Network security situation awareness prediction method based on knowledge graph

Abstract

The invention discloses a network security situation awareness prediction method based on a knowledge graph, comprising: acquiring heterogeneous data of network security, the heterogeneous data comprising device information and vulnerability information; performing entity data and attribute data extraction on the heterogeneous data through rule matching and a machine learning model; processing the entity data through a knowledge representation learning method to obtain semantic relationships, the semantic relationships including a hierarchical relationship, an association relationship, a causal relationship and a time sequence relationship; constructing a network security knowledge graph according to the entity data, the attribute data and the semantic relationship; and obtaining multi-dimensional attribute feature information, fusing the network security knowledge graph and the multi-dimensional attribute information to obtain a situation feature representation, and predicting the situation feature representation to obtain a network security situation awareness prediction result.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to a network security situation awareness prediction method based on knowledge graph. Background Art

[0002] Network security situation awareness prediction is a complex process involving multiple links and technical difficulties. First, in the entity extraction stage, how to accurately identify and extract entities related to network security from massive heterogeneous data is a major challenge. The formats and qualities of different data sources vary greatly, the data noise is large, and the entity boundary is fuzzy, which brings great difficulty to entity extraction. Secondly, the extracted entities vary greatly in type and granularity, lack a unified semantic representation, and are not conducive to subsequent knowledge fusion. Third, the knowledge in the field of network security is intricate and involves multiple dimensions such as attack methods, vulnerabilities, and security incidents. Building a comprehensive and high-quality knowledge graph requires a lot of manpower investment and a huge workload. Finally, situation awareness prediction needs to consider factors such as the possibility and impact of attacks from multiple angles. Most of the existing models predict one aspect, lack comprehensive evaluation capabilities, and the predictive results are not very interpretable. In summary, how to build a multi-faceted network security situation awareness prediction method is a key issue that needs to be solved urgently. Summary of the invention

[0003] In order to solve the above technical problems, the present invention proposes a network security situation awareness prediction method based on knowledge graph to solve the problems existing in the above-mentioned prior art.

[0004] To achieve the above object, the present invention provides a network security situation awareness prediction method based on knowledge graph, comprising:

[0005] Acquire heterogeneous data on network security, wherein the heterogeneous data includes device information and vulnerability information;

[0006] Extracting entity data and attribute data from the heterogeneous data through rule matching and machine learning models;

[0007] Processing the entity data by a knowledge representation learning method to obtain semantic relationships, wherein the semantic relationships include hierarchical relationships, association relationships, causal relationships, and temporal relationships;

[0008] Constructing a network security knowledge graph based on the entity data, attribute data and semantic relationships;

[0009] Acquire multi-dimensional attribute feature information, fuse the network security knowledge graph and the multi-dimensional attribute information to obtain a situation feature representation, predict the situation feature representation, and obtain a network security situation awareness prediction result.

[0010] Optionally, obtaining heterogeneous data on network security includes:

[0011] Preprocess heterogeneous data, where the preprocessing process includes data cleaning, filtering, and normalization.

[0012] Optionally, the process of extracting entity data and attribute data from the heterogeneous data includes:

[0013] Building a rule base for entity recognition by a rule matching method, wherein the rules may include keywords and part-of-speech patterns of the entity;

[0014] Build entity extraction models and attribute extraction models based on machine learning models;

[0015] Matching the heterogeneous data through a rule base to obtain first entity data;

[0016] Processing the data except the first entity data in the heterogeneous data through the entity extraction model to obtain the second entity data;

[0017] The first entity data and the second entity data are identified through the attribute extraction model to obtain attribute data of the entity data.

[0018] Optionally, the process of processing the entity data by using the knowledge representation learning method includes:

[0019] Processing the entity data by a knowledge representation learning method, mapping the entity data into a low-dimensional semantic space, and obtaining a low-dimensional semantic vector representation of the entity;

[0020] Using a threshold judgment method to perform similarity judgment on the low-dimensional semantic vector representations of the entities to obtain the association relationship between the entities;

[0021] The relationship between different entities is identified through the semantic recognition model to obtain hierarchical relationships, causal relationships, and temporal relationships.

