environments, and the expansibility of the calculation process is good, which can provide reasonable support for the test environmental equivalence judgment.

[0047] The working principle of the method starts from multi-dimensional collection of test environment data. Through the test environment data collection module, data collection is performed on the simulation environment and the installation environment respectively. The collection tools include asset scanning tools, security baseline checking tools, vulnerability scanning tools and penetration testing tools, and the collected data types cover asset, topology, vulnerability, source code defect, backdoor and other information. These data are standardized and stored in a structured data form, providing a basis for subsequent knowledge graph construction.

[0048] According to the collected structured data, data processing is performed using a preset knowledge graph structure, including extracting entities and attributes. Each knowledge graph instance represents the overall situation of a test environment, and the nodes represent key entities such as assets, vulnerabilities and topology relationships, and the edges represent the relationships between entities. In addition, to improve the completeness and relevance of the data, the system obtains additional information from a threat intelligence knowledge base and associates it with the collected data to generate more comprehensive knowledge graph instances.

[0049] After the construction of the knowledge graph instance, the Word2Vec model is used to vectorize each node and its attributes in the knowledge graph. The Word2Vec model generates feature vectors by learning the context information of nodes and attributes, capturing their semantic features. To further improve the embedding quality, the BERT model is used for secondary embedding of the variable-length input after vectorization, outputting a fixed-length vector representation. The node feature vector generated in this stage contains both semantic information and consistency in high-dimensional space.

[0050] Based on the vectorization of the nodes, the graph convolutional neural network (GCN) is used to update the node features. The GCN aggregates the neighbor node features of each node to encode the attributes and local structure information of the node.

[0051] Based on the feature vectors updated by the GCN, the system calculates the similarity between the nodes of the knowledge graphs of the simulation environment and the installation environment, generating a node-level similarity matrix. Each element in the matrix represents the semantic similarity and structural similarity between the nodes in the two graphs. The similarity is calculated based on the cosine similarity or Euclidean distance between the node feature vectors. The node-level similarity matrix provides a basis for subsequent global similarity calculation.

[0052] The system further considers the global features of the knowledge graph based on node similarity, including the distribution of nodes, the density of edges, and the topology structure, etc. Through weighted calculation, the local and global similarity results are fused into the final similarity value, measuring the overall similarity of two test environments in data semantics and structure. This result is used to quantify the equivalence of simulation environment and installation environment.

[0053] To ensure the accuracy of similarity calculation, the method dynamically adjusts the number of graph convolution layers according to the number of nodes in the knowledge graph. When the number of nodes is small (such as less than 100), 4 layers of convolution are used; when the number of nodes increases to 100-1000, 6 layers of convolution are used; when the number of nodes exceeds 1000, the number of convolution layers is based on the number of nodes in the longest path. This optimization strategy ensures the balance between information propagation depth and computational efficiency.

[0054] The final similarity value is output in a visual form, such as a heat map or a similarity matrix, representing the equivalence between two test environments. This result can be used for simulation environment design verification, installation environment safety evaluation, and optimization adjustment of test environment. The accurate quantification of similarity results provides a scientific basis for performance comparison and migration between different environments.

[0055] Secondly, the test environment equivalence quantification method based on graph similarity measurement provided by the present application aims to solve the problems of insufficient accuracy and insufficient fusion processing of different environment data types in traditional test environment comparison methods. This method can effectively improve the accuracy and intelligent level of test environment equivalence quantification by constructing a graph-based knowledge structure and combining deep learning technologies such as graph convolutional neural network (GCN), Word2Vec, and Bert model, solving the limitations of existing technologies, which is embodied in the following aspects:

[0056] 1. Accurate comparison of complex test environment data

[0057] Traditional test environment comparison methods often rely on simple numerical calculation or manual analysis, while the present application can effectively process heterogeneous data (such as assets, topology, vulnerabilities, source code defects, etc.) by converting test environment data into graph data structure, and accurately quantify the equivalence between different environments through graph similarity measurement calculation. In this way, it can more comprehensively capture and reflect the subtle differences between environments, avoiding the precision problems caused by the lack of multi-dimensional data fusion in traditional methods.