[0022] Optionally, the process of building a network security knowledge graph includes:

[0023] Use ontology building tools to set up an ontology model of the network security knowledge graph, where the ontology model includes entity types, entity attributes, and entity relationships;

[0024] Supplement and adjust the ontology model according to the entity data and attribute data, and map the semantic relationship to the ontology model to obtain an initial network security knowledge graph;

[0025] The data of the initial network security knowledge graph is fused through a knowledge fusion algorithm to obtain a network security knowledge graph.

[0026] Optionally, the process of obtaining multi-dimensional attribute feature information includes:

[0027] attacking multi-dimensional attribute information of entities from a network security knowledge graph, wherein the entity data includes attacking entities, wherein the multi-dimensional attribute information includes duration, attack traffic, and target port;

[0028] Entity data and association relationships associated with the attack entity are obtained, and multi-dimensional attribute information of the attack entity is fused with the entity data and association relationships associated with the attack entity to obtain multi-dimensional attribute feature information, wherein the fusion includes splicing processing.

[0029] Optionally, the process of predicting the situation feature representation includes:

[0030] The situation feature representation is predicted through a deep learning model to obtain a network security situation awareness prediction result.

[0031] Optionally, the deep learning model adopts a long short-term memory network.

[0032] Compared with the prior art, the present invention has the following advantages and technical effects:

[0033] The present invention discloses a network security situation awareness prediction method based on knowledge graph. In view of the noise and redundancy problems existing in massive heterogeneous data, the present invention improves data quality through data preprocessing, laying a foundation for entity extraction. On this basis, a multi-level entity recognition model is used to extract entity and attribute information, and the semantic relationship between entities is obtained through knowledge representation learning. Combined with expert knowledge, a network security knowledge graph covering multi-dimensional information such as entity type, attribute, and relationship is constructed. In situation awareness prediction, the present invention makes full use of the correlation relationship and causal dependency in the knowledge graph, combined with multi-dimensional features such as attack possibility and impact degree, to achieve accurate prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0035] Figure 1 It is a flowchart of a network security situation awareness prediction method based on a knowledge graph according to an embodiment of the present invention;

[0036] Figure 2 A simplified flowchart of a network security situation awareness prediction method based on a knowledge graph according to an embodiment of the present invention;

[0037] Figure 3This is another simplified schematic diagram of a network security situation awareness prediction method based on a knowledge graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0040] like Figure 1-3 In this embodiment, a network security situation awareness prediction system based on knowledge graph may specifically include:

[0041] S101. For massive heterogeneous data, remove noise and redundant information in the data through preprocessing operations such as data cleaning, filtering, and normalization, improve data quality, and lay the foundation for subsequent entity extraction.

[0042] For massive heterogeneous data, the original data set is obtained. According to the data characteristics, the corresponding data cleaning algorithm is used to denoise the data to obtain the first data set. For the first data set, redundant information in the data is removed by the data filtering algorithm to obtain the second data set. For the second data set, the data normalization algorithm is used to uniformly process heterogeneous data from different sources and formats to obtain a normalized third data set. According to the preset data quality evaluation indicators, the quality of the third data set is evaluated. If the quality meets the preset threshold, the third data set is used as the input for subsequent entity extraction, otherwise the first step is returned to re-data cleaning. For the qualified third data set, the named entity recognition algorithm is used to identify and extract the entities in the data set to obtain a candidate entity set. According to the preset entity evaluation rules, the candidate entity set is evaluated, and the entities that do not meet the requirements are filtered out to obtain the final target entity set. The target entity set is stored in the knowledge base for subsequent knowledge mining and application, completing the whole process of entity extraction.

[0043] Specifically, the massive heterogeneous data mentioned above refers to the device information and vulnerability information of different computing devices. The device information includes the device network port, model, and system version. The vulnerability information includes firewall log information, intrusion detection alarm information, vulnerability scanning results, vulnerability type, name, vulnerability specific information, impact range, impact degree, virus, attack entity, attack method, attack content, etc. The device information and vulnerability information mentioned above contain the type and corresponding detailed information of each data. Heterogeneous data is collected through data in related websites or libraries, device operation information, and other data.

[0044] Specifically, the processing of massive heterogeneous data first requires obtaining the original data set, which includes multi-source heterogeneous data such as device information and vulnerability information. The device information includes the device's network port information and network address information. These data may contain noise or erroneous information, such as typos, or repeated records of the same device at the same time, invalid links, etc. De-noising is performed through data cleaning algorithms, such as rule-based text error correction and statistical outlier detection. At the same time, the above content is tested for duplicate records at the same time, and the duplicate records are removed after detection to remove redundant data. The unified third data set is evaluated for quality through unified processing of unified text or unified format, and indicators such as completeness, accuracy, and consistency are set. If the data integrity is required to be no less than 95%, it needs to be cleaned again if it is not met. Good quality data is used as the data basis for the subsequent extraction of entities and attributes.

[0045] S102. In the entity extraction stage, rule matching, machine learning and other technologies are used to build a multi-level and multi-granular entity recognition model to extract entities and their attribute information from the preprocessed data.

[0046] According to business needs, determine the target entity type and granularity of entity extraction, such as attack method, etc., as well as the attribute type of the entity, such as script attack information, injection attack information, brute force cracking information, etc.

[0047] For ease of understanding, the above entities and attributes are explained: the entities and attributes in the knowledge graph are the basic components of the knowledge graph, and have different definitions and functions.

[0048] Entity: An entity is the basic unit in a knowledge graph and represents an object in the real world. An entity can be a specific physical object (such as "Apple", "Huangshan") or an abstract concept (such as "love", "economics"). Each entity has a unique identifier and a series of attributes that describe its characteristics. For example, for the entity "Apple", its attributes may include the date of establishment, founder, headquarters location, etc.

[0049] Attribute: An attribute is a description and supplement to an entity, providing detailed information about the entity. An attribute can be a feature or state of an entity, such as a person's date of birth, a company's founding year, etc. The existence of attributes enables the knowledge graph to describe entities more comprehensively and provide richer semantic information. For example, for the entity "Apple", its attributes may include founding date, founder, headquarters location, etc.

[0050] The role of entities and attributes: In the knowledge graph, the role of entities and attributes is crucial. Entities build the basic framework of the knowledge graph through their attributes and relationships, while attributes provide a detailed description of the entity, allowing the knowledge graph to more accurately reflect the complex relationships in the real world.

[0051] Collect and annotate relevant training data, pre-process the training data, such as word segmentation, part-of-speech tagging, named entity recognition, etc., to prepare for subsequent model training and train subsequent models. Word segmentation or key content extraction is to obtain specific detailed information, part-of-speech tagging is to mark the attributes of different data, and named entity recognition is to determine its entity information.

[0052] For different types of entities and attributes, the above heterogeneous data is segmented or fixed characters are intercepted as the input of the entity model, and the output of the entity recognition model is determined as the extracted entity information; the attribute extraction model takes the extracted entity as input and the corresponding attribute as output.

[0053] Use the rule matching method to build a rule base for entity recognition. The rule base includes keywords, part-of-speech patterns, etc. of the entity. Use machine learning algorithms, such as conditional random fields (CRF) and support vector machines (SVM), to train the entity recognition model. Use the preprocessed data as training samples to extract entity features, such as part-of-speech, contextual information, etc., and train recognition models of multiple granularities. In the entity extraction process, first use the rule matching method to quickly identify a part of the entities. For entities that cannot be identified by rule matching, use the machine learning model to make predictions to improve the recall rate of entity recognition. Extract attributes from the identified entities. Determine the attributes that need to be extracted based on the type of entity.

[0054] For attribute extraction, with the same model structure as above, a combination of rule matching and machine learning is used to build an attribute extraction model to extract attribute information from the context of the entity. The extraction results are post-processed, such as disambiguation, deduplication, formatting, etc., to obtain structured entity and attribute information. The extraction results are stored in the knowledge base for subsequent knowledge mining and application.

[0055] S103. Perform semantic representation learning and fusion on the extracted entities. Through knowledge representation learning methods, the entities are mapped to a low-dimensional semantic space to obtain semantic relationships between entities, including hierarchical relationships, association relationships, causal relationships, temporal relationships, etc.