[0058] 2. Utilize deep learning to improve the automation and intelligence of environment equivalence calculation

[0059] The application of the graph convolutional neural network (GCN) and the multi-modal embedding model (such as the combination of Word2Vec and Bert model) of the present application significantly improves the intelligent level of the equivalence quantification of the test environment. Through the combined use of these deep learning models, the system can automatically perform feature extraction, node feature updating, and graph data fusion calculation, reducing manual intervention and improving processing efficiency and accuracy.

[0060] 3. Multi-level and comprehensive data fusion and optimization

[0061] Using the parallel embedding method combined with different levels of graph convolution operations, the present application can not only perform similarity calculation at the node level, but also perform overall comparison of environmental equivalence at the global level. Through this comprehensive processing method, different dimensions and complexities of data can be effectively fused, avoiding the limitation of traditional methods that can only handle single type of data.

[0062] 4. Flexibility and scalability

[0063] The method of the present application flexibly adjusts the computational complexity according to the data characteristics and scale of the actual environment by setting different numbers of graph convolution layers and network architectures. This makes the method efficient in small-scale environments and still maintains good performance in large-scale environments, adapting to different types and scales of test environments.

[0064] 5. Improve environmental monitoring and security protection capability

[0065] Due to the ability to accurately quantify and compare the equivalence of test environments in real time, the technical solution of the present application has wide application potential in the fields of environmental monitoring, vulnerability management, and attack protection. It can help organizations better identify and respond to potential security risks, thereby optimizing security protection strategies and improving overall security levels.

[0066] In summary, by introducing a deep learning method based on graph similarity measurement, the present application not only improves the accuracy and efficiency of test environment equivalence quantification, but also introduces more data fusion, intelligent calculation, and automation processing capabilities based on traditional methods, thereby solving the technical bottlenecks of existing technologies in various practical applications and achieving significant technical progress. BRIEF DESCRIPTION OF DRAWINGS

[0067] Figure 1 is the flowchart of the test environment equivalence quantification method based on graph similarity measurement provided by the embodiment of the present application;

[0068] Figure 2 is the structural diagram of the test environment equivalence quantification calculation system based on graph similarity measurement provided by the embodiment of the present application;

[0069] Figure 3 is a schematic diagram of a data transfer transformation process provided by an embodiment of the present application. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0071] The working principle of the method starts from the multi-dimensional collection of test environment data. Through the test environment data collection module, data is collected for the simulation environment and the installation environment respectively. The collection tools include asset scanning tools, security baseline checking tools, vulnerability scanning tools and penetration testing tools, and the collected data types cover asset, topology, vulnerability, source code defect, backdoor and other information. These data are standardized and stored in structured data form, providing a basis for subsequent knowledge graph construction.

[0072] According to the collected structured data, data processing is performed using a preset knowledge graph structure, including extracting entities and attributes. Each knowledge graph instance represents the overall picture of a test environment, with nodes representing key entities such as assets, vulnerabilities and topology relationships, and edges representing the relationships between entities. In addition, to improve the completeness and relevance of the data, the system will obtain additional information from a threat intelligence knowledge base and associate it with the collected data to generate more comprehensive knowledge graph instances.

[0073] After the construction of the knowledge graph instance, the Word2Vec model is used to vectorize each node and its attributes in the knowledge graph. The Word2Vec model generates feature vectors by learning the context information of nodes and attributes, capturing their semantic features. To further improve the embedding quality, the vectorization is followed by the BERT model, which performs secondary embedding on variable-length input and outputs fixed-length vector representation. The node feature vector generated in this stage contains both semantic information and consistency in high-dimensional space.

[0074] Based on the node vectorization, the graph convolutional neural network (GCN) is used to update the node features. GCN encodes the attributes and local structure information of nodes by aggregating the features of neighboring nodes.

[0075] Based on the GCN updated feature vector, the system calculates the similarity between nodes of the knowledge graph of the simulation environment and the installation environment, generating a node-level similarity matrix. Each element in the matrix represents the semantic similarity and structural similarity between nodes in the two graphs. The similarity is calculated based on the cosine similarity or Euclidean distance between node feature vectors. The node-level similarity matrix provides a basis for subsequent global similarity calculation.

[0076] The system further considers global features of the knowledge graph based on node similarity, including node distribution, edge density, and topology structure, etc. The local and global similarity results are fused into the final similarity value through weighted calculation, measuring the overall similarity of two test environments in data semantics and structure. This result is used to quantify the equivalence of simulation environment and installation environment.