[0056] For the extracted entities, the knowledge representation learning algorithm is used to map the entities to the pre-constructed low-dimensional semantic space to obtain the low-dimensional semantic vector representation of the entity. According to the vector representation of the entity in the low-dimensional semantic space, by calculating the similarity between the entity vectors, it is determined whether there is a semantic association relationship between the entities. If the similarity between the entity vectors is greater than the preset association threshold, it is determined that there is a semantic association relationship between these entities. For entities with semantic association relationships, the semantic recognition model is used to analyze their superior and subordinate relationships in the knowledge base to further determine whether there is a hierarchical relationship between the entities. According to the causal relationship and temporal relationship information of the entity in the knowledge base, the semantic recognition model or manual annotation is used to determine whether there is a causal relationship and temporal relationship between the associated entities. And the entity, semantic relationship, and entity are used as triple content for the subsequent knowledge graph construction data foundation. The semantic association relationship, hierarchical relationship, causal relationship, and temporal relationship between entities are integrated to construct a multi-relation entity semantic network, where the network is a graph structure network composed of semantic relationships and entities, realizing the multi-dimensional fusion representation of entity semantics. By using algorithms such as graph neural networks, representation learning is performed on multi-relational entity semantic networks to further optimize the semantic representation of entities and obtain low-dimensional feature vectors of entities that integrate multiple semantic relationships.

[0057] S104. Construct a network security knowledge graph based on the acquired entity semantic relationships. Use a human-machine combination approach, ontology construction tools and crowdsourcing platforms, organize security experts to participate in knowledge modeling and review, and ensure the accuracy and completeness of the constructed knowledge graph. The knowledge graph should cover multi-dimensional information such as entity types, attributes, and relationships.

[0058] Obtain entities and their semantic relationship data in the field of network security. Use ontology building tools to define the ontology model of the network security knowledge graph, including entity types, entity attributes, and entity relationships (semantic relationships). Through the crowdsourcing platform, organize network security experts to review and modify the ontology model to ensure the accuracy and completeness of the ontology model. According to the ontology model, map the preprocessed entity semantic relationship data to the knowledge graph to build a preliminary network security knowledge graph. Use the knowledge fusion algorithm to fuse the entities, attributes, and relationships in the knowledge graph to eliminate redundant and inconsistent information. Through the crowdsourcing platform, organize network security experts to manually review and correct the constructed knowledge graph to further improve the quality of the knowledge graph. Use the knowledge reasoning algorithm to mine and infer new entity relationships based on existing entity relationships to expand and enrich the content of the knowledge graph.

[0059] Specifically, when obtaining entity and semantic relationship data in the field of network security, the original data can be collected from professional websites, security reports, vulnerability libraries and other sources. For example, vulnerability information can be obtained from the National Information Security Vulnerability Sharing Platform, including vulnerability name, type, impact range, etc. When constructing the ontology model, entity types such as network attacks, vulnerabilities, and defense measures can be defined. Taking the vulnerability entity as an example, its attributes include vulnerability number, discovery time, hazard level, etc., and its relationships with other entities include "affecting" a certain system and "being used" in a certain attack. When organizing expert reviews through crowdsourcing platforms, experts can judge the rationality of entity types and relationships, such as whether the vulnerability classification is accurate and whether the hazard level assessment is appropriate. In the data mapping stage, the pre-processed data needs to be converted according to the specifications of the ontology model. For example, the original vulnerability data is converted into standard entity attributes, such as mapping the hazard level "high risk" to a unified value "4". When integrating knowledge, it is necessary to deal with the problem of inconsistent entity reference, such as identifying "buffer overflow" and "buffer out of bounds" as the same type of vulnerability. In the expert review stage, experts can focus on the correctness of entity relationships. For example, verify whether a vulnerability can actually lead to a certain attack, or whether a certain defense measure can really prevent a certain type of attack. This ensures that the relationships in the knowledge graph are accurate and reliable. In terms of knowledge reasoning, new relationships can be discovered based on existing relationships. For example, if it is found that vulnerability A may lead to attack B, and attack B may cause harm C, then it can be inferred that vulnerability A may cause harm C. For another example, if defense measure D can prevent attack B, it may also be used to prevent attacks that exploit vulnerability A. This kind of reasoning can expand the relationships of the knowledge graph and help discover potential security threats and defense solutions. Through these steps, an accurate and complete network security knowledge graph can be constructed to provide knowledge support for security analysis and defense. The entities and relationships in the knowledge graph can help understand the propagation path of security threats, predict possible attack methods, and formulate corresponding defense strategies.