[0077] To ensure the accuracy of similarity calculation, the method dynamically adjusts the number of graph convolution layers according to the number of nodes in the knowledge graph. When the number of nodes is small (such as less than 100), 4 layers of convolution are used; when the number of nodes increases to 100-1000, 6 layers of convolution are used; when the number of nodes exceeds 1000, the number of convolution layers is based on the number of nodes in the longest path. This optimization strategy ensures the balance between information propagation depth and calculation efficiency.

[0078] The final similarity value is output in a visual form, such as a heat map or a similarity matrix, representing the equivalence between two test environments. This result can be used for simulation environment design verification, installation environment safety evaluation, and test environment optimization adjustment. The accurate quantification of similarity results provides a scientific basis for performance comparison and migration between different environments.

[0079] As shown in Figure 1 The embodiment of the present application provides a test environment equivalence quantification method based on graph similarity measurement, which includes the following steps:

[0080] Step one, using the test environment data acquisition module to collect multi-dimensional data of simulation environment and installation environment respectively;

[0081] Step two, using the environment detection conversion module to construct the corresponding knowledge graph instance of the environment using the collected data;

[0082] Step three, similarity calculation of knowledge graph based on graph similarity calculation method;

[0083] Step four, weighted calculation of similarity calculation result.

[0084] The working principle of the test environment equivalence quantification method based on graph similarity measurement provided by the embodiment of the present application is as follows:

[0085] 1. Test environment data acquisition

[0086] Firstly, the experimental environment data collection module is used to collect multi-dimensional data from the simulation environment and the installed environment. The dimensions of data collection include but are not limited to asset allocation, topology, vulnerabilities, source code defects, etc. This process collects key data in different environments through various scanning tools and inspection tools such as asset scanning tools, security baseline inspection tools, vulnerability scanning tools, etc., and converts these data into structured information, providing a basis for subsequent graph construction and similarity calculation.

[0087] 2. Constructing knowledge graph instances

[0088] In step two, the environment detection conversion module is used to process the collected data and construct corresponding knowledge graph instances. The knowledge graph structure can be designed according to pre-set standards, mainly including nodes (representing different entities such as system components, vulnerabilities, assets, etc.) and edges (representing the relationships between these entities). The key to this step is to effectively extract entities, assign attributes, and represent relationships from the original data, and through the combination of environment data and threat intelligence, to expand the information quantity of the graph instance, thereby improving the completeness and accuracy of the graph.

[0089] 3. Graph similarity calculation

[0090] In step three, the constructed knowledge graph instances are calculated for similarity by the graph similarity calculation method. At this time, the similarity calculation method not only considers the characteristics of the nodes (such as node attributes, types, etc.), but also considers the structural relationships between the nodes (such as the connection and path information between the nodes). The purpose of similarity calculation is to judge the structural and content differences between the simulation environment and the installed environment, identify the similarity of the two in actual application, and provide a basis for subsequent equivalence evaluation.

[0091] 4. Weighted calculation

[0092] In step four, the graph similarity calculation results obtained in step three are weighted. Different environmental characteristics may have different influences on the final equivalence quantification, so it is necessary to adjust the weights of different characteristics through weighting strategies. Weighted calculation can flexibly adjust the contribution of each data dimension (such as assets, topology, vulnerabilities, etc.) according to actual needs, ensuring that the final similarity score can truly reflect the equivalence of the simulation environment and the installed environment.

[0093] 5. Optimization and evaluation

[0094] After obtaining the weighted similarity calculation result, the application can further perform optimization analysis to identify important factors that may affect the equivalence of the test environment, and adjust according to the actual application scenario. For example, in different industries and different application fields, some environmental characteristics may be more critical than others. By optimizing the weighting strategy, the equivalence between different environments can be more accurately quantified.

[0095] 6. Generating an equivalence quantification report

[0096] Finally, the test environment equivalence quantification method based on graph similarity measurement of the application can generate a detailed equivalence quantification report. The report contains the similarity and difference between the simulation environment and the installation environment in various dimensions, helping engineers better understand the environmental differences during testing, and providing decision support for environmental matching and optimization.

[0097] Through this process, the application can accurately and intelligently quantify the equivalence of different test environments, overcoming the limitations of traditional methods and providing more comprehensive and reliable environmental comparison analysis results.