[0060] The knowledge fusion algorithm is used to fuse entities, attributes, and relationships in the knowledge graph to eliminate redundant and inconsistent information:

[0061] Obtain the entity, attribute and relationship information in the knowledge graph, analyze the entity attributes and entity relationships, and determine whether there is redundancy or inconsistency. If there is redundancy or inconsistency, use the knowledge fusion algorithm to fuse the entity attributes and entity relationships to eliminate redundant and inconsistent information. After the fusion process, obtain the optimized entity attribute and entity relationship information, and update the relevant content in the knowledge graph. According to the optimized knowledge graph, obtain the association information between entities, build an entity association network, and improve the relevance and integrity of knowledge. Use the graph embedding algorithm to map the entities and relationships in the knowledge graph to a low-dimensional vector space to obtain the vector representation of entities and relationships. Through the vector representation, calculate the similarity between entities and relationships, judge the relevance of entities and relationships, and further optimize the quality of the knowledge graph. Based on the optimized knowledge graph, build a knowledge reasoning and knowledge question-answering system to improve the availability and practicality of knowledge and provide users with high-quality knowledge services.

[0062] Specifically, obtaining entity, attribute and relationship information in the knowledge graph is the basis for building a high-quality knowledge graph. For example, in the field of network security, entities may include viruses, vulnerabilities, attackers, etc., attributes may be the speed of virus propagation, the severity of vulnerabilities, and relationships may be the virus using vulnerabilities to attack. By analyzing this information, it can be determined whether there is redundancy or inconsistency. Suppose there are two entities "virus A" and "virus B" in the knowledge graph, and their attributes both contain "propagation speed", but the descriptions are inconsistent, one is "fast propagation" and the other is "medium-speed propagation". Through analysis, it is found that these two pieces of information come from different data sources and may have data inconsistency problems. At this time, the knowledge fusion algorithm, such as rule-based fusion or machine learning-based fusion, can be used to fuse these two attributes into a unified description, such as "medium-speed to fast propagation", thereby eliminating redundancy and inconsistency. After fusion processing, the optimized entity attribute and entity relationship information are obtained, and the relevant content in the knowledge graph is updated. For example, after fusion, the propagation speed attributes of virus A and virus B are unified, and the relevant entity and attribute information in the knowledge graph is also updated accordingly, ensuring the accuracy and consistency of knowledge. According to the optimized knowledge graph, the association information between entities is obtained and the entity association network is constructed. For example, through analysis, it is found that virus A not only uses vulnerability X to attack, but also has a close relationship with attacker Y. These association information are integrated to construct the association network of virus A, vulnerability X and attacker Y, which improves the relevance and completeness of knowledge. Using graph embedding algorithms, such as TransE or Node2Vec, the entities and relationships in the knowledge graph are mapped to a low-dimensional vector space. For example, virus A, vulnerability X and attacker Y are mapped to vector representations, and the correlation between them can be determined by calculating the cosine similarity between vectors. Assume that the vector similarity between virus A and virus B is 0.85, indicating that they have a high correlation and may be variants of the same virus. Through vector representation, the similarity between entities and relationships is calculated to further optimize the quality of the knowledge graph. For example, it is found that virus A and virus B are not only similar in propagation speed, but also have a high consistency in attack methods. They can be classified into the same category to enrich the content of the knowledge graph. Based on the optimized knowledge graph, a knowledge reasoning and knowledge question-answering system is constructed. For example, using the knowledge reasoning algorithm, it can be inferred that virus A may also use other unknown vulnerabilities to attack, and early warning can be given. The knowledge question-answering system can answer users' specific questions about the speed of virus transmission, attack methods, etc., and provide high-quality knowledge services. The purpose of the above steps is, first, to eliminate redundant and inconsistent information, ensure the accuracy of the knowledge graph, and avoid misleading users. Secondly, to build an entity association network, enhance the relevance of knowledge, and help users fully understand network security incidents. Furthermore, through graph embedding and similarity calculation, potential associations can be mined to enrich the content of the knowledge graph.Finally, we build a knowledge reasoning and question-answering system to improve the availability and practicality of knowledge and provide users with accurate and efficient knowledge services. Through these steps, the knowledge graph not only has a high degree of accuracy, relevance, and completeness, but also plays an important role in practical applications, such as security warnings and attack tracing, greatly improving network security protection capabilities. Each step is closely linked to each other, and together they build a high-quality, high-value network security knowledge graph.

[0063] S105. When making situational awareness predictions, make full use of the constructed network security knowledge graph to obtain the association relationship and causal dependency between entities as an important basis for prediction analysis. At the same time, comprehensively consider multiple factors such as the possibility of attack, impact, and attack frequency, construct a multi-dimensional feature representation, and combine the knowledge graph and feature representation for prediction analysis.