[0098] Further, the test environment data collection module in step one includes asset scanning tools, security baseline checking tools, vulnerability scanning tools, and penetration testing tools of the same type and configuration, and the collected data includes asset, topology, vulnerability, source code defect, backdoor, etc. The scanning results obtained in step one are all structured data. Alternatively, in the absence of an installation environment, historical data obtained from other projects can be used as the basis for subsequent graph data establishment and calculation.

[0099] Further, the knowledge graph instance construction in step two includes extracting entities and attributes from the data according to the pre-set knowledge graph structure; while constructing the knowledge graph instance, receiving data information from the threat intelligence knowledge base, and correlating and expanding the data collected in step one.

[0100] Further, in step three, the knowledge graph similarity uses node features (local) and global feature data; the similarity calculation includes:

[0101] (1) obtaining node feature vectors using embedding (Embedding) model for the input knowledge graph,

[0102] (2) updating the node vectors using graph convolutional neural network (GCN), the updated node feature vectors encode the attributes of each node and its surrounding structure information;

[0103] (3) performing pairwise similarity judgment on the nodes of different knowledge graphs to obtain a node-level similarity matrix.

[0104] Further, the weighting calculation in step four includes:

[0105] (1) Obtain the full set of nodes in the implementation and equivalent environment knowledge graph, and then assign weights to the nodes in the full set, thereby affecting the final calculation result of the node-level similarity matrix obtained in step three;

[0106] (2) Pooling the node-level similarity matrix using a pyramid pooling layer (SSP), and the SSP outputs are concatenated with a convolutional neural network to calculate the node-level similarity result, which is a general binary classification multi-layer convolutional neural network, and the confidence of the similarity judgment is the quantization result of the node-level equivalence.

[0107] As Figure 2 shown, the embodiment of the present application provides a test environment equivalence quantification calculation system based on graph similarity measurement for a test environment equivalence quantification method based on graph similarity measurement, comprising:

[0108] A test environment data acquisition module is used to acquire multi-dimensional data of the simulation environment and the implementation environment respectively.

[0109] An environment detection conversion module is used to construct the corresponding knowledge graph instance of the environment by using the acquired data.

[0110] A similarity calculation module is used to calculate the similarity of the knowledge graph based on the graph similarity calculation method.

[0111] A weighting calculation module is used to calculate the similarity calculation result.

[0112] Embodiment 1

[0113] S1, using the test environment data acquisition module to acquire multi-dimensional data of the simulation environment and the implementation environment respectively.

[0114] When the test personnel face the implementation environment and the equivalent environment, first use the asset scanning tool to detect the target environment, for example, use the general asset detection tool, connect the tool to different environments and input the corresponding scanning network segment, and obtain the information list of the IP address, MAC address, belonging area, operating system, host name, etc. of the assets in different environments.

[0115] Use the vulnerability scanning tool to scan the target environment, connect the tool to different environments, and configure the target address / network segment, weak password dictionary, etc. required by the host weak password scanning tool. After the test personnel complete the information input required for the scanning task, each vulnerability scanning engine starts to send different types of messages to the target system in advance, and analyzes and forms the related results according to the returned information.

[0116] The target and the environment are probed by using a security baseline checking tool, specifically, the tool is connected to different environments, the same checking item content is used, and information of a system on a host, middleware, a database, account configuration, security software and the like in the target environment is obtained.

[0117] S2, using an environment detection conversion module to construct an environment corresponding knowledge graph instance by using the collected data;

[0118] According to the preset knowledge graph structure, the data is extracted entity and attribute. In addition, in order to improve the accuracy of the subsequent fusion step, while constructing the knowledge graph instance, receiving the data information in the threat intelligence knowledge base, the data collected in step S1 is associated and expanded, the expansion operation is essentially amplifying the difference and strengthening the same part, specifically, when there are same devices or software in the equivalent environment and the installed environment, both knowledge graphs will be expanded; on the contrary, when only the installed environment has a certain device, only the knowledge graph of the installed environment is expanded, and the difference between the two is further expanded.

[0119] S3, similarity calculation of the knowledge graph based on a graph similarity calculation method;

[0120] In the application, the knowledge graph similarity adopts node features (local) and global feature data, first, the input knowledge graph is converted into a node feature vector by using a graph neural convolution network (GCN), and the node feature vector encodes the attribute of each node and the surrounding structure information.