[0064] Obtain the constructed network security knowledge graph, extract the entity nodes and attribute information corresponding to the attack entity, and analyze the association and causal dependency between entities. For the attack entity in the knowledge graph, obtain data such as its occurrence probability, impact assessment, and historical attack frequency. Fusion of graph information such as entity association and causal dependency with numerical feature information such as attack probability, impact, and frequency to construct a multi-dimensional feature vector representation. Using a graph neural network model, the topological structure of the knowledge graph and entity features are combined, and the implicit representation of the entity is learned through node information propagation and aggregation. The implicit representation of the entity in the graph is spliced ​​with the multi-dimensional feature vector representation to form the final situation feature representation. Using the long short-term memory network LSTM model, multiple situation feature representations in the time series are used as input, and attack prediction is achieved by learning the time series evolution law of attack events. According to the output probability value of the LSTM model, the possibility of various attacks in the future is judged, and the situation awareness prediction results are generated to provide a basis for security defense decision-making.

[0065] Specifically, in the network security knowledge graph, multi-dimensional attribute information of attack entities can be extracted, such as the duration of distributed denial of service attacks, attack traffic, target ports and other features. By analyzing the association between entities, the attack link can be discovered. For example, after a Trojan program invades the system through a vulnerability, it steals data and launches external attacks to form a complete attack path. The probability assessment of attack entities can be obtained based on historical data statistics. For example, if a certain type of network scanning attack occurs an average of ten times per month in the past year, then its monthly probability of occurrence is 0.33. The degree of impact can be assessed from dimensions such as the number of affected systems and the losses caused, such as being rated as high, medium and low. In the construction of feature vectors, the association between entities can be converted into numerical representations. For example, if there is a causal relationship between two attack entities, the eigenvalue of the corresponding position is one, otherwise it is zero. At the same time, numerical features such as attack probability and impact degree are integrated to form a complete feature vector. The graph neural network model can learn the law of information propagation between nodes. For example, in a botnet attack, the infected host will gradually spread to infect other hosts. This propagation characteristic can be modeled by message passing between nodes. Through multi-layer graph convolution operations, the implicit representation of each node is finally obtained. Combining graph features with statistical features can provide a more comprehensive situational representation. For example, the implicit representation of a network scanning node reflects its importance in the attack chain, and together with statistical features such as scanning frequency, it constitutes a situational feature. Long short-term memory networks can learn the temporal regularity of attack sequences. If attack sequences such as network scanning, vulnerability exploitation, and data leakage are observed to occur multiple times, the model can learn this attack pattern. When an early attack is detected, the type of attack that may occur later can be predicted. The prediction result can be expressed as a probability value, such as predicting that the probability of a data leakage attack in the next hour is 0.8. This prediction can help adjust defense strategies in a timely manner, such as strengthening data encryption and access control. By continuously accumulating attack data, the prediction accuracy of the model will gradually improve.

[0066] Using the long short-term memory network (LSTM) model, multiple situation feature representations in time series are taken as input, and attack prediction is achieved by learning the time series evolution law of attack events.

[0067] According to the pre-established network security knowledge base, multiple situation features related to the current network environment are obtained, and for each situation feature, its time series feature representation vector is extracted. The time series feature representation vectors of the extracted multiple situation features are input into the pre-built LSTM neural network model, and the hidden layer state output at the current moment is obtained through the forward propagation calculation of the model. The hidden layer state output obtained in the previous step is compared with the pre-set attack event threshold. If it exceeds the threshold, it is judged that an attack event may occur within a certain period of time in the future, and the early warning mechanism is triggered. If it does not exceed the threshold, the current hidden layer state is used as the input of the LSTM model at the next moment, and the next round of feature extraction and attack prediction judgment is continued until an attack event is predicted or the data processing is completed. According to the back propagation algorithm of the LSTM model, the existing attack event sample data is used to train and optimize the parameters of the model, and the attack event prediction accuracy of the model is continuously improved. In the process of model application, new attack event data is continuously collected, and the model is incrementally trained and optimized regularly, so that it can adapt to the ever-changing network security situation and maintain a high attack prediction effect. Combined with other network security measures, such as intrusion detection and threat intelligence, further analyze and confirm the suspicious attack events warned by the LSTM model, and take corresponding protection and disposal measures in time to minimize the risk of attack.