[0121] Specifically, the nodes and attributes in the knowledge graph are vectorized by using a common Word2Vec model. Considering that the number of attributes of different nodes is inconsistent, the length of the vectorization result is inconsistent, a Bert model is cascaded after the Word2Vec model output, which is used for second-round embedding of the variable-length input to obtain a fixed-length vector representation.

[0122] The neighbor features of each node are aggregated by using the GCN to update the representation of the node, specifically, for each node n, the new representation is calculated by weighting and summing the features of the neighbor nodes, and the specific calculation is shown in the following formula:

[0123]

[0124] In the above formula, N(n) is a set of adjacent nodes of node n, d n , d m are the degrees (sum of out-degree and in-degree) of n and m respectively, is the weight matrix of the first layer, and is the activation function, and a common ReLu function is used as the activation function. The above node update is composed of multiple convolution layers, and in the present application, in order to ensure that the topological structure information in the knowledge graph is fully quantized and learned, the following requirements are required for the number of convolution layers: when the number of nodes in the knowledge graph is in the range of [0, 100], the number of graph convolution layers is not less than 4 layers; when the number of nodes is in the range of [100-1000], the number of graph convolution layers is not less than 6 layers; and when the number of nodes is more than 1000, the number of graph convolution layers is equal to the number of nodes in the longest path in the graph.

[0125] After completing the multi-layer graph convolution operation, a new set of node quantization results v topo containing node topological information is obtained. topo The pre-trained Bert model is used to perform embedding representation on each knowledge graph v topo to obtain the global expression h of each environment corresponding knowledge graph, and the data flow conversion and dimension change are as shown in Figure 3 The h of the implementation environment and the equivalent environment are simultaneously input into a multi-layer convolutional neural network, which uses a general binary classification network, that is, it is determined whether the input two vectors are similar, and the confidence degree of the determination as similar in the binary classification result is the global similarity result, which always falls in the interval [0, 1].

[0126] According to the v topo of the implementation environment and the equivalent environment, a node-level similarity matrix is additionally calculated, specifically, the number of nodes of each knowledge graph is n and m respectively, that is, an (n, m) dimensional matrix can be constructed, and the value in any position of the matrix represents the similarity between the two nodes in the corresponding dimension. The similarity between nodes is calculated as follows:

[0127]

[0128] represent the constructed matrix, and f represents the similarity calculation of the v topo of different environments by the multi-layer neural network, and f also uses a general binary classification multi-layer neural network.

[0129] S4, weighted calculation is performed on the similarity calculation result;

[0130] The experimental personnel can assign weights to the node similarity matrix obtained in S3 according to the actual situation, which can affect the similarity results of the implementation environment and the equivalent environment. By assigning a weight value of 0.1 to the host device A in the equivalent environment, the similarity obtained by the corresponding row or column of the device is reduced.

[0131] The similarity matrix at the node level is pooled using a pyramid pooling layer (SSP). The SSP is mainly used to solve the problem of inputting similarity matrices of different sizes. The similarity results at the node level are calculated by cascading the convolutional neural network after the output of the SSP. The convolutional neural network can be a general binary classification multi-layer convolutional neural network. The confidence of the similarity judgment is also used as the equivalent quantitative result at the node level.

[0132] It should be noted that the embodiments of the present application can be realized by hardware, software or a combination of software and hardware. The hardware part can be realized by special logic; the software part can be stored in a memory and executed by a suitable instruction execution system, such as a microprocessor or a specially designed hardware. Those skilled in the art can understand that the above-mentioned devices and methods can be realized by computer executable instructions and / or included in processor control code, such as carrier media, such as magnetic disk, CD or DVD-ROM, programmable memory, such as read-only memory (firmware), or data carrier, such as optical or electronic signal carrier. The device and its modules of the present application can be realized by hardware circuit, such as ultra-large scale integrated circuit or gate array, semiconductor, such as logic chip, transistor, etc., or programmable hardware device, such as field programmable gate array, programmable logic device, etc., or by software executed by various types of processors, or by a combination of the above-mentioned hardware circuit and software, such as firmware.

[0133] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any modification, equivalent replacement and improvement within the technical range disclosed by the present application, which is made by those skilled in the art in the spirit and principle of the present application, should be covered within the protection scope of the present application.