[0068] Specifically, in network security situation awareness, feature extraction based on knowledge base is a key link. For example, for distributed denial of service attacks, features can be extracted from dimensions such as network traffic, number of connections, duration, and request frequency. Specifically, when a target server is detected to receive a large number of connection requests from different source addresses in a short period of time, and these requests have similar patterns, it may face attack risks. The construction of time series feature representation vectors needs to consider the changing trend of historical data. Taking network traffic analysis as an example, the traffic data of each minute can be recorded to construct a time window of fixed length, such as the traffic data of the last thirty minutes. By normalizing these data, a standardized feature vector is obtained for input into the prediction model. The long short-term memory network model has unique advantages in processing time series data. Through the synergy of input gate, forget gate and output gate, the model can effectively capture the long-term dependency of data. For example, when detecting slow attacks, the model can identify potential attack patterns by analyzing the network behavior characteristics over a longer time span. The setting of thresholds requires a trade-off between detection rate and false alarm rate. A reasonable warning threshold can be set based on statistical analysis of historical attack data. For example, when the attack probability output by the model exceeds 85%, a high-risk warning is triggered; when it is between 60% and 85%, a moderate warning is issued; when it is less than 60%, it is considered to be in a normal state. The training and optimization of the model is a continuous iterative process. By collecting real attack samples, the training data set is continuously expanded. For example, after discovering a new type of network attack, its characteristic pattern is added to the training set, and the model is retrained to enable it to recognize this new type of attack. In practical applications, the prediction results need to be coordinated with other security measures. When the model predicts a possible attack, the firewall rules can be automatically adjusted to limit the access rights of suspicious source addresses. At the same time, deep packet inspection is started to conduct a detailed analysis of suspicious traffic to confirm whether there is a real attack behavior. This multi-level protection mechanism can effectively reduce the risk of attack and improve the level of network security protection.

[0069] S106. Build a full-process automated analysis mechanism for network security situation awareness, organically integrate entity extraction, knowledge graph construction, situation prediction and other links, form an end-to-end analysis pipeline through process orchestration and scheduling technology, realize data flow and collaborative work between modules, and improve analysis efficiency.

[0070] Based on the above steps 101-105, by collecting heterogeneous data related to network security, natural language processing technology is used to pre-process the data and extract key entity information. According to the acquired entity information, the semantic association between entities is established through the knowledge graph construction algorithm to form a knowledge graph in the field of network security. The entities and relationships in the knowledge graph are represented and learned using a machine learning algorithm to obtain low-dimensional vector representations of the entities and relationships. The vector representations of entities and relationships are input into the graph neural network model, and the evolution law of network security situation is learned through the information propagation mechanism of the graph neural network. According to the output of the graph neural network model, a time series prediction algorithm is used to predict the network security situation in the future. Through process orchestration technology, data preprocessing, entity extraction, knowledge graph construction, representation learning, graph neural network prediction and other links are combined into an automated analysis pipeline. Using scheduling technology, the data flow and task scheduling between modules are controlled to achieve end-to-end automated analysis and improve the real-time and accuracy of network security situation awareness.

[0071] Specifically, some data are used as examples: network security heterogeneous data includes firewall logs, intrusion detection alarms, vulnerability scanning reports and other types. Taking firewall logs as an example, natural language processing technology can be used to extract entity information such as source and destination addresses, port numbers, and protocol types. For vulnerability scanning reports, key information such as vulnerability type, affected system, and hazard level can be extracted. In the process of building a knowledge graph, attackers, attack methods, vulnerabilities, victims, etc. can be used as entity nodes, and the association relationship between entities can be established through semantic analysis. For example, in a certain network attack incident, the attacker exploited the system vulnerability to attack the target server. Three entity nodes of attacker, vulnerability, and server can be established in the knowledge graph, and connected through relationship edges such as utilization and impact. Entities and relationships in the knowledge graph are mapped to low-dimensional vector space. For example, the attacker entity is mapped to a 100-dimensional vector, which contains the characteristic information of the attacker. Relationship edges can also be expressed in vector form to describe the semantic association strength between entities. The graph neural network model aggregates and updates node features through a message passing mechanism. Taking the server node as an example, the characteristic information of the vulnerability node and attack event node directly connected to it can be aggregated to learn the interaction pattern between nodes. Through multi-layer propagation, complex attack paths and attack chains can be captured. Time series prediction uses a sliding time window method to divide historical situation data into multiple sequence segments by time. Each time window contains multiple feature dimensions, such as attack frequency, number of vulnerabilities, and alarm level. By analyzing the temporal change patterns of these features, possible security incidents in the future can be predicted. Process orchestration technology realizes the automated collaboration of various analysis modules. For example, after the data preprocessing module is completed, the entity extraction task is automatically triggered, and the entity extraction results are automatically input into the knowledge graph construction module. Through task orchestration and scheduling, a closed-loop analysis link is formed. The scheduling system can dynamically adjust the task priority according to the data volume and computing resources to ensure analysis efficiency. The comprehensive application of the above technologies can realize real-time perception and prediction of network security situation. For example, after the system detects that a server is attacked, it can quickly locate the attack source and attack path, predict the attacker's next behavior, and provide support for defense decision-making. Through automated analysis processes, the efficiency and accuracy of situation awareness can be greatly improved.

[0072] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network security situation awareness prediction method based on knowledge graph, characterized in that: include: Acquire heterogeneous data on network security, wherein the heterogeneous data includes device information and vulnerability information; Extracting entity data and attribute data from the heterogeneous data through rule matching and machine learning models; Processing the entity data by a knowledge representation learning method to obtain semantic relationships, wherein the semantic relationships include hierarchical relationships, association relationships, causal relationships, and temporal relationships; Constructing a network security knowledge graph based on the entity data, attribute data and semantic relationships; Acquire multi-dimensional attribute feature information, fuse the network security knowledge graph and the multi-dimensional attribute information to obtain a situation feature representation, predict the situation feature representation, and obtain a network security situation awareness prediction result.

2. The method according to claim 1, characterized in that After obtaining heterogeneous data of network security, it includes: Preprocess heterogeneous data, where the preprocessing process includes data cleaning, filtering, and normalization.

3. The method according to claim 1, characterized in that The process of extracting entity data and attribute data from the heterogeneous data includes: Building a rule base for entity recognition by a rule matching method, wherein the rules may include keywords and part-of-speech patterns of the entity; Build entity extraction models and attribute extraction models based on machine learning models; Matching the heterogeneous data through a rule base to obtain first entity data; Processing the data except the first entity data in the heterogeneous data through the entity extraction model to obtain the second entity data; The first entity data and the second entity data are identified through the attribute extraction model to obtain attribute data of the entity data.

4. The method according to claim 1, characterized in that: The process of processing the entity data by the knowledge representation learning method includes: Processing the entity data by a knowledge representation learning method, mapping the entity data into a low-dimensional semantic space, and obtaining a low-dimensional semantic vector representation of the entity; Using a threshold judgment method to perform similarity judgment on the low-dimensional semantic vector representations of the entities to obtain the association relationship between the entities; The relationship between different entities is identified through the semantic recognition model to obtain hierarchical relationships, causal relationships, and temporal relationships.

5. The method according to claim 1, characterized in that The process of building a network security knowledge graph includes: Use ontology building tools to set up an ontology model of the network security knowledge graph, where the ontology model includes entity types, entity attributes, and entity relationships; Supplement and adjust the ontology model according to the entity data and attribute data, and map the semantic relationship to the ontology model to obtain an initial network security knowledge graph; The data of the initial network security knowledge graph is fused through a knowledge fusion algorithm to obtain a network security knowledge graph.

6. The method according to claim 1, characterized in that The process of obtaining multidimensional attribute feature information includes: attacking multi-dimensional attribute information of entities from a network security knowledge graph, wherein the entity data includes attacking entities, wherein the multi-dimensional attribute information includes duration, attack traffic, and target port; Entity data and association relationships associated with the attack entity are obtained, and multi-dimensional attribute information of the attack entity is fused with the entity data and association relationships associated with the attack entity to obtain multi-dimensional attribute feature information, wherein the fusion includes splicing processing.

7. The method according to claim 1, characterized in that The process of predicting the situation feature representation includes: The situation feature representation is predicted through a deep learning model to obtain a network security situation awareness prediction result.

8. The method according to claim 7, characterized in that The deep learning model uses a long short-term memory network.

Images