Claims

1. A method for quantifying the equivalence of experimental environments based on graph similarity measurement, characterized in that, Comprise the following steps: Step one, using the test environment data acquisition module to simulate the environment, the installation environment is collected respectively multidimensional data; Step two, using the environment detection conversion module using the collected data to build the corresponding knowledge graph instance of the environment; Step three, based on the graph similarity calculation method for similarity calculation of knowledge graph; Step four, the similarity calculation result is weighted calculation; The knowledge graph similarity in step three adopts node feature and global feature data; The similarity calculation includes: (1) the input knowledge graph is obtained by using embedding model node feature vector, (2) the node vector is updated by using graph convolutional neural network GCN, and the updated node feature vector encodes the attribute of each node and its surrounding structure information; (3) the node of different knowledge graph is judged for similarity, and the node level similarity matrix is obtained; The nodes and attributes in the knowledge graph are vectorized using the Word2Vec model, and the Bert model is cascaded after the output of the Word2Vec model, which is used for the second round of embedding of the variable length input to obtain the fixed length vector representation; The neighbor features of each node are aggregated by using GCN to update the representation of the node, and specifically for each node, its new representation is calculated by weighting and summing the features of its neighbor nodes, and the specific calculation is shown in the following formula: ； In the formula, N(n) is a set of adjacent nodes of node n, d n , d m are degrees (sum of out-degree and in-degree) of n and m respectively, is a weight matrix of the lth layer, and σ is an activation function, and a ReLu function is used as the activation function. The requirement of the number of convolution layers in the knowledge graph: when the number of nodes in the knowledge graph is in the range of [0, 100], the number of graph convolution layers is not less than 4 layers; when the number of nodes is in the range of [100-1000], the number of graph convolution layers is not less than 6 layers, and when the number of nodes is more than 1000, the number of graph convolution layers is equal to the number of nodes in the longest path in the graph; After completing the multi-layer graph convolution operation, a new set of node quantization results v of each knowledge graph is obtained topo , which contains node topology information; using a pre-trained Bert model to perform embedding representation on each knowledge graph v topo to obtain the global expression h of the corresponding knowledge graph of each environment, inputting the h of the implementation environment and the equivalent environment into a multi-layer convolutional neural network at the same time, judging whether the input two vectors are similar, and taking the confidence degree of judging as the global similarity result, the value of the global similarity result falls within the interval [0, 1]; According to the installation environment and the equivalent environment, v topo In addition, a node-level similarity matrix of each knowledge graph is calculated, and the number of nodes of each knowledge graph is n and m respectively, that is, an (n, m)-dimensional matrix is constructed, and the value at any position in the matrix represents the similarity between two nodes in the corresponding dimension. The similarity between nodes is calculated as follows, ； In the formula, a matrix representing the configuration, f represents the multi-layer neural network for different environments v topo Similarity calculation is performed; The weighted calculation in step four includes: (1) obtaining the full set of nodes in the installation and equivalent environment knowledge graph, and then assigning weights to the nodes in the full set, so as to affect the final calculation result of the node level similarity matrix obtained in step three; (2) using the pyramid pooling layer SSP to pool the node level similarity matrix, and cascading the convolutional neural network after the SSP output to calculate the node level similarity result, so as to judge the confidence of the similar as the quantization result of the node level equivalence.

2. The test environment equivalency quantification method based on graph similarity metrics of claim 1, wherein, The test environment data acquisition module in step one includes the same type, configuration of asset scanning tool, security baseline checking tool, vulnerability scanning tool and penetration testing tool, and the collected data includes asset, topology, vulnerability, source code defect and backdoor data; the scanning result obtained in step one is structured data.

3. The test environment equivalence quantification method based on graph similarity metrics of claim 1, wherein, The knowledge graph instance construction in step two includes: extracting entities and attributes according to the preset knowledge graph structure; while constructing the knowledge graph instance, receiving data information in the threat intelligence knowledge base, and associating and expanding the data collected in step one.

4. A graph similarity measure based test environment equivalence quantification computing system of the graph similarity measure based test environment equivalence quantification method according to any one of claims 1 to 3, characterized by, Comprise: Test environment data acquisition module, for collecting multidimensional data of simulation environment and installation environment respectively; Environment detection conversion module, using the collected data to build the corresponding knowledge graph instance of the environment; Similarity calculation module, based on the graph similarity calculation method for similarity calculation of knowledge graph; weighting calculation module, for weighted calculation of similarity calculation result.

Images